MobileAudit - SAST and Malware Analysis for Android Mobile APKs
http://www.kitploit.com/2021/09/mobileaudit-sast-and-malware-analysis.html

___________________________
@hacking_Attack
@Hacking_Video

Django Web application for performing Static Analysis (https://www.kitploit.com/search/label/Static%20Analysis) and detecting malware in Android APKs

___________________________
@hacking_Attack
@Hacking_Video

In each of the scans, it would have the following information:Application InfoSecurity InfoComponentsSAST FindingsBest Practices ImplementedVirus Total InfoCertificate InfoStringsDatabasesFiles

___________________________
@hacking_Attack
@Hacking_Video

For easy access there is a sidebar on the left page of the scan:

___________________________
@hacking_Attack
@Hacking_Video

Components

___________________________
@hacking_Attack
@Hacking_Video

db: PostgreSQL 13.2nginx: Nginx 1.19.10rabbitmq: RabbitMQ 3.8.14worker: Celery 5.0.5web: Mobile Audit App
Docker Base images
Image is based on python buster. Link to Docker Hub image (https://hub.docker.com/repository/docker/mpast/mobile_audit)ImageTagsBasempast/mobile_audit1.3.8python:3.9.4-bustermpast/mobile_audit1.3.6python:3.9.2-bustermpast/mobile_audit1.3.0python:3.9.1-bustermpast/mobile_audit1.0.0python:3.9.0-buster
Main features
Uses Docker for easy deployment in multiplatform (https://www.kitploit.com/search/label/Multiplatform) environment Extract all information of the APK Analyze all the source code searching for weaknesses All findings are categorized and follows CWE standards All findings are categorized and include Mobile Top 10 Risk Also highlight the Best Practices in Secure Android Implementation in the APK The findings can be edited and the false positives can be triaged and deleted All scan results can be exported to PDF User authentication (https://www.kitploit.com/search/label/Authentication) and user management API v1 with Swagger and ReDoc TLS Dynamic page reload (WIP) LDAP integration Export to Markdown Export to CSV
Patterns
The application has an engine with different rules and patterns that are used though the findings scanning phase to detect vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) and/or malicious code into the apk.These can be activated and deactivated in /patterns

___________________________
@hacking_Attack
@Hacking_Video

Note: some of the hardcoded patterns are from apkleaks (https://github.com/dwisiswant0/apkleaks)
Models
The application has an created models for each of the entities of the scans' information to be able to create relations an abtain the best conclusions for each of the apks.

___________________________
@hacking_Attack
@Hacking_Video

To see the whole model schema, go to models (https://github.com/mpast/mobileAudit/blob/main/app/static/models.png)### Integrations
Virus Total (API v3)
It checks if there has been an scan of the APK and extract all its information. Also, there is the possibility of uploading the APK is selected a property in the environment (Disabled by default).
Defect Dojo (API v2)
It is possible to upload the findings to the defect manager.
MalwareDB & Maltrail
It checks in the database if there are URLs in the APK that are related with Malware.
Installation
Using Docker-compose:The provided docker-compose.yml file allows you to run the app locally in development.To build the local image and if there are changes to the local Application Dockerfile, you can build the image with:docker-compose buildThen, to start the container, run:docker-compose upOptional: run in detached mode (not see the logs)docker-compose up -dOnce the application has launched, you can test the application by navigating to: http://localhost:8888/ to access the dashboard.

___________________________
@hacking_Attack
@Hacking_Video

Also, there is a TLS version using docker-compose.prod.yaml running in port 443To use it, execute docker-compose -f docker-compose.prod.yaml upThen, you can test the application by navigating to: https://localhost/ to access the dashboard.For more information, see TLS (https://github.com/mpast/mobileAudit#tls)To stop and remove the containers, rundocker-compose down
API v1
REST API integration with Swagger and ReDoc.
Usage
Endpoint to authenticate and get token: /api/v1/auth-token/

___________________________
@hacking_Attack
@Hacking_Video

Once authenticated, use header in all requests: Authorization: Token
Swagger

___________________________
@hacking_Attack
@Hacking_Video

ReDoc

___________________________
@hacking_Attack
@Hacking_Video