Thursday 26 November 2015

Web Debugging Proxy based on Chrome DevTools Network panel.

Betwixt

This tool will help you analyze web traffic outside the browser using familiar Chrome DevTools interface.

This project is in an early stage of development, things may break, values may not be accurate. All contributors are very welcome. See CONTRIBUTING.md fore more details.

How To Use

To clone and run this repository you'll need Git and Node.js 5.x (which comes with npm) installed on your computer. From your command line:

# Clone this repository
$ git clone https://github.com/kdzwinel/betwixt.git
# Go into the repository
$ cd betwixt
# Install dependencies and run the app
$ npm install && npm start

In order to capture traffic, you'll have to direct it to the proxy created by Betwixt in the background (http://localhost:8008).

If you wish to analyze traffic system wide:

on OS X - System Preferences → Network → Advanced → Proxies → Web Proxy (HTTP)
on Ubuntu - All Settings → Network → Network Proxy
on Windows - PC Settings → Network → Proxy

If you want to capture traffic coming from a single terminal (e.g. wget, npm) use export http_proxy=http://localhost:8008.

Quick Android Review Kit

Quick Android Review Kit - This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating "Proof-of-Concept" deployable APKs and/or ADB commands, capable of exploiting many of the vulnerabilities it finds. There is no need to root the test device, as this tool focuses on vulnerabilities that can be exploited under otherwise secure conditions.

How to install

To run in interactive mode:

$ python qark.py

To run in headless mode:

$ python qark.py --source 1 --pathtoapk /Users/foo/qark/sampleApps/goatdroid/goatdroid.apk --exploit 1 --install 1

or
$ python qark.py --source 2 -c /Users/foo/qark/sampleApps/goatdroid/goatdroid --manifest /Users/foo/qark/sampleApps/goatdroid/goatdroid/AndroidManifest.xml --exploit 1 --install 1

The sampleApps folder contains sample APKs that you can test against QARK

Requirements

python 2.7.6
JRE 1.6+ (preferably 1.7+)
OSX or Ubuntu Linux (Others may work, but not fully tested)

Documentation

QARK is an easy to use tool capable of finding common security vulnerabilities in Android applications. Unlike commercial products, it is 100% free to use. QARK features educational information allowing security reviewers to locate precise, in-depth explanations of the vulnerabilities. QARK automates the use of multiple decompilers, leveraging their combined outputs, to produce superior results, when decompiling APKs. Finally, the major advantage QARK has over traditional tools, that just point you to possible vulnerabilities, is that it can produce ADB commands, or even fully functional APKs, that turn hypothetical vulnerabilities into working "POC" exploits.

Included in the types of security vulnerabilities this tool attempts to find are:

Inadvertently exported components
Improperly protected exported components
Intents which are vulnerable to interception or eavesdropping
Improper x.509 certificate validation
Creation of world-readable or world-writeable files
Activities which may leak data
The use of Sticky Intents
Insecurely created Pending Intents
Sending of insecure Broadcast Intents
Private keys embedded in the source
Weak or improper cryptography use
Potentially exploitable WebView configurations
Exported Preference Activities
Tapjacking
Apps which enable backups
Apps which are debuggable
Apps supporting outdated API versions, with known vulnerabilities

Roadmap

Things that are coming soon:

Rewrite of code to support extensibility
Bound Service vulnerability detection and exploitation
Content Provider vulnerability detection and exploitation
Additional WebView configuration demonstrations
Static Tapjacking mitigation detection
File browser capable of using root permissions

Notice

Note: QARK decompiles Android applications back to raw source code. Please do not use this tool if this may be considered illegal in your juristdiction. If you are unsure, seek legal counsel.

If you run into issues on OSX, especially relating to the outbound call to the Play Store, or the downloading of the SDK, it is likely due to your Python/OpenSSL configuration and the fact that recent changes in OSX impacted Python installed via brew. Nuking your Python installation(s) and re-installing from source may fix your issues.

License

Copyright 2015 LinkedIn Corp. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.  You may obtain a copy of the License athttp://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software  distributed under the License is distributed on an "AS IS" BASIS,  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

download tool : https://github.com/linkedin/qark