deardaniel/secdata-raw huggingface dataset:
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0002

---
title: MobSF (Android)
platform: android
source: https://github.com/MobSF/Mobile-Security-Framework-MobSF
---

After MobSF is done with its analysis, you will receive a one-page overview of all the tests that were executed. The page is split up into multiple sections, giving some first hints on the attack surface of the application.

<img src="Images/Chapters/0x05b/mobsf_android.png" width="100%" />

The following is displayed:

- Basic information about the app and its binary file.
- Some options to:
    - View the `AndroidManifest.xml` file.
    - View the IPC components of the app.
- Signer certificate.
- App permissions.
- A security analysis showing known defects e.g. if the app backups are enabled.
- List of libraries used by the app binary and list of all files inside the unzipped APK.
- Malware analysis that checks for malicious URLs.

Refer to [MobSF documentation](https://github.com/MobSF/Mobile-Security-Framework-MobSF/wiki/1.-Documentation "MobSF documentation") for more details.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0007

---
title: Android Studio
platform: android
source: https://developer.android.com/studio/index.html
---

Android Studio is the official IDE for Google's Android operating system, built on JetBrains' IntelliJ IDEA software and designed specifically for Android development.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0020

---
title: JustTrustMe
platform: android
source: https://github.com/Fuzion24/JustTrustMe
---

JustTrustMe is an @MASTG-TOOL-0149 module to bypass SSL certificate pinning.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0005

---
title: Android NDK
platform: android
source: https://developer.android.com/ndk/guides/standalone_toolchain
---

The Android NDK contains prebuilt versions of the native compiler and toolchain. Both the GCC and Clang compilers have traditionally been supported, but active support for GCC ended with NDK revision 14. The device architecture and host OS determine the appropriate version. The prebuilt toolchains are in the `toolchains` directory of the NDK, which contains one subdirectory for each architecture.

| Architecture | Toolchain name |
| --- | --- |
| ARM-based | arm-linux-androideabi-&lt;gcc-version&gt; |
| x86-based | x86-&lt;gcc-version&gt; |
| MIPS-based | mipsel-linux-android-&lt;gcc-version&gt; |
| ARM64-based | aarch64-linux-android-&lt;gcc-version&gt; |
| X86-64-based | x86_64-&lt;gcc-version&gt; |
| MIPS64-based | mips64el-linux-android-&lt;gcc-version&gt; |

Besides picking the right architecture, you need to specify the correct sysroot for the native API level you want to target. The sysroot is a directory that contains the system headers and libraries for your target. Native APIs vary by Android API level. Available sysroot directories for each Android API level can be found in `$NDK/platforms/`. Each API level directory contains subdirectories for the various CPUs and architectures.

One possibility for setting up the build system is exporting the compiler path and necessary flags as environment variables. To make things easier, however, the NDK allows you to create a so-called standalone toolchain, which is a temporary toolchain that incorporates the required settings.

To set up a standalone toolchain, download the [latest stable version of the NDK](https://developer.android.com/ndk/downloads/index.html#stable-downloads "Android NDK Downloads"). Extract the ZIP file, change into the NDK root directory, and run the following command:

```bash
./build/tools/make_standalone_toolchain.py --arch arm --api 24 --install-dir /tmp/android-7-toolchain
```

This creates a standalone toolchain for Android 7.0 (API level 24) in the directory `/tmp/android-7-toolchain`. For convenience, you can export an environment variable that points to your toolchain directory (we'll be using this in the examples). Run the following command or add it to your `.bash_profile` or other startup script:

```bash
export TOOLCHAIN=/tmp/android-7-toolchain
```
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0120

---
title: ProxyDroid
platform: android
source: https://github.com/madeye/proxydroid/
---

ProxyDroid is an open source app [available in Google Play](https://play.google.com/store/apps/details?id=org.proxydroid) that configures your device to send HTTP(S) traffic to a proxy. It is especially useful for apps that ignore the system's proxy settings, as it uses `iptables` to force the traffic to your proxy.

