Skip to content

Commit 5da3f1e

Browse files
author
tmarschutz
committed
first commit
1 parent 09821c1 commit 5da3f1e

File tree

10,571 files changed

+1386578
-1
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

10,571 files changed

+1386578
-1
lines changed

‎backend/toolbox/modules/android/__init__.py‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
"""
2+
Android Security Modules
3+
4+
This package contains modules for android static code analysis and security testing.
5+
6+
Available modules:
7+
- MobSF: Mobile Security Framework
8+
- Jadx: Dex to Java decompiler
9+
- OpenGrep: Open-source pattern-based static analysis tool
10+
"""
11+
12+
from typing import List, Type
13+
from ..base import BaseModule
14+
15+
# Module registry for automatic discovery
16+
ANDROID_MODULES: List[Type[BaseModule]] = []
17+
18+
def register_module(module_class: Type[BaseModule]):
19+
"""Register a android security module"""
20+
ANDROID_MODULES.append(module_class)
21+
return module_class
22+
23+
def get_available_modules() -> List[Type[BaseModule]]:
24+
"""Get all available android modules"""
25+
return ANDROID_MODULES.copy()

‎backend/toolbox/modules/android/custom_rules/clipboard-sensitive-data.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
rules:
2+
- id: clipboard-sensitive-data
3+
severity: WARNING
4+
languages: [java]
5+
message: "Sensitive data may be copied to the clipboard."
6+
metadata:
7+
authors:
8+
- Guerric ELOI (FuzzingLabs)
9+
category: security
10+
area: clipboard
11+
verification-level: [L1]
12+
paths:
13+
include:
14+
- "**/*.java"
15+
pattern: "$CLIPBOARD.setPrimaryClip($CLIP)"

‎backend/toolbox/modules/android/custom_rules/hardcoded-secrets.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
rules:
2+
- id: hardcoded-secrets
3+
severity: WARNING
4+
languages: [java]
5+
message: "Possible hardcoded secret found in variable '$NAME'."
6+
metadata:
7+
authors:
8+
- Guerric ELOI (FuzzingLabs)
9+
owasp-mobile: M2
10+
category: secrets
11+
verification-level: [L1]
12+
paths:
13+
include:
14+
- "**/*.java"
15+
patterns:
16+
- pattern-either:
17+
- pattern: 'String $NAME = "$VAL";'
18+
- pattern: 'final String $NAME = "$VAL";'
19+
- pattern: 'private String $NAME = "$VAL";'
20+
- pattern: 'public static String $NAME = "$VAL";'
21+
- pattern: 'static final String $NAME = "$VAL";'
22+
- pattern-regex: "$NAME =~ /(?i).*(api|key|token|secret|pass|auth|session|bearer|access|private).*/"
23+

‎backend/toolbox/modules/android/custom_rules/insecure-data-storage.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rules:
2+
- id: insecure-data-storage
3+
severity: WARNING
4+
languages: [java]
5+
message: "Potential insecure data storage (external storage)."
6+
metadata:
7+
authors:
8+
- Guerric ELOI (FuzzingLabs)
9+
owasp-mobile: M2
10+
category: security
11+
area: storage
12+
verification-level: [L1]
13+
paths:
14+
include:
15+
- "**/*.java"
16+
pattern-either:
17+
- pattern: "$CTX.openFileOutput($NAME, $MODE)"
18+
- pattern: "Environment.getExternalStorageDirectory()"

‎backend/toolbox/modules/android/custom_rules/insecure-deeplink.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
rules:
2+
- id: insecure-deeplink
3+
severity: WARNING
4+
languages: [xml]
5+
message: "Potential insecure deeplink found in intent-filter."
6+
metadata:
7+
authors:
8+
- Guerric ELOI (FuzzingLabs)
9+
category: component
10+
area: manifest
11+
verification-level: [L1]
12+
paths:
13+
include:
14+
- "**/AndroidManifest.xml"
15+
pattern: |
16+
<intent-filter>

‎backend/toolbox/modules/android/custom_rules/insecure-logging.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
rules:
2+
- id: insecure-logging
3+
severity: WARNING
4+
languages: [java]
5+
message: "Sensitive data logged via Android Log API."
6+
metadata:
7+
authors:
8+
- Guerric ELOI (FuzzingLabs)
9+
owasp-mobile: M2
10+
category: logging
11+
verification-level: [L1]
12+
paths:
13+
include:
14+
- "**/*.java"
15+
patterns:
16+
- pattern-either:
17+
- pattern: "Log.d($TAG, $MSG)"
18+
- pattern: "Log.e($TAG, $MSG)"
19+
- pattern: "System.out.println($MSG)"
20+
- pattern-regex: "$MSG =~ /(?i).*(password|token|secret|api|auth|session).*/"
21+

‎backend/toolbox/modules/android/custom_rules/intent-redirection.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
rules:
2+
- id: intent-redirection
3+
severity: WARNING
4+
languages: [java]
5+
message: "Potential intent redirection: using getIntent().getExtras() without validation."
6+
metadata:
7+
authors:
8+
- Guerric ELOI (FuzzingLabs)
9+
category: intent
10+
area: intercomponent
11+
verification-level: [L1]
12+
paths:
13+
include:
14+
- "**/*.java"
15+
pattern: "$ACT.getIntent().getExtras()"

‎backend/toolbox/modules/android/custom_rules/sensitive_data_sharedPreferences.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rules:
2+
- id: sensitive-data-in-shared-preferences
3+
severity: WARNING
4+
languages: [java]
5+
message: "Sensitive data may be stored in SharedPreferences. Please review the key '$KEY'."
6+
metadata:
7+
authors:
8+
- Guerric ELOI (FuzzingLabs)
9+
owasp-mobile: M2
10+
category: security
11+
area: storage
12+
verification-level: [L1]
13+
paths:
14+
include:
15+
- "**/*.java"
16+
patterns:
17+
- pattern: "$EDITOR.putString($KEY, $VAL);"
18+
- pattern-regex: "$KEY =~ /(?i).*(username|password|pass|token|auth_token|api_key|secret|sessionid|email).*/"

‎backend/toolbox/modules/android/custom_rules/sqlite-injection.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
rules:
2+
- id: sqlite-injection
3+
severity: ERROR
4+
languages: [java]
5+
message: "Possible SQL injection: concatenated input in rawQuery or execSQL."
6+
metadata:
7+
authors:
8+
- Guerric ELOI (FuzzingLabs)
9+
owasp-mobile: M7
10+
category: injection
11+
area: database
12+
verification-level: [L1]
13+
paths:
14+
include:
15+
- "**/*.java"
16+
patterns:
17+
- pattern-either:
18+
- pattern: "$DB.rawQuery($QUERY, ...)"
19+
- pattern: "$DB.execSQL($QUERY)"
20+
- pattern-regex: "$QUERY =~ /.*\".*\".*\\+.*/"
21+

‎backend/toolbox/modules/android/custom_rules/vulnerable-activity.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
rules:
2+
- id: vulnerable-activity
3+
severity: WARNING
4+
languages: [xml]
5+
message: "Activity exported without permission."
6+
metadata:
7+
authors:
8+
- Guerric ELOI (FuzzingLabs)
9+
category: component
10+
area: manifest
11+
verification-level: [L1]
12+
paths:
13+
include:
14+
- "**/AndroidManifest.xml"
15+
pattern: |
16+
<activity android:exported="true"

0 commit comments

Comments
 (0)