wargio/fufluns

Easy to use APK/IPA Mobile App Inspector

fufluns's Issues

allowBackup android

test for android:allowBackup="true"

The mobile application uses external backup functionality (default Android backup mechanism) that may store inside sensitive data from the application. In certain conditions, this may lead to information disclosure (e.g. when a backup server or your Gmail account is compromised).

Improve iOS ASLR short description

Full ASLR (-pie) with CVSS 4 is not acceptable.

Broken Markdown generator

Sometimes the markdown generator fails to create valid markdown, due a throw done by the repeat function.

TODO List

Android

• Check APK Signature
  • rizin can open META-INF/CERT.RSA and print the pkcs7 data from pFp
• Check Certificates and validity, bad hashes, etc..
• Detect trackers
• App is debuggable example
• Exported example issue - Partial
• Test all android security best practies link

iOS

• Weak rand function
• Sandbox Behavior (like successfully use fork() because calls to fork() are disallowed on a stock iOS device).
• TrustKit pinning.

Redefine CVSS on api keys (too high)

Error in ipa and apk analysis

I've tried to analysis the ipa and apk files and get an error:

Exception in thread Thread-2:
Traceback (most recent call last):
  File "/usr/lib/python3.8/threading.py", line 932, in _bootstrap_inner
    self.run()
  File "/usr/lib/python3.8/threading.py", line 870, in run
    self._target(*self._args, **self._kwargs)
  File "/fufluns/ios/ipa.py", line 56, in _ipa_analysis
    raise e
  File "/fufluns/ios/ipa.py", line 53, in _ipa_analysis
    mod.run_tests(ipa, r2, utils, r2help)
  File "/fufluns/ios/tests/bininfo.py", line 7, in run_tests
    o.binary.classes(filename, r2h.cmdj(r2, 'icj'))
  File "/fufluns/r2help.py", line 14, in cmdj
    return json.loads(v.replace('\\x', '\\u00'), strict=False)
  File "/usr/lib/python3.8/json/__init__.py", line 370, in loads
    return cls(**kw).decode(s)
  File "/usr/lib/python3.8/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/usr/lib/python3.8/json/decoder.py", line 353, in raw_decode
    obj, end = self.scan_once(s, idx)
json.decoder.JSONDecodeError: Expecting ',' delimiter: line 1 column 47 (char 46)

fufluns from master branch and was started in docker