Due to the usage of `iptables`, there are a few limitations to consider:

- ProxyDroid only works on rooted devices
- Only port 80, 443 and 5228 are intercepted
- The proxy needs to be configured in _transparent proxy_ mode
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0011

---
title: Apktool
platform: android
source: https://github.com/iBotPeaches/Apktool
---

Apktool is used to unpack Android app packages (APKs). Simply unzipping APKs with the standard `unzip` utility leaves some files unreadable. `AndroidManifest.xml` is encoded into binary XML format, which isn't readable with a text editor. Also, the app resources are still packaged into a single archive file.

When run with default command line flags, apktool automatically decodes the Android Manifest file to text-based XML format and extracts the file resources (it also disassembles the .DEX files to smali code - a feature that we'll revisit later in this book).

Among the unpacked files you can usually find (after running `apktool d base.apk`):

- AndroidManifest.xml: The decoded Android Manifest file, which can be opened and edited in a text editor.
- apktool.yml: file containing information about the output of apktool
- original: folder containing the MANIFEST.MF file, which contains information about the files contained in the JAR file
- res: directory containing the app's resources
- smali: directory containing the disassembled Dalvik bytecode.

You can also use apktool to repackage decoded resources back to a binary APK/JAR. See the techniques @MASTG-TECH-0007 and @MASTG-TECH-0039 for more information and practical examples.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0003

---
title: nm (Android)
platform: android
source: https://ftp.gnu.org/gnu/binutils/
---

nm is a tool that displays the name list (symbol table) of the given binary. [More information for the Android (GNU)](https://ftp.gnu.org/old-gnu/Manuals/binutils-2.12/html_node/binutils_4.html "nm -binutils") version.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0125

---
title: Apkleaks
platform: android
source: https://github.com/dwisiswant0/apkleaks
hosts: [windows, linux, macOS]
---

Apkleaks is an open-source utility designed for static analysis of Android APK files, with a primary focus on identifying sensitive data such as API keys, URLs, AWS S3 buckets, and Firebase URLs. This tool automates the process of string analysis, facilitating the detection of hardcoded secrets and potential security vulnerabilities.

It offers support for custom regular expression rules, enabling users to specify additional search criteria through a JSON configuration file [regexes.json](https://github.com/dwisiswant0/apkleaks/blob/master/config/regexes.json).
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0009

---
title: APKiD
platform: android
source: https://github.com/rednaga/APKiD
---

APKiD gives you information about how an APK was made. It identifies many compilers, packers, obfuscators, and other weird stuff.

For more information on what this tool can be used for, check out:

- [Android Compiler Fingerprinting](https://hitcon.org/2016/CMT/slide/day1-r0-e-1.pdf)
- [Detecting Pirated and Malicious Android Apps with APKiD](https://rednaga.io/2016/07/31/detecting_pirated_and_malicious_android_apps_with_apkid/)
- [APKiD: PEiD for Android Apps](https://github.com/enovella/cve-bio-enovella/blob/master/slides/bheu18-enovella-APKID.pdf)
- [APKiD: Fast Identification of AppShielding Products](https://github.com/enovella/cve-bio-enovella/blob/master/slides/APKiD-NowSecure-Connect19-enovella.pdf)
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0010

---
title: APKLab
platform: android
source: https://github.com/APKLab/APKLab
---

APKLab is a Visual Studio Code extension leveraging tools such as @MASTG-TOOL-0011 and @MASTG-TOOL-0018 to enable features including app unpacking, decompilation, code patching (e.g. for MITM), and repackaging straight from the IDE.

For more information, you can refer to [APKLab's official documentation](https://apklab.surendrajat.xyz/).
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0014

---
title: Bytecode Viewer
platform: android
source: https://bytecodeviewer.com/
---

Bytecode Viewer (BCV) is a free and open source Java decompiler framework running on all operating systems. It is a versatile tool which can be used to decompile Android apps, view APK resources (via apktool) and easily edit APKs (via Smali/Baksmali). Apart from APKs, also DEX, Java Class files and Java Jars can be viewed. One of its major features is the support for multiple Java bytecode decompilers under one GUI. BCV currently includes the Procyon, CFR, Fernflower, Krakatau, and JADX-Core decompilers. These decompilers have different strengths and can be easily leveraged while using BCV, especially when dealing with obfuscated programs.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0103

