deardaniel/secdata-raw huggingface dataset:
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0109

---
title: Nope-Proxy
platform: network
source: https://github.com/summitt/Nope-Proxy
---

Nope-Proxy is an extension for Burp that operates as a Non-HTTP [Machine-in-the-Middle (MITM)](../../Document/0x04f-Testing-Network-Communication.md#intercepting-network-traffic-through-mitm) tool, allowing you to intercept both TCP and UDP traffic. Additionally, it allows DNS spoofing on mobile devices to redirect traffic to Burp for the interception of non-HTTP communications. It also includes features such as manual traffic interception, automated traffic manipulation, a Python mangler, and traffic highlighting.

It can be installed using the `.jar` file from the [GitHub releases](https://github.com/summitt/Nope-Proxy/releases).
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0097

---
title: mitmproxy
platform: network
source: https://github.com/mitmproxy/mitmproxy/
---

mitmproxy is a free and open source interactive HTTPS intercepting proxy.

- **Command Line**: `mitmdump` is the command-line version of mitmproxy. Think tcpdump for HTTP. It can be used to intercept, inspect, modify and replay web traffic such as HTTP/1, HTTP/2, WebSockets, or any other SSL/TLS-protected protocols. You can prettify and decode a variety of message types ranging from HTML to Protobuf, intercept specific messages on-the-fly, modify them before they reach their destination, and replay them to a client or server later on.
- **Web Interface**: `mitmweb` is a web-based interface for mitmproxy. It gives you a similar experience as in Chrome's DevTools, plus additional features such as request interception and replay.
- **Python API**: Write powerful addons and script mitmproxy with mitmdump. The scripting API offers full control over mitmproxy and makes it possible to automatically modify messages, redirect traffic, visualize messages, or implement custom commands.

## Installation

```bash
brew install mitmproxy
```

The installation instructions are [in the official documentation](https://docs.mitmproxy.org/stable/overview-installation).

## Usage

The documentation is [available on the mitmproxy website](https://docs.mitmproxy.org/stable/). Mitmproxy starts as a regular HTTP proxy by default and listens on `http://localhost:8080`. You need to configure your browser or device to route all traffic through mitmproxy. For example, on Android emulator you need to follow the steps indicated [in the mitmproxy Android guide](https://docs.mitmproxy.org/stable/howto-install-system-trusted-ca-android/).

For example, to capture all traffic to a file:

```bash
mitmdump -w outfile
```

This runs mitmproxy with the add_header.py script, which simply adds a new header to all responses.

```bash
mitmdump -s add_header.py
```
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0143

---
title: badssl
platform: network
source: https://github.com/chromium/badssl.com
---

badssl is a website maintained by the Chromium project that provides various SSL/TLS certificate configurations for testing security implementations. It offers a comprehensive collection of test subdomains with different certificate issues and configurations to help developers and security testers validate how applications handle SSL/TLS certificate validation.

The tool provides test cases for common SSL/TLS vulnerabilities and misconfigurations, including:

- Self-signed certificates (`self-signed.badssl.com`)
- Expired certificates (`expired.badssl.com`)
- Wrong hostname certificates (`wrong.host.badssl.com`)
- Untrusted root certificates (`untrusted-root.badssl.com`)
- Mixed content scenarios (`mixed.badssl.com`)
- Weak cipher suites (`rc4.badssl.com`, `dh512.badssl.com`)
- HSTS testing (`hsts.badssl.com`)
- Certificate transparency issues (`no-sct.badssl.com`)

This makes badssl.com particularly useful for testing the SSL/TLS certificate validation logic of mobile applications and ensuring that they properly reject invalid certificates and handle various security scenarios correctly.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0006

---
title: Android SDK
platform: android
source: https://developer.android.com/tools/releases/platform-tools
---

Local Android SDK installations are managed via Android Studio. Create an empty project in Android Studio and select **Tools** -> **SDK Manager** to open the SDK Manager GUI. The **SDK Platforms** tab is where you install SDKs for multiple API levels. Recent API levels are:

- Android 11.0 (API level 30)
- Android 10.0 (API level 29)
- Android 9.0 (API level 28)
- Android 8.1 (API level 27)
- Android 8.0 (API level 26)

An overview of all Android codenames, their version number, and API levels can be found in the [Android Developer Documentation](https://source.android.com/setup/start/build-numbers "Codenames, Tags, and Build Numbers").

