Quick Android Review Kit

[rukov]

Quick Android Review Kit - This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating "Proof-of-Concept" deployable APKs and/or ADB commands, capable of exploiting many of the vulnerabilities it finds. There is no need to root the test device, as this tool focuses on vulnerabilities that can be exploited under otherwise secure conditions.

Requirements

python 2.7.6

JRE 1.6+ (preferably 1.7+)

OSX or Ubuntu Linux (Others may work, but not fully tested)

Documentation

QARK is an easy to use tool capable of finding common security vulnerabilities in Android applications. Unlike commercial products, it is 100% free to use. QARK features educational information allowing security reviewers to locate precise, in-depth explanations of the vulnerabilities. QARK automates the use of multiple decompilers, leveraging their combined outputs, to produce superior results, when decompiling APKs. Finally, the major advantage QARK has over traditional tools, that just point you to possible vulnerabilities, is that it can produce ADB commands, or even fully functional APKs, that turn hypothetical vulnerabilities into working "POC" exploits.

Included in the types of security vulnerabilities this tool attempts to find are:

Inadvertently exported components

Improperly protected exported components

Intents which are vulnerable to interception or eavesdropping

Improper x.509 certificate validation

Creation of world-readable or world-writeable files

Activities which may leak data

The use of Sticky Intents

Insecurely created Pending Intents

Sending of insecure Broadcast Intents

Private keys embedded in the source

Weak or improper cryptography use

Potentially exploitable WebView configurations

Exported Preference Activities

Tapjacking

Apps which enable backups

Apps which are debuggable

Apps supporting outdated API versions, with known vulnerabilities

Download https://github.com/linkedin/qark