---
title: uber-apk-signer
platform: android
source: https://github.com/patrickfav/uber-apk-signer
---

Uber-apk-signer is a tool that helps to sign, [zip align](https://developer.android.com/studio/command-line/zipalign.html) and verify one or more Android application packages (APKs) with either debug or provided release certificates. It supports v1, v2, [v3](https://source.android.com/security/apksigning/v3) and [v4](https://source.android.com/security/apksigning/v4) Android signing schemes. Easy and convenient debug signing with embedded debug keystore. Automatically verifies signature and zip alignment after signing.

Download the jar from the [latest release](https://github.com/patrickfav/uber-apk-signer/releases/latest) and run:

```bash
$ java -jar uber-apk-signer.jar --apks </path/to/apks>
```

Demo:

[![asciicast](https://asciinema.org/a/91092.png)](https://asciinema.org/a/91092)

For more information go to the [GitHub repository](https://github.com/patrickfav/uber-apk-signer).
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0130

---
title: blint
platform: android
source: https://github.com/owasp-dep-scan/blint
---

Blint is a Binary Linter that checks the security properties and capabilities of an executable. Since version 2, `blint` can generate Software Bill-of-Materials (SBOM) for supported binaries, which includes Android (APK and AAB), but not iOS (IPA) apps.

The creation of an SBOM out of an Android App (APK or AAB) is supported, but [limited](https://github.com/owasp-dep-scan/blint/issues/119). Due to stripping out meta-information of the libraries used in an app, a SBOM created ouf of an Android app will always be incomplete.

BLint can be a choice in a black-box security assessment, but other tools should be preferred during a grey/white-box test, like:

- @MASTG-TOOL-0131
- @MASTG-TOOL-0132
- @MASTG-TOOL-0134
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0029

---
title: objection (Android)
platform: android
source: https://github.com/sensepost/objection
---

Objection offers several features specific to Android. You can find the [full list of features](https://github.com/sensepost/objection/wiki/Features) on the project's page, but here are a few interesting ones:

- Repackage applications to include the Frida gadget
- Disable SSL pinning for popular methods
- Access application storage to download or upload files
- Execute custom Frida scripts
- List the Activities, Services, and Broadcast receivers
- Start Activities
- Detect implicit intents

If you have a rooted device with frida-server installed, Objection can connect directly to the running Frida server to provide all its functionality without needing to repackage the application. However, it is not always possible to root an Android device, or the app may contain advanced RASP controls for root detection, so injecting a frida-gadget may be the easiest way to bypass those controls.

The ability to **perform advanced dynamic analysis on non-rooted devices** is one of the features that makes Objection incredibly useful. After following the repackaging process (@MASTG-TECH-0039), you will be able to run all the aforementioned commands, which make it very easy to quickly analyze an application or bypass basic security controls.

## Using Objection on Android

Starting up Objection depends on whether you've patched the APK or whether you are using a rooted device running Frida-server. For running a patched APK, either the foreground process `-f` or Gadget should be specified `-n Gadget`. Whereas when using frida-server, you need to specify which application you want to attach to or spawn.

```bash
# Connecting to a patched APK
objection -f explore

# Using Frida-server
# Find the correct name using frida-ps
$ frida-ps -Ua | grep -i telegram
30268  Telegram                               org.telegram.messenger

# Connecting to the Telegram app through Frida-server
$ objection -n "Telegram" start
# Alternatively use the process ID (PID)
$ objection -n 30268 start

# Objection can also spawn the app through Frida-server using the application identifier / package name
$ objection -s -n "org.telegram.messenger"
... [usb] resume

# Alternatively with "no pause"
$ objection -s -p -n "org.telegram.messenger"
```

Once you are in the Objection REPL, you can execute any of the available commands. Below is an overview of some of the most useful ones:

```bash
# Show the different storage locations belonging to the app
$ env

# Disable popular SSL pinning methods
$ android sslpinning disable

# List items in the keystore
$ android keystore list

# Try to circumvent root detection
$ android root disable

