Package: qark
Quick Android Review KitThis tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating “Proof-of-Concept” deployable APKs and/or ADB commands, capable of exploiting many of the vulnerabilities it finds. There is no need to root the test device, as this tool focuses on vulnerabilities that can be exploited under otherwise secure conditions.RequirementsTested on Python 2.7.13 and 3.6
Tested on OSX, Linux, and WindowsUsageFor more options please see the--helpcommand.APK:~ qark --apk path/to/my.apkJava source code files:~ qark --java path/to/parent/java/folder
~ qark --java path/to/specific/java/file.javaResultsA report is generated in JSON and can be built into other format types, to change the report type please use the--report-typeflag.InstallationWith pip (no security checks on requirements):~ pip install --user qark  # --user is only needed if not using a virtualenv
~ qark --helpWithrequirements.txt(security checks on requirements):~ git clone https://github.com/linkedin/qark
~ cd qark
~ pip install -r requirements.txt
~ pip install . --user  # --user is only needed if not using a virtualenv
~ qark --helpExploit APKQARK can generate a basic exploit APK for a few of the vulnerabilities that have been found.To generate the exploit APK there are a few steps to follow. You need to have the Android SDK v21 and build-tools v21.1.2Install the android SDK, you can get it under the ‘command line tools’:https://developer.android.com/studio/#downloadsUnzip the android SDKGo into the new directory and generate the licenses withbin/sdkmanager –licensesMake sure the generated licenses are in the android SDK directory.Install the SDK and the proper build-tools version:bin/sdkmanager –install “platforms;android-21” “sources;android-21” “build-tools;21.1.2”ChecksQARK is an easy to use tool capable of finding common security vulnerabilities in Android applications. Unlike commercial products, it is 100% free to use. QARK features educational information allowing security reviewers to locate precise, in-depth explanations of the vulnerabilities. QARK automates the use of multiple decompilers, leveraging their combined outputs, to produce superior results, when decompiling APKs. Finally, the major advantage QARK has over traditional tools, that just point you to possible vulnerabilities, is that it can produce ADB commands, or even fully functional APKs, that turn hypothetical vulnerabilities into working “POC” exploits.Included in the types of security vulnerabilities this tool attempts to find are:Inadvertently exported componentsImproperly protected exported componentsIntents which are vulnerable to interception or eavesdroppingImproper x.509 certificate validationCreation of world-readable or world-writeable filesActivities which may leak dataThe use of Sticky IntentsInsecurely created Pending IntentsSending of insecure Broadcast IntentsPrivate keys embedded in the sourceWeak or improper cryptography usePotentially exploitable WebView configurationsExported Preference ActivitiesTapjackingApps which enable backupsApps which are debuggableApps supporting outdated API versions, with known vulnerabilitiesNoticeNote: QARK decompiles Android applications back to raw source code. Please do not use this tool if this may be considered illegal in your juristdiction. If you are unsure, seek legal counsel.If you run into issues on OSX, especially relating to the outbound call to the Play Store, or the downloading of the SDK, it is
likely due to your Python/OpenSSL configuration and the fact that recent changes in OSX impacted Python installed via brew. Nuking your
Python installation(s) and re-installing from source may fix your issues.LicenseCopyright 2015 LinkedIn Corp.  All rights reserved.Copyright 2015 LinkedIn Corp. Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License.You may obtain a copy of the Licensehere.
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.