Android/IOS应用静态资源分析工具：truegaze，关注源代码之外的安全问题

发表于 2019年08月21日
安全工具

目录表

truegaze Android/IOS应用静态分析工具

一个针对 Android 和 iOS 应用程序的静态分析工具，专注于源代码之外的安全问题，如资源字符串、第三方库和配置文件等。

Android/IOS应用静态资源分析工具：truegaze，关注源代码之外的安全问题

依赖

Python 3是必需的，您可以在 requirements.txt 文件中找到所有必需的模块。只在 Python 3.7上测试过，但应该可以在其他3. x 版本上使用。目前还没有支持2.x 的计划。

truegaze 安装

你可以通过如下的 PIP 安装它:

pip install truegaze
truegaze

1 2	pip install truegaze truegaze

要手动下载和运行，请执行以下操作:

git clone https://github.com/nightwatchcybersecurity/truegaze.git
cd truegaze
pip -r requirements.txt
python -m truegaze.cli

git clone https://github.com/nightwatchcybersecurity/truegaze.git

cd truegaze

pip -r requirements.txt

python -m truegaze.cli

truegaze 使用

列出模块:

truegaze list

1	truegaze list

要扫描应用程序：

truegaze scan test.apk
truegaze scan test.ipa

1 2	truegaze scan test.apk truegaze scan test.ipa

样本输出

清单模块:

user@localhost:~/$ truegaze list
Total active plugins: 1
+----------------+------------------------------------------+---------+------+
|      Name      |               Description                | Android | iOS  |
+----------------+------------------------------------------+---------+------+
| AdobeMobileSdk | Detection of incorrect SSL configuration |  True   | True |
|                |         in the Adobe Mobile SDK          |         |      |
+----------------+------------------------------------------+---------+------+

user@localhost:~/$ truegaze list

Total active plugins: 1

+----------------+------------------------------------------+---------+------+

+----------------+------------------------------------------+---------+------+

+----------------+------------------------------------------+---------+------+

扫描应用程序：

user@localhost:~/$ truegaze scan ~/test.ipa
Identified as an iOS application via a manifest located at: Payload/IPAPatch-DummyApp.app/Info.plist
Scanning using the "AdobeMobileSdk" plugin
-- Found 1 configuration file(s)
-- Scanning "Payload/IPAPatch-DummyApp.app/Base.lproj/ADBMobileConfig.json'
---- FOUND: The ["analytics"]["ssl"] setting is missing or false - SSL is not being used
---- FOUND: The ["remotes"]["analytics.poi"] URL doesn't use SSL: http://assets.example.com/c234243g4g4rg.json
---- FOUND: The ["remotes"]["messages"] URL doesn't use SSL: http://assets.example.com/b34343443egerg.json
---- FOUND: A "templateurl" in ["messages"]["payload"] doesn't use SSL: http://my.server.com/?user={user.name}&zip={user.zip}&c16={%sdkver%}&c27=cln,{a.PrevSessionLength}
---- FOUND: A "templateurl" in ["messages"]["payload"] doesn't use SSL: http://my.43434server.com/?user={user.name}&zip={user.zip}&c16={%sdkver%}&c27=cln,{a.PrevSessionLength}
Done!

user@localhost:~/$ truegaze scan ~/test.ipa

Identified as an iOS application via a manifest located at: Payload/IPAPatch-DummyApp.app/Info.plist

Scanning using the "AdobeMobileSdk" plugin

-- Found 1 configuration file(s)

-- Scanning "Payload/IPAPatch-DummyApp.app/Base.lproj/ADBMobileConfig.json'

---- FOUND: The ["analytics"]["ssl"] setting is missing or false - SSL is not being used

---- FOUND: The ["remotes"]["analytics.poi"] URL doesn't use SSL: http://assets.example.com/c234243g4g4rg.json

---- FOUND: The ["remotes"]["messages"] URL doesn't use SSL: http://assets.example.com/b34343443egerg.json

---- FOUND: A "templateurl" in ["messages"]["payload"] doesn't use SSL: http://my.server.com/?user={user.name}&zip={user.zip}&c16={%sdkver%}&c27=cln,{a.PrevSessionLength}

---- FOUND: A "templateurl" in ["messages"]["payload"] doesn't use SSL: http://my.43434server.com/?user={user.name}&zip={user.zip}&c16={%sdkver%}&c27=cln,{a.PrevSessionLength}

Done!

显示已安装版本:

user@localhost:~/$ truegaze version
Current version: v0.2

1 2	user@localhost:~/$ truegaze version Current version: v0.2

标签：Android , IOS , pip , Python , 静态分析原文连接：Android/IOS应用静态资源分析工具：truegaze，关注源代码之外的安全问题 所有媒体，可在保留署名、原文连接的情况下转载，若非则不得使用我方内容。

MySQL binlog太大，如何优化及清理/删除binlog PEpper - PE文件恶意软件静态分析的开源脚本