<img src="Images/Chapters/0x05c/sdk_manager.jpg" width="100%" />

Installed SDKs are on the following paths:

Windows:

```bash
C:\Users\<username>\AppData\Local\Android\sdk
```

MacOS:

```bash
/Users/<username>/Library/Android/sdk
```

Note: On Linux, you need to choose an SDK directory. `/opt`, `/srv`, and `/usr/local` are common choices.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0107

---
title: jnitrace
platform: android
source: https://github.com/chame1eon/jnitrace
hosts: [windows, linux, macOS]
---

jnitrace is a Frida based tool to trace use of the JNI API in Android apps.

Native libraries contained within Android Apps often make use of the JNI API to utilize the Android Runtime. Tracking those calls through manual reverse engineering can be a slow and painful process. jnitrace works as a dynamic analysis tracing tool similar to frida-trace or strace but for the JNI.

<img src="https://i.ibb.co/ZJ04cBB/jnitrace-1.png" style="width: 80%; border-radius: 5px; margin: 2em" />
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0030

---
title: Angr
platform: android
source: https://github.com/angr/angr
---

Angr is a Python framework for analyzing binaries. It is useful for both static and dynamic symbolic ("concolic") analysis. In other words, given a binary and a requested state, Angr will try to get to that state, using formal methods (a technique used for static code analysis) to find a path, as well as brute forcing. Using angr to get to the requested state is often much faster than taking manual steps for debugging and searching the path towards the required state. Angr operates on the VEX intermediate language and comes with a loader for ELF/ARM binaries, so it is perfect for dealing with native code, such as native Android binaries.

Angr allows for disassembly, program instrumentation, symbolic execution, control-flow analysis, data-dependency analysis, decompilation, and more, given a large set of plugins.

Since version 8, Angr is based on Python 3, and can be installed with pip on \*nix operating systems, macOS, and Windows:

```bash
pip install angr
```

> Some of angr's dependencies contain forked versions of the Python modules Z3 and PyVEX, which would overwrite the original versions. If you're using those modules for anything else, you should create a dedicated virtual environment with [Virtualenv](https://docs.python.org/3/tutorial/venv.html "Virtualenv documentation"). Alternatively, you can always use the provided Docker container. See the [installation guide](https://docs.angr.io/introductory-errata/install "angr Installation Guide") for more details.

Comprehensive documentation, including an installation guide, tutorials, and usage examples, is available on [Angr's Gitbooks page](https://docs.angr.io/ "angr"). A complete [API reference](https://api.angr.io/ "angr API") is also available.

You can use angr from a Python REPL - such as iPython - or script your approaches. Although angr has a bit of a steep learning curve, we do recommend using it when you want to brute force your way to a given state of an executable. Please refer to @MASTG-TECH-0037 as a great example of how this can work.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0146

---
title: RootBeer
platform: android
source: https://github.com/scottyab/rootbeer
hosts: [android]
---

RootBeer is an Android library for detecting root access on devices. It implements multiple detection techniques using both Java and native code (JNI) to make bypassing more difficult. The library checks for common root indicators including root management apps (SuperSU, Magisk), root cloaking apps, dangerous packages, test-keys in the build, dangerous system properties, the presence of su and BusyBox binaries, and read-write access to system partitions.

RootBeer provides a sample app to demonstrate its capabilities, see @MASTG-APP-0032.

!!! info "Limitations"
    Root detection cannot be 100% reliable since root access provides elevated privileges that can be used to hide root indicators. RootBeer can be bypassed by determined attackers, especially when using multiple root cloaking tools simultaneously. For critical security decisions, consider combining RootBeer with server-side validation using Google Play Integrity API.