```

More information on using the Objection REPL can be found on the [Objection Wiki](https://github.com/sensepost/objection/wiki/Using-objection "Using Objection")
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0022

---
title: ProGuard
platform: android
source: https://www.guardsquare.com/proguard
---

ProGuard is a free Java class file shrinker, optimizer, obfuscator, and preverifier. It detects and removes unused classes, fields, methods, and attributes and can also be used to delete logging-related code.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0024

---
title: Scrcpy
platform: android
source: https://github.com/Genymobile/scrcpy
---

Scrcpy provides display and control of Android devices connected over USB (or [TCP/IP](https://www.genymotion.com/blog/open-source-project-scrcpy-now-works-wirelessly/ "Scrcpy now works wirelessly")). It does not require any root access and it works on GNU/Linux, Windows and macOS.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0149

---
title: LSPosed
platform: android
source: https://github.com/JingMatrix/LSPosed
---

LSPosed is a Zygisk module that allows modifying the system or application aspect and behavior at runtime, without modifying any Android application package (APK) or re-flashing. Technically, it is an extended version of Zygote that exports APIs for running Java code when a new process is started. Running Java code in the context of the newly instantiated app makes it possible to resolve, hook, and override Java methods belonging to the app.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0148

---
title: apkeep
platform: android
source: https://github.com/EFForg/apkeep
hosts: [windows, linux, macOS]
---

apkeep is a command-line tool written in Rust for downloading APK files from various sources including Google Play Store. It's designed to make downloading and archiving Android APKs simple and reliable.

- Supports downloading specific versions of apps
- Can download split APKs and bundle them
- Provides CSV output for automation
- No authentication required for free apps

See the [GitHub repository](https://github.com/EFForg/apkeep) for more information and installation instructions.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0099

---
title: FlowDroid
platform: android
source: https://github.com/secure-software-engineering/FlowDroid
---

FlowDroid is an open-source tool based in [soot](https://github.com/soot-oss/soot "soot"), a framework dedicated to analyzing and translating Java bytecode for easier analysis. The tool handles the nuances of Android app lifecycles (like `onCreate`, `onStart`, `onPause`, and others) and its UI components during analysis and performs taint analysis that is:

- **Context-sensitive**: Distinguishing between calls to the same method based on their specific execution contexts.
- **Object-sensitive**: Identifying individual objects, even when they're of the same class.
- **Flow-sensitive**: Recognizing the sequential order of code execution.

FlowDroid can be used in two ways: as a standalone command line tool for quick analyses or as a library for more complex investigations. In addition to performing taint analysis, FlowDroid can also generate call graphs, as illustrated in [this blog post](https://medium.com/geekculture/generating-call-graphs-in-android-using-flowdroid-pointsto-analysis-7b2e296e6697 "Generating Call Graphs in Android Using FlowDroid + PointsTo Analysis by Navid Salehnamadi").
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0019

---
title: jdb
platform: android
source: https://docs.oracle.com/javase/7/docs/technotes/tools/windows/jdb.html
---

jdb is a Java Debugger which allows to set breakpoints and print application variables. jdb uses the JDWP protocol.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0021

---
title: Magisk
platform: android
source: https://topjohnwu.github.io/Magisk/
---

Magisk ("Magic Mask") is one way to root your Android device. It's specialty lies in the way the modifications on the system are performed. While other rooting tools alter the actual data on the system partition, Magisk does not (which is called "systemless"). This enables a way to hide the modifications from root-sensitive applications (e.g. for banking or games) and allows using the official Android OTA upgrades without the need to unroot the device beforehand.

You can get familiar with Magisk reading the official [documentation on GitHub](https://topjohnwu.github.io/Magisk/ "Magisk Documentation"). If you don't have Magisk installed, you can find installation instructions in [the documentation](https://topjohnwu.github.io/Magisk/install.html "Magisk Installation"). If you use an official Android version and plan to upgrade it, Magisk provides a [tutorial on GitHub](https://topjohnwu.github.io/Magisk/ota.html "OTA Installation").

