Proposed tool: Online assessment autosubmitter and result collector - Githubissues

TamerPlatform / Tools_Repository

This repository will only hold issues around various Tools to be bundled in AndroidTamer

12 stars 5 forks source link

Proposed tool: Online assessment autosubmitter and result collector #14

Open anantshri opened 8 years ago

anantshri commented 8 years ago

A shell script / python code which autosubmits to various online services and keep a tab when results are available.

preferably also co-related the results and agregates the list of findings or at the least list out all findings in one place where human can co-relate with them.

Todo:

[ ] Identify various online services that will allow online assessment
[ ] Identify how many will allow us to upload apk and later retrieve result.
[ ] Store all results in a local DB (preferably sqlite)
[ ] Display the data in a single page with tab's or views from each assessment website

Nice-to-have feature

[ ] co-relation and unique finding view.

anantshri commented 8 years ago

http://docs.koodous.com/

anantshri commented 7 years ago

https://android.fallible.co/#

anantshri commented 7 years ago

http://judge.rednaga.io

anantshri commented 7 years ago

http://www.apk-deguard.com

anantshri commented 7 years ago

https://mobilesecuritywiki.com/#-online-analyzers-

anantshri commented 7 years ago

https://github.com/Koodous/python-sdk

Chan9390 commented 7 years ago

Detailed Description

andrototal.org

Scanning the apk for malwares takes so long and the pages keeps reloading
Good for searching with md5 hashes
Shows the following info in the analysis report:
- Sample SHA-256
- Sample SHA-1
- Sample MD5
- Package name
- Min sdk version
- Target sdk version
- Main activity
- Activities
- Requested permissions
- Package files

akana.mobiseclab.org

No use. Requires Invite code for sign up.

copperdroid.isg.rhul.ac.uk/copperdroid/

Requires CAPTCHA to get the result. Cannot be automated.

dexter.dexlabs.org

Seems good.
Provides the following:
- Filename
- App package name
- Version
- Minimum SDK Version
- Target SDK Version
- Checksum - MD5
- Developer (Signature)
- Shared UID
- No of methods referenced
- Used permissions
- Defined permissions
- Activities
- Services
- Broadcast receivers
- Content providers
It also provides Program statistics which include the following
- Classes per package
- Basic blocks per package
- Obfuscated vs. unobfuscated packages
- Internal vs. external packages
Has package dependency chart
Provides detailed class list, along with details of superclasses, interfaces, packages and methods
Really awesome

mobiseclab.org/eacus.jsp

Gives the following info:
- AppName
- Package
- MD5
- SHA-1
- Version
- Signature
- PublicKey
- sig_version
- sig_serialnum
- Basic Analysis
- Re-pack Check
- ADs Check
- Obfuscator Check
- Virus DB Check
- Embedded APK Check
- Plugin Analysis
- FakeID Check
- Root Check
- Smishing Check
- Masterkey Check
- Advance Analysis
- Behavior Check
- Heuristic Check
- Privilege Check

mobilesandbox.org

Allows anonymous submission
Does the following analysis:
- Static Analysis
- Is this Sample malicious? (Classification)
- SHA256
- MD5
- ssdeep
- Used Features
- Requested Permissions from Android Manifest
- Used Permissions
- Responsible API calls for used Permissions
- Used Intents
- Used Activities
- Potentially dangerous Calls
- Used Services and Receiver
- Used Providers
- Used Networks
- Found hardcoded URLs and IPs
- Dynamic Analysis
- VirusTotal
- processes
- listening
- Network
  - UDP
  - TCP
- Certificate
- Screenshots
It allows to download the decompiled source code
One of the best free tools on internet

apkscan.nviso.be

Allows anonymous submissions
Allows to send the report in a mail
API available - Free plan has 100 /hr

sanddroid.xjtu.edu.cn

Static Analysis:
- Basic Information Extraction
- Certification Analysis
- Category Analysis
- Permission Analysis
- Component Analysis
- Code Feature Analysis
- Advertisement Module Analysis
- Sensitive API Analysis
Dynamic Analysis
- Network Data Record
- Http Data Recovery
- IP Distribution Analysis
- File Operation Monitor
- SMS & Phone Call Monitor
- SMS Block Monitor
- Crypto Operation Monitor
- Data Leakage Monitor
Comprehensive Analysis：
- Risky Behaviors Summary
- Risk Score
Gives the screenshot of the dynamic analysis

virustotal.com

API access and much more

android.fallible.co

Secrets in XML files
APIs
Service List

judge.rednaga.io

MD5, SHA1, SHA256 search functionality
Allows anonymous uploads
Judgement
- Label
- Confidence Score
- Engine Version
Hashes
- SHA256
- SHA1
- MD5
APKiD Results
APK Judge Results

apk-deguard.com

Statistical Deobfuscation for Android
Allows the download of deobfuscated tools

koodous.com

API access available
Analysis reports contain the following:
- File info
- Androguard analysis report
- Network
- Droidbox analysis
- Strings - Includes comments, path elements, etc
- Results in JSON format

anantshri commented 6 years ago

github.com/kudelskisecurity/check_all_apks <- nice idea to get checksums of all apk's and run them past VT. However its too convaluted. why require drozer etc when you can get package out from phone by using pm list package etc so a simple rewrite of this tool could be done or we can simple take apk's checksum and match at vt also.