trueseeing is a fast, accurate and resillient vulnerabilities scanner for Android apps. It operates on Android Packaging File (APK) and outputs a comprehensive report in HTML. It doesn’t matter if the APK is obfuscated or not.

Since it is an early beta stage we provide it as a service; this is the reference API client implementation. Once it goes stable we will release it with complete implementation – please look forward to it.

Capability

Currently trueseeing can detect the following class of vulnerabilities:

  • Improper Platform Usage (M1)

    • Debuggable

    • Inadvent publishing of Activities, Services, ContentProviders, BroadcastReceivers

  • Insecure Data (M2)

    • Backupable (i.e. suspectible to the backup attack)

    • Insecure file permissions

    • Logging

  • Insecure Commnications (M3)

    • Lack of pinning (i.e. suspictible to the TLS interception attack)

    • Use of cleartext HTTP

    • Tamperable WebViews

  • Insufficient Cryptography (M5)

    • Hardcoded passphrase/secret keys

    • Vernum ciphers with static keys

    • Use of the ECB mode

  • Client Code Quality Issues (M7)

    • Reflectable WebViews (i.e. XSSs in such views should be escalatable to remote code executions via JS reflection)

    • Usage of insecure policy on mixed contents

  • Code Tampering (M8)

    • Hardcoded certificates

  • Reverse Engineering (M9)

    • Lack of obfuscation

Usage

The following command line is sufficient to scan a APK (target.apk):

$ trueseeing /path/to/target.apk > report.html

Project links

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (2.2.11)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for alterakey from gravatar.com alterakey

Credits

Author: Takahiro Yoshimura

Tags

android java security pentest hacking

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

trueseeing-2.0.2.tar.gz (4.6 kB view details)

Uploaded Source

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

trueseeing-2.0.2-py35-none-any.whl (7.3 kB view details)

Uploaded Python 3.5

trueseeing-2.0.2-py2.py30-none-any.whl (7.3 kB view details)

Uploaded Python 2Python 3.0

File details

Details for the file trueseeing-2.0.2.tar.gz.

File metadata

  • Download URL: trueseeing-2.0.2.tar.gz
  • Upload date:
  • Size: 4.6 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No

File hashes

Hashes for trueseeing-2.0.2.tar.gz
Algorithm Hash digest
SHA256 3be9b3fbc1367be158e9784c5f31255ce6e350e5b11f8b3701e4c4c8e8e83207
MD5 161975f71f6dbdf4b2194771fc781ced
BLAKE2b-256 b47fd8b42d4c69a266fed3ac4af39b767af4111ff902c7bb2864b12555c64818

See more details on using hashes here.

File details

Details for the file trueseeing-2.0.2-py35-none-any.whl.

File metadata

File hashes

Hashes for trueseeing-2.0.2-py35-none-any.whl
Algorithm Hash digest
SHA256 6d777594abe3860adbe37e50affa92f2a84327c65bf6c6d04f08d30039d1e714
MD5 7d69eadfda5de8cae62c489eecb81c0a
BLAKE2b-256 cd8cdadd387a59c2d3c6b576270d6e4ae1ce97147eba371a62a8848b45e1b971

See more details on using hashes here.

File details

Details for the file trueseeing-2.0.2-py2.py30-none-any.whl.

File metadata

File hashes

Hashes for trueseeing-2.0.2-py2.py30-none-any.whl
Algorithm Hash digest
SHA256 a41f2eebccb42ae2def6dce2952e616e700d6d62d1e972a62e3c601029abae4c
MD5 e7847b7f52801378f7c889c7052450ed
BLAKE2b-256 d3f57fcb14405f5c183dfd08f6670cca1fb2f3a8a1c03ffe686f4708b94d90a1

See more details on using hashes here.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page