!!! warning "OWASP MAS Disclaimer"
    The OWASP Mobile Application Security Testing Guide (MASTG) does not endorse specific tools or libraries, which are included as examples. It is the responsibility of the tester to evaluate its suitability for their specific use case and to stay informed about any limitations or vulnerabilities associated with it. Always refer to the official repository for the latest information and updates.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0008

---
title: Android-SSL-TrustKiller
platform: android
status: deprecated
deprecation_note: The Cydia Substrate framework for Android is no longer maintained, and the last update was in 2015. As a result, Android-SSL-TrustKiller is not compatible with modern Android versions and should not be used for testing SSL certificate pinning bypasses on current devices.
covered_by: [MASTG-TOOL-0020, MASTG-TOOL-0025, MASTG-TOOL-0029, MASTG-TOOL-0140]
source: https://github.com/iSECPartners/Android-SSL-TrustKiller
---

Android-SSL-TrustKiller is a Cydia Substrate Module acting as a blackbox tool to bypass SSL certificate pinning for most applications running on a device.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0116

---
title: blutter
platform: android
hosts: [linux, windows, macOS]
source: https://github.com/worawit/blutter
---

Blutter is an open-source tool created to support the reverse engineering of Flutter applications. Unlike other Flutter tools, blutter parses the libapp.so file statically, without requiring you to run the app on a device. blutter can:

- Extract and analyze Dart objects
- Provide annotations for instructions, including function names or pool objects where applicable
- Generate Frida scripts for further analysis

This tool requires a specific environment to function, which is explained in the [setup instructions](https://github.com/worawit/blutter?tab=readme-ov-file#environment-setup). Alternatively, a [convenient Docker file can be found in a PR](https://github.com/worawit/blutter/pull/50).

More information is available in the [B(l)utter – Reversing Flutter Applications presentation](https://www.youtube.com/watch?v=EU3KOzNkCdI).
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0004

---
title: adb
platform: android
source: https://developer.android.com/studio/command-line/adb
---

adb, shipped with the Android SDK, bridges the gap between your local development environment and a connected Android device. You'll usually leverage it to test apps on the emulator or a connected device via USB or Wi-Fi. Use the `adb devices` command to list the connected devices and execute it with the `-l` argument to retrieve more details on them.

```bash
$ adb devices -l
List of devices attached
090c285c0b97f748 device usb:1-1 product:razor model:Nexus_7 device:flo
emulator-5554    device product:sdk_google_phone_x86 model:Android_SDK_built_for_x86 device:generic_x86 transport_id:1
```

adb provides other useful commands, such as `adb shell` to start an interactive shell on a target and `adb forward` to forward traffic on a specific host port to a different port on a connected device.

```bash
adb forward tcp:<host port> tcp:<device port>
```

```bash
$ adb -s emulator-5554 shell
root@generic_x86:/ # ls
acct
cache
charger
config
...
```

You'll come across different use cases on how you can use adb commands when testing later in this book. Note that you must define the serial number of the target device with the `-s` argument (as shown by the previous code snippet) in case you have multiple devices connected.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0025

---
title: SSLUnpinning
platform: android
source: https://github.com/ac-pm/SSLUnpinning_Xposed
---

SSLUnpinning is an @MASTG-TOOL-0149 module to bypass SSL certificate pinning.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0012

---
title: apkx
platform: android
source: https://github.com/muellerberndt/apkx
---

apkx is a Python wrapper to popular free DEX converters and Java decompilers. It automates the extraction, conversion, and decompilation of APKs. Install it as follows:

```bash
git clone https://github.com/muellerberndt/apkx
cd apkx
sudo ./install.sh
```

This should copy apkx to `/usr/local/bin`.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0026

---
title: Termux
platform: android
source: https://github.com/termux/termux-app
---

Termux is a terminal emulator for Android that provides a Linux environment that works directly with or without rooting and with no setup required. The installation of additional packages is a trivial task thanks to its own APT package manager (which makes a difference in comparison to other terminal emulator apps). You can search for specific packages by using the command `pkg search <pkg_name>` and install packages with `pkg install <pkg_name>`. You can install Termux straight from [Google Play](https://play.google.com/store/apps/details?id=com.termux "Install Termux").
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0112

---
title: pidcat
platform: android
source: https://github.com/1fexd/pidcat
---

The pidcat tool acts as a wrapper for `adb logcat` that allows you to view Android log entries for specific application packages in a visually distinct color format.

