Dynamic Analysis Of Android Applications Tool

Inspeckage is a tool developed to offer dynamic analysis of Android applications. By applying hooks to functions of the Android API, Inspeckage will help you understand what an Android application is doing at runtime.

Features

 Information gathering

• Requested Permissions;
• App Permissions;
• Shared Libraries;
• Exported and Non-exported Activities, Content Providers,Broadcast Receivers and Services;
• Check if the app is debuggable or not;
• Version, UID and GIDs;
• etc.

== Hooks (so far)

With the hooks, we can see what the application is doing in real time:

• Shared Preferences (log and file);
• Serialization;
• Crypto;
• Hashes;
• SQLite;
• HTTP (an HTTP proxy tool is still the best alternative);
• File System;
• Miscellaneous (Clipboard, URL.Parse());
• WebView;
• IPC.

Actions

With Xposed it's possible to perform actions such as start a unexported activity and much else:

• Start any activity (exported and unexported);
• Call any provider (exported and unexported);
• Disable FLAG_SECURE;
• SSL uncheck;
• Start, stop and restart the application.

 Extras

• APK Download;
• View the app's directory tree;
• Download the app's files;
• Download the output generated by hooks in text file format;
• Take a screen capture;

Configuration

Even though our tool has some hooks to the HTTP libraries, using an external proxy tool is still the best option to analyze the app's traffic. With Inspeckage, you can:

• Add a proxy to the target app;
• Enable and disable proxy;
• Add entries in the arp table.

Installation

Requirements: Xposed Framework

Xposed Installer

1. Go to Xposed Installer, select "Download"
2. Refresh and search for "Inspeckage"
3. Download the latest version and install
4. Enable it in Xposed
5. Reboot and enjoy!

Xposed Repository

Get it from Xposed repo: http://repo.xposed.info/module/mobi.acpm.inspeckage

    adb install mobi.acpm.inspeckage.apk

1. Enable it in Xposed
2. Reboot and enjoy!

From Source

Feel free to download the source!

How to uninstall

    adb uninstall mobi.acpm.inspeckage.apk  

Screenshots









Download tool : https://goo.gl/TcCR05

Md5crack Online Tools

Support online crack md5, and support for plug-in development mode, the plug has been templated directly using the template file 'plugin / template.py' you can quickly add new sites to crack md5

Provides the following functions 

1, support the development of plug-in to facilitate increased late and delete

2, plug-templated facilitate development

3, support for multi-threaded and single-threaded crack

4, plug-in template matching algorithm does not use regular and BeautifulSoup, but the character of the scan so that the site will be higher compatibility, plug-in development process does not need to be concerned about the regular matching problem, simply grasp that Web content can be

5, support for Google search on MD5 value (Note: Thanks QQ: 374331370 brothers xmd5 account, do not want to apply for this site account, so the direct use)  

[+] site: http://cracker.blackbap.org/ 

[+] site: http://www.hashcracker.org/ 

[+] site: http://www.cmd5.com/ 

[+] site: http://www.md5.com.cn/ 

[+] site: http://md5.gromweb.com/ 

[+] site: http://md5decryption.com/ 

[+] site: http://md5.my-addr.com/ 

[+] site: http://www.md5-hash.com/ 

[+] site: http://md5pass.info/ 

[+] site: http://www.md5this.com/ 

[+] site: http://www.netmd5crack.com/ 

[+] site: http://www.2d5.net/ 

[+] site: http://md5online.net/ 

[+] site: http://requnix.tk/ 

[+] site: http://md5.rednoize.com/ 

[+] site: http://md5.noisette.ch/ 

[+] site: http://www.xmd5.com/ 

Web Scanner Tool

WhatWeb identifies websites. Its goal is to answer the question, "What is that Website?". WhatWeb recognises web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 1500 plugins, each to recognise something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more.

WhatWeb can be stealthy and fast, or thorough but slow. WhatWeb supports an aggression level to control the trade off between speed and reliability. When you visit a website in your browser, the transaction includes many hints of what web technologies are powering that website. Sometimes a single webpage visit contains enough information to identify a website but when it does not, WhatWeb can interrogate the website further. The default level of aggression, called 'stealthy', is the fastest and requires only one HTTP request of a website. This is suitable for scanning public websites. More aggressive modes were developed for use in penetration tests.

Most WhatWeb plugins are thorough and recognise a range of cues from subtle to obvious. For example, most WordPress websites can be identified by the meta HTML tag, e.g. '<meta name="generator" content="WordPress 2.6.5">', but a minority of WordPress websites remove this identifying tag but this does not thwart WhatWeb. The WordPress WhatWeb plugin has over 15 tests, which include checking the favicon, default installation files, login pages, and checking for "/wp-content/" within relative links.


Features:
 * Over 1500 plugins
 * Control the trade off between speed/stealth and reliability
 * Performance tuning. Control how many websites to scan concurrently. 

 * Multiple log formats: Brief (greppable), Verbose (human readable), XML, JSON, MagicTree, RubyObject, MongoDB.  

 * Proxy support including TOR
 * Custom HTTP headers
 * Basic HTTP authentication
 * Control over webpage redirection
 * Nmap-style IP ranges
 * Fuzzy matching
 * Result certainty awareness
 * Custom plugins defined on the command line  

How To Install : 

Download tool : https://goo.gl/fmjzNx

Python Tool For FTP Fuzzer

SFTPfuzzer (Simple FTP Fuzzer) is a very simple software written in Python 2.7 (by 0x8b30cc), that allows you to easily fuzz username and password field in an FTP Server, looking for a buffer overflow vulnerability. 

SFTPfuzzer is written in a very simple way, and the code is well commented, allowing you to easily understand what is going on and easily edit the software. The code is licensed under GNU General Public License (GPL v3), if you want to know more read  

How to use :   

step 1 . $ python SFTPfuzzer.py   

step 2 . $ SFTPfuzzer.py -t <rhost> -p <rport>  

step 3 . $ python SFTPfuzzer.py -t 176.20.50.165 -p 21  

Screenshot :  

Download Tool : https://goo.gl/I5vR69

linux_mem_diff_tool

Script to perform Linux Memory Diff Analysis Using Volatility 

Tool Options : 

The screen shot below shows the usage options

-c  path to the clean memory image
-i  path to the infected memory image
-p profile for the memory images, the profile for the clean and the infected memory image has to be same. The profile can be created by following the procedure mentioned. 

-o path to the file where analysis results will be stored, this is an optional argument. If this option is not given the analysis results are stored in "final_report.txt" in the current working directory. 

-v performs verbose diff analysis. This is again optional. 

By default the script performs non verbose Diff analysis by running most plugins against the clean and infected memory images. In the non verbose mode (default) it skips few plugins which takes some time. with -v option the script runs all the plugins including the slow running plugins because of which it will be slow and can take a while to complete.  

Download tool : https://goo.gl/9zJtj8