wargio / fufluns Goto Github PK

View Code? Open in Web Editor NEW

70.0 5.0 10.0 123 KB

Easy to use APK/IPA Mobile App Inspector

Home Page: https://kumo.みんな/2020-03-02.html

License: GNU General Public License v3.0

Python 64.31% HTML 4.10% JavaScript 15.33% CSS 15.60% Shell 0.06% Dockerfile 0.60%

docker inspector ipa-mobile android apk rizin radare2 mobsf

fufluns's Introduction

Fufluns

Easy to use APK/IPA Mobile App Inspector

Features

Detects common fails in compiled apps for Android and iOS (iPhones, iPads, etc..)

Android
- APKiD
- Secrets (Private keys, API keys, etc..)
- Insecure AndroidManifest.xml attributes
- Network Security
- Permissions
- Root Detection
- Source Code
- SQL Injections
iOS
- Compiler options (-fstack-protector-all, -fobjc-arc, -pie, etc..)
- Insecure C imports (memcmp, memcpy, memmove, memset, etc..)
- Jailbreak Detection
- Network Security
- Permissions
- Secrets (Private keys, API keys, etc..)
- Source Code
- SQL Injections

Export

The tool allows to export the data in JSON, Markdown and Textile formats.

Tools Required

APKiD
Apktool (and the Android Platform Tools)
rizin (python rzpipe)

Docker

You can download it from docker hub or build it by yourself.

Download from docker hub

# Download first the image
docker pull deroad/fufluns:latest .
# run the image
docker run -it --rm -p 8080:8080 deroad/fufluns:latest

Or Build from sources

To build a docker image just run

# Build first the image
docker build -t fufluns:latest .
# Run the built image
docker run -it --rm -p 8080:8080 fufluns:latest

Debug

To debug http traffic, you need to define the environment variable 'DEBUG_MODE'.

For example:

DEBUG_MODE=1 ./fufluns.sh

Development

Check the documents here: https://github.com/wargio/fufluns/blob/master/DOCS.md

fufluns's People

Contributors

Stargazers

Watchers

Forkers

timb-machine-mirrors akshayjaing crackercat slooppe infosecdad 4val0v polling-repo-continua ckandroidproject dukebarman

fufluns's Issues

Error in ipa and apk analysis

I've tried to analysis the ipa and apk files and get an error:

Exception in thread Thread-2:
Traceback (most recent call last):
  File "/usr/lib/python3.8/threading.py", line 932, in _bootstrap_inner
    self.run()
  File "/usr/lib/python3.8/threading.py", line 870, in run
    self._target(*self._args, **self._kwargs)
  File "/fufluns/ios/ipa.py", line 56, in _ipa_analysis
    raise e
  File "/fufluns/ios/ipa.py", line 53, in _ipa_analysis
    mod.run_tests(ipa, r2, utils, r2help)
  File "/fufluns/ios/tests/bininfo.py", line 7, in run_tests
    o.binary.classes(filename, r2h.cmdj(r2, 'icj'))
  File "/fufluns/r2help.py", line 14, in cmdj
    return json.loads(v.replace('\\x', '\\u00'), strict=False)
  File "/usr/lib/python3.8/json/__init__.py", line 370, in loads
    return cls(**kw).decode(s)
  File "/usr/lib/python3.8/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/usr/lib/python3.8/json/decoder.py", line 353, in raw_decode
    obj, end = self.scan_once(s, idx)
json.decoder.JSONDecodeError: Expecting ',' delimiter: line 1 column 47 (char 46)

fufluns from master branch and was started in docker

Broken Markdown generator

Sometimes the markdown generator fails to create valid markdown, due a throw done by the repeat function.

allowBackup android

test for android:allowBackup="true"

The mobile application uses external backup functionality (default Android backup mechanism) that may store inside sensitive data from the application. In certain conditions, this may lead to information disclosure (e.g. when a backup server or your Gmail account is compromised).

TODO List

Android

Check APK Signature
- rizin can open META-INF/CERT.RSA and print the pkcs7 data from pFp
Check Certificates and validity, bad hashes, etc..
Detect trackers
App is debuggable example
Exported example issue - Partial
Test all android security best practies link

iOS

Weak rand function
Sandbox Behavior (like successfully use fork() because calls to fork() are disallowed on a stock iOS device).
TrustKit pinning.

Improve iOS ASLR short description

Full ASLR (-pie) with CVSS 4 is not acceptable.