Merge pull request #1918 from HackTricks-wiki/research_update_src_mobile-pentesting_android-checklist_20260219_132002

Research Update Enhanced src/mobile-pentesting/android-check...

Author: carlospolop

src/mobile-pentesting/android-checklist.md

@@ -47,6 +47,7 @@
   - `flutter-packer`, `fluttersign`, `rn-differ`
 - [ ] Scan third-party native libraries for known CVEs (e.g., **libwebp CVE-2023-4863**, **libpng**, etc.).
 - [ ] Evaluate **SEMgrep Mobile rules**, **Pithus** and the latest **MobSF ≥ 3.9** AI-assisted scan results for additional findings.
+- [ ] Check OEM ROM add-ons (OxygenOS/ColorOS/MIUI/OneUI) for extra **exported ContentProviders** that bypass permissions; try `content query --uri content://com.android.providers.telephony/ServiceNumberProvider` without `READ_SMS` (e.g., OnePlus CVE-2025-10184).
 
 ### [Dynamic Analysis](android-app-pentesting/index.html#dynamic-analysis)
 
@@ -66,10 +67,11 @@
 - [ ] Attempt **overlay / SYSTEM_ALERT_WINDOW clickjacking** and **Accessibility Service abuse** for privilege escalation.
 - [ ] Check if `adb backup` / `bmgr backupnow` can still dump app data (apps that forgot to disable `allowBackup`).
 - [ ] Probe for **Binder-level LPEs** (e.g., **CVE-2023-20963, CVE-2023-20928**); use kernel fuzzers or PoCs if permitted.
-- [ ] If Play Integrity / SafetyNet is enforced, try runtime hooks (`Frida Gadget`, `MagiskIntegrityFix`, `Integrity-faker`) or network-level replay.
+- [ ] If Play Integrity / SafetyNet is enforced, try runtime hooks (`Frida Gadget`, `MagiskIntegrityFix`, `Integrity-faker`) or network-level replay. Recent Play Integrity Fix forks (≥17.x) embed `playcurl`—focus on ZygiskNext + PIF + ZygiskAssistant/TrickyStore combinations to regain DEVICE/STRONG verdicts.
 - [ ] Instrument with modern tooling:
-  - **Objection > 2.0**, **Frida 17+**, **NowSecure-Tracer (2024)**
+  - **Objection > 2.0**, **Frida 17+ (Android 16 support, ART offset fixes)**, **NowSecure-Tracer (2024)**
   - Dynamic system-wide tracing with `perfetto` / `simpleperf`.
+- [ ] For OEM telephony/provider bugs (e.g., OxygenOS CVE-2025-10184), attempt **permission-less SMS read/send** via the `content` CLI or in-app `ContentResolver`; test blind SQLi in `update()` to exfiltrate rows.
 
 ### Some obfuscation/Deobfuscation information
 
@@ -79,5 +81,7 @@
 ## References
 
 - [CVE-2025-59489 – Arbitrary Code Execution in Unity Runtime (blog)](https://flatt.tech/research/posts/arbitrary-code-execution-in-unity-runtime/)
+- [Rapid7: CVE-2025-10184 OnePlus OxygenOS Telephony provider permission bypass](https://www.rapid7.com/blog/post/cve-2025-10184-oneplus-oxygenos-telephony-provider-permission-bypass-not-fixed/)
+- [TapTrap animation-based tapjacking research (TU Wien)](https://www.tomsguide.com/computing/online-security/this-new-android-attack-could-trick-you-into-compromising-your-own-phone-everything-you-need-to-know)
 
-{{#include ../banners/hacktricks-training.md}}
+{{#include ../banners/hacktricks-training.md}}