trueseeing is a fast, accurate and resillient vulnerabilities scanner for Android apps. It operates on Android Packaging File (APK) and outputs a comprehensive report in HTML. It doesn’t matter if the APK is obfuscated or not.

Since it is an early beta stage we provide it as a service; this is the reference API client implementation. Once it goes stable we will release it with complete implementation – please look forward to it.

Capability

Currently trueseeing can detect the following class of vulnerabilities:

  • Improper Platform Usage (M1)

    • Debuggable

    • Inadvent publishing of Activities, Services, ContentProviders, BroadcastReceivers

  • Insecure Data (M2)

    • Backupable (i.e. suspectible to the backup attack)

    • Insecure file permissions

    • Logging

  • Insecure Commnications (M3)

    • Lack of pinning (i.e. suspictible to the TLS interception attack)

    • Use of cleartext HTTP

    • Tamperable WebViews

  • Insufficient Cryptography (M5)

    • Hardcoded passphrase/secret keys

    • Vernum ciphers with static keys

    • Use of the ECB mode

  • Client Code Quality Issues (M7)

    • Reflectable WebViews (i.e. XSSs in such views should be escalatable to remote code executions via JS reflection)

    • Usage of insecure policy on mixed contents

  • Code Tampering (M8)

    • Hardcoded certificates

  • Reverse Engineering (M9)

    • Lack of obfuscation

Usage

The following command line is sufficient to scan a APK (target.apk):

$ trueseeing /path/to/target.apk > report.html

Project links

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (2.2.11)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for alterakey from gravatar.com alterakey

Credits

Author: Takahiro Yoshimura

Tags

android java security pentest hacking

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

trueseeing-2.0.1.tar.gz (4.5 kB view details)

Uploaded Source

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

trueseeing-2.0.1-py35-none-any.whl (7.3 kB view details)

Uploaded Python 3.5

trueseeing-2.0.1-py2.py30-none-any.whl (7.3 kB view details)

Uploaded Python 2Python 3.0

File details

Details for the file trueseeing-2.0.1.tar.gz.

File metadata

  • Download URL: trueseeing-2.0.1.tar.gz
  • Upload date:
  • Size: 4.5 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No

File hashes

Hashes for trueseeing-2.0.1.tar.gz
Algorithm Hash digest
SHA256 b59b4f36a1691c732000ec7693db2c6f8decaddadbcd6c3d02b0e33129f2a2f1
MD5 21b24651ed1de7863a022de849f442b8
BLAKE2b-256 9207cb838448b48cb58c0d96989bc37ce163f5b01ec09d9219c12660b64d0bd0

See more details on using hashes here.

File details

Details for the file trueseeing-2.0.1-py35-none-any.whl.

File metadata

File hashes

Hashes for trueseeing-2.0.1-py35-none-any.whl
Algorithm Hash digest
SHA256 eea1006f155dbf80d9ae1306d9509f3b83e735f7e6e47207088c66bbfba8c126
MD5 86839ffdab8520eca84386122499894d
BLAKE2b-256 c2528cd3aa548387c85be7b049741b6208c89852d2e63bd1ee01af793314e95a

See more details on using hashes here.

File details

Details for the file trueseeing-2.0.1-py2.py30-none-any.whl.

File metadata

File hashes

Hashes for trueseeing-2.0.1-py2.py30-none-any.whl
Algorithm Hash digest
SHA256 974d7ff698b7f5cffdf0640ca824fae5dcc4f92f0b2dcadac1691e4aeaeca083
MD5 47b495725fbe7628cde67833d6527af7
BLAKE2b-256 721a203900b33db3ea5ac27e28c26175c5f4a3b4fe70757982c7525911a23e1e

See more details on using hashes here.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page