Learn more about [rooting your device with Magisk](../../Document/0x05b-Android-Security-Testing.md#rooting-with-magisk "Rooting with Magisk").
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0124

---
title: aapt2
platform: android
source: https://developer.android.com/tools/aapt2
---

aapt2, available in Android SDK Build Tools since revision 26.0.2, is contained in the @MASTG-TOOL-0006 at `[SDK-Path]/build-tools/[version]/aapt2` and can be used, for example, to examine the contents of the AndroidManifest file.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0023

---
title: RootCloak Plus
platform: android
source: https://github.com/devadvance/rootcloakplus
status: deprecated
covered_by: [MASTG-TOOL-0142]
---

RootCloak Plus is a Cydia Substrate Module used to check for commonly known indications of root
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0106

---
title: Fridump
platform: generic
source: https://github.com/Nightbringer21/fridump
hosts: [windows, linux, macOS]
---

Fridump is an open source memory dumping tool, primarily aimed to penetration testers and developers. Fridump is using the Frida framework to dump accessible memory addresses from any platform supported.

More information:

- [Introduction to Fridump](https://pentestcorner.com/introduction-to-fridump/)
- [iOS Examples](https://pentestcorner.com/fridump-ios-examples/)
- [Android Examples](https://pentestcorner.com/fridump-android-examples/)
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0032

---
title: Frida CodeShare
platform: generic
source: https://codeshare.frida.re/
---

Frida CodeShare is a repository containing a collection of ready-to-run Frida scripts which can enormously help when performing concrete tasks both on Android as on iOS as well as also serve as inspiration to build your own scripts. Some examples of useful scripts:

- Frida Multiple Unpinning - <https://codeshare.frida.re/@akabe1/frida-multiple-unpinning/>
- Disable Flutter TLS verification - <https://codeshare.frida.re/@TheDauntless/disable-flutter-tls-v1/>
- ObjC method observer - <https://codeshare.frida.re/@mrmacete/objc-method-observer/>
- JNI Trace - <https://codeshare.frida.re/@chame1eon/jnitrace/>
- Dump dynamically loaded DEX - <https://codeshare.frida.re/@cryptax/inmemorydexclassloader-dump/>
- Enable iOS WebInspector - <https://codeshare.frida.re/@leolashkevych/ios-enable-webinspector/>

Using them is as simple as including the `--codeshare <script>` flag with the chosen script when using the Frida CLI. For example, to use "ObjC method observer", enter the following:

```bash
frida --codeshare mrmacete/objc-method-observer -f YOUR_BINARY
```
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0132

---
title: dependency-track
platform: generic
source: https://github.com/DependencyTrack/dependency-track
---

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

- **Installation**: You can install Dependency-Track by using [docker](https://docs.dependencytrack.org/getting-started/deploy-docker/). The default credentials can be found in the [initial setup](https://docs.dependencytrack.org/getting-started/initial-startup/).
- **Input**: Dependency-Track relies on Software Bill of Materials (SBOM) to identify vulnerable dependencies. SBOMs can be generated using tools such as @MASTG-TOOL-0134 and uploaded via the [API](https://docs.dependencytrack.org/usage/cicd/).
- **REST API**: You can use the REST API with an [API Key](https://docs.dependencytrack.org/integrations/rest-api/) and a project to which the SBOM can be uploaded.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0134

---
title: cdxgen
platform: generic
source: https://github.com/CycloneDX/cdxgen
---

cdxgen can generate Software Bill of Materials (SBOM) for most applications and container images with a single command. It supports SwiftPM for iOS and Maven for Android. The generated SBOM can then be submitted to analysis tools such as @MASTG-TOOL-0132.

While the creation of an SBOM for a compiled Android app (APK or AAB) is supported, it is limited and mostly incomplete. This is mainly due to the removal of metadata from the libraries used in an app. Therefore, it is recommended to execute cdxgen in the Android app project folder to create a complete SBOM.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0034

---
title: LIEF
platform: generic
source: https://github.com/lief-project/LIEF
---

The purpose of LIEF is to provide a cross platform library to parse, modify and abstract ELF, PE and MachO formats. With it you can, for instance, inject a certain library as a dependency of a native library, which an application already loads by default. - <https://lief.quarkslab.com/>