Consolidated demos sections and titles. Added more details to the obs…

…ervation in android-data-unencrypted-shared-storage-no-user-interaction-dynamic-frida/demo-1/demo.md

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-shared-storage-no-user-interaction/android-data-unencrypted-shared-storage-no-user-interaction-dynamic-file-diff/demo-1/demo.md

@@ -1,32 +1,42 @@
 ---
 platform: android
-title: Listing files inside External Storage 
+title: File System Snapshots from External Storage 
 tools: [adb]
 code: [kotlin]
 ---
 
 ### Sample
 
-The snippet below shows sample code that creates a file in external storage.
+The snippet below shows sample code that creates two files in the external storage using the `getExternalFilesDir` method and the `MediaStore` API.
 
 {{ MastgTest.kt }}
 
 ### Steps
 
-1. Install an app on your device
-2. Execute `run_before.sh`
-3. Open an app and exercise it to trigger file creations
-4. Execute `run_after.sh`
-5. Close the app once you finish testing
+1. Install an app on your device.
+2. Execute `run_before.sh`.
+3. Open an app and exercise it to trigger file creations.
+4. Execute `run_after.sh`.
+5. Close the app once you finish testing.
 
 {{ run.sh }}
 
 ### Observation
 
-There is a list of all created files inside `output.txt`. Their content is inside the `./new_files/` directory.
+There is a list of all created files inside `output.txt`.
 
 {{ output.txt }}
 
+Their content is inside the `./new_files/` directory and contains:
+
+A password:
+
+{{ secret.txt }}
+
+And an API key:
+
+{{ secretFile75.txt }}
+
 ### Evaluation
 
-This test fails because the file contains a secretFile.txt.
+This test fails because the files are not encrypted and contain sensitive data (a password and an API key). You can further confirm this by reverse engineering the app and inspecting the code.

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-shared-storage-no-user-interaction/android-data-unencrypted-shared-storage-no-user-interaction-dynamic-frida/demo-1/demo.md

@@ -1,30 +1,43 @@
 ---
 platform: android
-title: File Tracing with Frida
+title: External Storage APIs Tracing with Frida
 tools: [frida]
 code: [kotlin]
 ---
 
 ### Sample
 
-The snippet below shows sample code that creates a file in external storage.
+The snippet below shows sample code that creates two files in the external storage using the `getExternalFilesDir` method and the `MediaStore` API.
 
 {{ MastgTest.kt }}
 
 ### Steps
 
-1. Update the Package ID of your app inside `run.sh`
-2. Execute `run.sh` against the sample app to trace all usage of file IO.
-3. Close the app once you finish testing
+1. Ensure the app is running on the target device.
+2. Execute `run.sh`.
+3. Close the app once you finish testing.
+
+The `run.sh` script will inject a Frida script called `script.js`.
 
 {{ run.sh }}
 
+The Frida script will hook and log calls to `open` and `android.content.ContentResolver.insert`.
+
+{{ script.js }}
+
 ### Observation
 
-There is only one file written to the external storage - `/storage/emulated/0/Android/data/org.owasp.mastestapp/files/secret.json`.
+In the output you can see the paths and the relevant stack trace which helps to identify the actual APIs used to write to external storage and their respective callers.
 
 {{ output.txt }}
 
+There are two files written to the external storage:
+
+- `/storage/emulated/0/Android/data/org.owasp.mastestapp/files/secret.txt` written using `java.io.FileOutputStream` from `org.owasp.mastestapp.MastgTest.mastgTestApi(MastgTest.kt:26)`
+- `content:https://media/external/downloads/27` written using `android.content.ContentResolver.insert` from `org.owasp.mastestapp.MastgTest.mastgTestMediaStore(MastgTest.kt:44)`
+
+Note that the calls via `ContentResolver.insert` do not write directly to the file system, but to the `MediaStore` content provider, and therefore we can't see the actual file path, instead we see the `content:https://` URI.
+
 ### Evaluation
 
-This test fails since the file contains a password.
+This test fails because the files are not encrypted and contain sensitive data (a password and an API key). You can further confirm this by reverse engineering the app and inspecting the code as well as retrieving the files from the device.