<img src="https://raw.githubusercontent.com/JakeWharton/pidcat/master/screen.png"/>
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0018

---
title: jadx
platform: android
source: https://github.com/skylot/jadx
---

Jadx is an open-source Dex and Java decompiler available both in a CLI (`jadx`) and GUI (`jadx-gui`) form. It's actively developed and offers an extensive range of features to help you analyze Android applications:

- Decoding of resources and Manifest
- Refactoring of symbols
- Finding cross-references
- Search features for classes, symbols, resources and code
- An API for creating custom extensions
- Support for debugging applications
- Generation of @MASTG-TOOL-0031 and @MASTG-TOOL-0149 snippets

<img src="Images/Tools/TOOL-0018-jadx-gui.png" width="800px" />
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0027

---
title: Xposed
platform: android
source: https://github.com/ElderDrivers/EdXposed
status: deprecated
deprecation_note: Xposed does not work on Android 9 (API level 28). However, it was forked to EdXposed, which has been abandoned, and then to LSPosed. The original LSPosed has been abandoned, but there are multiple active forks of LSPosed available (see MASTG-TOOL-0149).
covered_by: [MASTG-TOOL-0020, MASTG-TOOL-0025, MASTG-TOOL-0029, MASTG-TOOL-0140]

---

Xposed is a framework that allows modifying the system or application aspect and behavior at runtime, without modifying any Android application package (APK) or re-flashing. Technically, it is an extended version of Zygote that exports APIs for running Java code when a new process is started. Running Java code in the context of the newly instantiated app makes it possible to resolve, hook, and override Java methods belonging to the app. Xposed uses [reflection](https://docs.oracle.com/javase/tutorial/reflect/ "Reflection Tutorial") to examine and modify the running app. Changes are applied in memory and persist only during the process's runtime since the application binaries are not modified.

To use Xposed, you need to first install the Xposed framework on a rooted device. Modules can be installed through the Xposed Installer app, and they can be toggled on and off through the GUI.

Note: given that a plain installation of the Xposed framework is easily detected with SafetyNet, we recommend using Magisk to install Xposed. This way, applications with SafetyNet attestation should have a higher chance of being testable with Xposed modules.

Xposed has been compared to Frida. When you run the Frida server on a rooted device, you will end up with a similarly effective setup. Both frameworks deliver a lot of value when you want to do dynamic instrumentation. When Frida crashes the app, you can try something similar with Xposed. Next, similar to the abundance of Frida scripts, you can easily use one of the many modules that come with Xposed, such as the earlier discussed module to bypass SSL pinning ([JustTrustMe](https://github.com/Fuzion24/JustTrustMe "JustTrustMe") and [SSLUnpinning](https://github.com/ac-pm/SSLUnpinning_Xposed "SSL Unpinning")). Xposed includes other modules, such as [Inspeckage](https://github.com/ac-pm/Inspeckage "Inspeckage"), which allow you to do more in-depth application testing as well. On top of that, you can create your own modules as well to patch often-used security mechanisms of Android applications.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0016

---
title: gplaycli
platform: android
source: https://github.com/matlink/gplaycli
---

gplaycli is a Python-based CLI tool to search, install, and update Android applications from the Google Play Store. Follow the [installation steps](https://github.com/matlink/gplaycli#installation "gplaycli Installation") and you're ready to run it. gplaycli offers several options. Please refer to its help (`-h`) for more information.

