search

reddr / LibScout

LibScout: Third-party library detector for Java/Android apps
Apache License 2.0
283 stars 48 forks source link

Library Version - Incorrect #6

Closed narayan8291 closed 6 years ago

narayan8291 commented 6 years ago

Hi, I am scanning a mobile app using LibScout. We are using the okhttp3 library and the version used is 3.10.0. This is done using gradle in Android Studio : 'com.squareup.okhttp3:mockwebserver:3.10.0'.

When I scan this binary using LibScout it reports 3.6.0 version. I was wondering which file is used within okhttp3 to fingerprint the version.

reddr commented 6 years ago

The pre-generated profiles include the version from maven central with groupid: com.squareup.okhttp3 and artefactid: okhttp. The last version that we profiled was 3.9.1. You can lookup the libs that we retrieve from maven central here: https://github.com/reddr/LibScout-Profiles/blob/master/scripts/mvn-central/libraries.json

Thus, the mockwebserver lib would have to be profiled first. You can add a push request for this new library if you like.