Hackers Choice
Home
Videos

Truegaze : Static Analysis Tool For Android/iOS Applications Focusing On Security Issues Outside The Source Code

Truegaze : Static Analysis Tool For Android/iOS Applications Focusing On Security Issues Outside The Source Code

By Admin •  2019-08-22T03:45:12.782Z •  Hacking Tools

134 views

Truegaze is a static analysis tool for Android and iOS applications focusing on security issues outside the source code such as resource strings, third party libraries and configuration files.

Requirements

Python 3 is required and you can find all required modules in the requirements.txt file. Only tested on Python 3.7 but should work on other 3.x releases. No plans to 2.x support at this time.


Installation

You can install this via PIP as follows:

pip install truegaze 
truegaze 

To download and run manually, do the following:

git clone https://github.com/nightwatchcybersecurity/truegaze.git 
cd truegaze 
pip -r requirements.txt 
python -m truegaze.cli 

How To Use?

To list modules:

truegaze list 

To scan an application:

truegaze scan test.apk 
truegaze scan test.ipa 

Sample Output

Listing modules:

user@localhost:~/$ truegaze list
Total active plugins: 1
+----------------+------------------------------------------+---------+------+
|      Name      |               Description                | Android | iOS  |
+----------------+------------------------------------------+---------+------+
| AdobeMobileSdk | Detection of incorrect SSL configuration |  True   | True |
|                |         in the Adobe Mobile SDK          |         |      |
+----------------+------------------------------------------+---------+------+

Scanning an application:

user@localhost:~/$ truegaze scan ~/test.ipa
Identified as an iOS application via a manifest located at: Payload/IPAPatch-DummyApp.app/Info.plist
Scanning using the “AdobeMobileSdk” plugin
— Found 1 configuration file(s)
— Scanning “Payload/IPAPatch-DummyApp.app/Base.lproj/ADBMobileConfig.json’
—- FOUND: The [“analytics”][“ssl”] setting is missing or false – SSL is not being used
—- FOUND: The [“remotes”][“analytics.poi”] URL doesn’t use SSL: http://assets.example.com/c234243g4g4rg.json
—- FOUND: The [“remotes”][“messages”] URL doesn’t use SSL: http://assets.example.com/b34343443egerg.json
—- FOUND: A “templateurl” in [“messages”][“payload”] doesn’t use SSL: http://my.server.com/?user={user.name}&zip={user.zip}&c16={%sdkver%}&c27=cln,{a.PrevSessionLength}
—- FOUND: A “templateurl” in [“messages”][“payload”] doesn’t use SSL: http://my.43434server.com/?user={user.name}&zip={user.zip}&c16={%sdkver%}&c27=cln,{a.PrevSessionLength}
Done!

Display installed version:

user@localhost:~/$ truegaze version 
Current version: v0.2 

Structure

The application is command line and will consist of several modules that check for various vulnerabilities. Each module does its own scanning, and all results get printed to command line.

Powered by Froala Editor

Admin
Author
 You may also like
Download our apps
Get it on Google Play