Skip to main content

Trueseeing is a fast, accurate, and resillient vulnerability scanner for Android apps.

Project description

trueseeing is a fast, accurate and resillient vulnerabilities scanner for Android apps. It operates on Android Packaging File (APK) and outputs a comprehensive report in HTML. It doesn’t matter if the APK is obfuscated or not.

Since it is an early beta stage we provide it as a service; this is the reference API client implementation. Once it goes stable we will release it with complete implementation – please look forward to it.

Capability

Currently trueseeing can detect the following class of vulnerabilities:

  • Improper Platform Usage (M1)

    • Debuggable

    • Inadvent publishing of Activities, Services, ContentProviders, BroadcastReceivers

  • Insecure Data (M2)

    • Backupable (i.e. suspectible to the backup attack)

    • Insecure file permissions

    • Logging

  • Insecure Commnications (M3)

    • Lack of pinning (i.e. suspictible to the TLS interception attack)

    • Use of cleartext HTTP

    • Tamperable WebViews

  • Insufficient Cryptography (M5)

    • Hardcoded passphrase/secret keys

    • Vernum ciphers with static keys

    • Use of the ECB mode

  • Client Code Quality Issues (M7)

    • Reflectable WebViews (i.e. XSSs in such views should be escalatable to remote code executions via JS reflection)

    • Usage of insecure policy on mixed contents

  • Code Tampering (M8)

    • Hardcoded certificates

  • Reverse Engineering (M9)

    • Lack of obfuscation

Usage

The following command line is sufficient to scan a APK (target.apk):

$ trueseeing /path/to/target.apk > report.html

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

trueseeing-2.0.2.tar.gz (4.6 kB view hashes)

Uploaded Source

Built Distributions

trueseeing-2.0.2-py35-none-any.whl (7.3 kB view hashes)

Uploaded Python 3.5

trueseeing-2.0.2-py2.py30-none-any.whl (7.3 kB view hashes)

Uploaded Python 2 Python 3.0

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page