Skip to main content

Trueseeing is a non-decompiling Android application vulnerability scanner.

Project description

trueseeing is a fast, accurate and resillient vulnerabilities scanner for Android apps. It operates on Android Packaging File (APK) and outputs a comprehensive report in HTML. It doesn’t matter if the APK is obfuscated or not.

Capability

Currently trueseeing can detect the following class of vulnerabilities:

  • Improper Platform Usage (M1)
    • Debuggable
    • Inadvent publishing of Activities, Services, ContentProviders, BroadcastReceivers
  • Insecure Data (M2)
    • Backupable (i.e. suspectible to the backup attack)
    • Insecure file permissions
    • Logging
  • Insecure Commnications (M3)
    • Lack of pinning (i.e. suspictible to the TLS interception attack)
    • Use of cleartext HTTP
    • Tamperable WebViews
  • Insufficient Cryptography (M5)
    • Hardcoded passphrase/secret keys
    • Vernum ciphers with static keys
    • Use of the ECB mode
  • Client Code Quality Issues (M7)
    • Reflectable WebViews (i.e. XSSs in such views should be escalatable to remote code executions via JS reflection)
    • Usage of insecure policy on mixed contents
  • Code Tampering (M8)
    • Hardcoded certificates
  • Reverse Engineering (M9)
    • Lack of obfuscation

Usage

The following command line is sufficient to scan a APK (target.apk):

$ trueseeing /path/to/target.apk > report.html

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for trueseeing, version 2.0.10
Filename, size File type Python version Upload date Hashes
Filename, size trueseeing-2.0.10-py3-none-any.whl (9.3 MB) File type Wheel Python version py3 Upload date Hashes View hashes
Filename, size trueseeing-2.0.10.tar.gz (9.3 MB) File type Source Python version None Upload date Hashes View hashes

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN SignalFx SignalFx Supporter DigiCert DigiCert EV certificate StatusPage StatusPage Status page