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-shared-storage-no-user-interaction/android-data-unencrypted-shared-storage-no-user-interaction-static/demo-1/demo.md

@@ -1,17 +1,21 @@
 ---
 platform: android
-title: Find common APIs that return paths to Public External Storage locations
+title: App Writing to External Storage without Scoped Storage Restrictions
 tools: [semgrep]
 code: [kotlin, xml]
 ---
 
 ### Sample
 
-The snippet below shows sample code that creates a file in external storage.
+The snippet below shows sample code that creates a file in external storage without using scoped storage APIs. The `getExternalStorageDirectory` API returns a path to the root of the shared external storage (e.g. `/storage/emulated/0`).
+
+{{ MastgTest.kt }}
 
 {{ MastgTest_reversed.java }}
 
-This requires special app access called ["All files access"](https://developer.android.com/preview/privacy/storage#all-files-access), so the following permission must be declared in the manifest file.
+This requires special app access called ["All files access"](https://developer.android.com/preview/privacy/storage#all-files-access), so the `MANAGE_EXTERNAL_STORAGE` permission must be declared in the manifest file.
+
+{{ AndroidManifest.xml }}
 
 {{ AndroidManifest_reversed.xml }}
 

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-shared-storage-no-user-interaction/android-data-unencrypted-shared-storage-no-user-interaction-static/demo-2/demo.md

@@ -1,12 +1,16 @@
 ---
 platform: android
-title: Find common APIs that return paths to Scoped External Storage locations
+title: App Writing to External Storage with Scoped Storage Restrictions
 tools: [semgrep]
 code: [kotlin]
 ---
 
 ### Sample
 
+The snippet below shows sample code that creates a file in external storage using the `getExternalFilesDir` API which returns a path to the app's external files directory (e.g. `/storage/emulated/0/Android/data/org.owasp.mastestapp/files`) and does not require any permissions to access. Scoped storage applies since the app targets Android 12 (API level 31) which is higher than Android 10 (API level 29).
+
+{{ MastgTest.kt }}
+
 {{ MastgTest_reversed.java }}
 
 ### Steps
@@ -19,10 +23,10 @@ Let's run our semgrep rule against the reversed java code.
 
 ### Observation
 
-The rule has identified one location in the code file where a path to scoped external storage is returned.
+The rule has identified one location in the code file where an API, `getExternalFilesDir`, is used to write to external storage with scoped storage restrictions.
 
 {{ output.txt }}
 
 ### Evaluation
 
-Review the decompiled code at the location specified in the output (file and line number). This test fails because the file written by this instance contains sensitive data, specifically a password.
+After reviewing the decompiled code at the location specified in the output (file and line number) we can conclude that the test fails because the file written by this instance contains sensitive data, specifically a password.

risks/MASVS-STORAGE/1-store-sensitive-data-securely/data-unencrypted-shared-storage-no-user-interaction/android-data-unencrypted-shared-storage-no-user-interaction-static/demo-3/demo.md

@@ -1,12 +1,16 @@
 ---
 platform: android
-title: Find MediaStore APIs that writes data to locations shared with other apps
+title: App Writing to External Storage via the MediaStore API
 tools: [semgrep]
 code: [kotlin]
 ---
 
 ### Sample
 
+The snippet below shows sample code that uses the `MediaStore` API to write a file to shared storage in a path like `/storage/emulated/0/Download/` which does not require any permissions to access and is shared with other apps.
+
+{{ MastgTest.kt }}
+
 {{ MastgTest_reversed.java }}
 
 ### Steps
@@ -23,9 +27,8 @@ The rule has identified 2 locations that indicate a use of MediaStore API.
 
 {{ output.txt }}
 
-### Evaluation
+The first location is the import statement for the `MediaStore` API and the second location is where the `MediaStore` API is used to write to shared storage.
 
-Review the reported instances and make sure to either:
+### Evaluation
 
-- confirm you intended to make this data public
-- store this data in a more strict storage type
+After reviewing the decompiled code at the locations specified in the output (file and line number) we can conclude that the test fails because the file written by this instance contains sensitive data, specifically a API key.