If you're unsure about the package name (or AppID) of an app, you may perform a keyword-based search for APKs (`-s`):

```bash
$ gplaycli -s "google keep"

Title                          Creator     Size      Last Update  AppID                                    Version

Google Keep - notes and lists  Google LLC  15.78MB   4 Sep 2019   com.google.android.keep                  193510330
Maps - Navigate & Explore      Google LLC  35.25MB   16 May 2019  com.google.android.apps.maps            [PII_REDACTED]
Google                         Google LLC  82.57MB   30 Aug 2019  com.google.android.googlequicksearchbox  301008048
```

!!! note
    Regional (Google Play) restrictions apply when using gplaycli. To access apps restricted in your country, you can use alternative app stores, such as those described in @MASTG-TECH-0003.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0140

---
title: frida-multiple-unpinning
platform: android
source: https://codeshare.frida.re/@akabe1/frida-multiple-unpinning
---

Frida-multiple unpinning is a Frida CodeShare script to bypass various forms of TLS pinning. This is one of the most extensive TLS pinning bypass scripts available on CodeShare. One of its main strengths is a dynamic bypass which detects instantiations of the `SSLPeerUnverifiedException` class and automatically patches the method responsible for throwing the exception.

You can run the script directly with Frida:

```bash
$ frida -U --codeshare akabe1/frida-multiple-unpinning -f YOUR_BINARY
```
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0123

---
title: apksigner
platform: android
source: https://developer.android.com/tools/apksigner
---

apksigner, available in revision 24.0.3 and higher of the Android SDK Build Tools, is contained in the @MASTG-TOOL-0006 at `[SDK-Path]/build-tools/[version]/apksigner` and can be used to verify APK signatures, rotate keys and display additional information about the signing certificates and keys.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0017

---
title: House
platform: android
source: https://github.com/nccgroup/house
---

House is a runtime mobile application analysis toolkit for Android apps, developed and maintained by the NCC Group and is written in Python.

It's leveraging a running Frida server on a rooted device or the Frida gadget in a repackaged Android app. The intention of House is to allow an easy way of prototyping Frida scripts via its convenient web GUI.

The installation instructions and "how-to guide" of House can be found in the [Readme of the Github repo](https://github.com/nccgroup/house "Github Repo of House").
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0013

---
title: Busybox
platform: android
source: https://busybox.net
---

Busybox combines multiple common Unix utilities into a small single executable. The utilities included generally have fewer options than their full-featured GNU counterparts, but are sufficient enough to provide a complete environment on a small or embedded system. Busybox can be installed on a rooted device by downloading the Busybox application from Google Play Store. You can also download the binary directly from the [Busybox website](https://busybox.net "Busybox Website"). Once downloaded, make an `adb push busybox /data/local/tmp` to have the executable available on your phone. A quick overview of how to install and use Busybox can be found in the [Busybox FAQ](https://busybox.net/FAQ.html#getting_started "Busybox FAQ").
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0147

---
title: Android RASP
platform: android
source: https://github.com/securevale/android-rasp
hosts: [android]
---

Android RASP (Runtime Application Self-Protection) is a library written in Kotlin and Rust that provides runtime security checks for Android applications. It detects emulators, debuggers, and root access using native code implementation to make hooking and bypassing more difficult. The library performs comprehensive checks including superuser indicators, test tags, root management and cloaking apps, writable system paths, suspicious device properties, emulator characteristics, debug flags, and debugger attachment detection.

Android RASP provides a sample app to demonstrate its capabilities, see @MASTG-APP-0033.

!!! info "Limitations"
    Like all client-side security measures, Android RASP can be bypassed by skilled attackers. Implement multiple checks throughout your app and consider server-side validation for critical security decisions. The native Rust implementation provides additional protection against common hooking frameworks but is not foolproof.

!!! warning "OWASP MAS Disclaimer"
    The OWASP Mobile Application Security Testing Guide (MASTG) does not endorse specific tools or libraries, which are included as examples. It is the responsibility of the tester to evaluate its suitability for their specific use case and to stay informed about any limitations or vulnerabilities associated with it. Always refer to the official repository for the latest information and updates.