Package: quark-engine
Quark Script - Dig Vulnerabilities in the BlackBoxInnovative & InteractiveThe goal of Quark Script aims to provide an innovative way for mobile security researchers to analyze orpentestthe targets.Based on Quark, we integrate decent tools as Quark Script APIs and make them exchange valuable intelligence to each other. This enables security researchers tointeractwith staged results and performcreativeanalysis with Quark Script.Dynamic & Static AnalysisIn Quark script, we integrate not only static analysis tools (e.g. Quark itself) but also dynamic analysis tools (e.g.objection).Re-Usable & SharableOnce the user creates a Quark script for specific analysis scenario. The script can be used in another targets. Also, the script can be shared to other security researchers. This enables the exchange of knowledges.More APIs to comeQuark Script is now in a beta version. We'll keep releasing practical APIs and analysis scenarios.See API documenthere.CWE ShowcasesCWE-020Improper Input ValidationCWE-022Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CWE-023Relative Path TraversalCWE-073External Control of File Name or PathCWE-078Improper Neutralization of Special Elements used in an OS CommandCWE-088Improper Neutralization of Argument Delimiters in a CommandCWE-089Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CWE-094Improper Control of Generation of Code ('Code Injection')CWE-117Improper Output Neutralization for LogsCWE-295Improper Certificate ValidationCWE-312Cleartext Storage of Sensitive InformationCWE-319Cleartext Transmission of Sensitive InformationCWE-327Use of a Broken or Risky Cryptographic AlgorithmCWE-328Use of Weak HashCWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)CWE-489Active Debug CodeCWE-502Deserialization of Untrusted DataCWE-532Insertion of Sensitive Information into Log FileCWE-601URL Redirection to Untrusted Site ('Open Redirect')FileCWE-749Exposed Dangerous Method or FunctionCWE-780Use of RSA Algorithm without OAEPCWE-798Use of Hard-coded CredentialsCWE-921Storage of Sensitive Data in a Mechanism without Access ControlCWE-925Improper Verification of Intent by Broadcast ReceiverCWE-926Improper Export of Android Application ComponentsCWE-940Improper Verification of Source of a Communication ChannelQuick StartIn this section, we will show how to detect CWE-798 with Quark Script.Step 1: Environments RequirementsQuark requires Python 3.8 or above.Step 2: Install Quark EngineInstall Quark Engine by running:$pip3install-Uquark-engineStep 3: Prepare Quark Script, Detection Rule and the Sample FileGet the CWE-798 Quark Script and the detection rulehere.Get the sampe file (ovaa.apk)here.Put the script, detection rule, and sample file in the same directory.Edit accordingly to the file names:SAMPLE_PATH="ovaa.apk"RULE_PATH="findSecretKeySpec.json"# Now you are ready to run the script!Step 4: Run the script$python3CWE-798.py# You should now see the detection result in the terminal.Foundhard-codedAESkey49u5gh249gh24985ghf429gh4ch8f23fCheck thedocumentfor more examples.AcknowledgmentsThe Honeynet ProjectGoogle Summer Of CodeQuark-Engine has been participating in the GSoC under the Honeynet Project!2021:YuShiang Dang:New Rule Generation Technique & Make Quark Everywhere Among Security Open Source ProjectsSheng-Feng Lu:Replace the core library of Quark-EngineStay tuned for the upcoming GSoC! Join theHoneynet Slack chatfor more info.Core Values of Quark Engine TeamWe lovebattle fields. We embraceuncertainties. We challengeimpossibles. Werethinkeverything. We change the way people think. And the most important of all, we benefit ourselves by benefit othersfirst.