Skip to content

Commit 6cd00f4

Browse files
JerryTasiJerryTasi
authored
Optimize the document of Quark Script CWE-338, 489, and 532 (#60)
1 parent d28c7dc commit 6cd00f4

File tree

7 files changed

+90
-80
lines changed

7 files changed

+90
-80
lines changed

‎CWE-338/CWE-338.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313

1414
for usePRNGMethod in quarkResult.behaviorOccurList:
1515
for prngCaller in usePRNGMethod.methodCaller.getXrefFrom():
16-
if any(keyword in prngCaller.fullName
17-
for keyword in CREDENTIAL_KEYWORDS):
18-
print("CWE-338 is detected in %s" % prngCaller.fullName)
16+
if any(
17+
keyword in prngCaller.fullName for keyword in CREDENTIAL_KEYWORDS
18+
):
19+
print("CWE-338 is detected in %s" % prngCaller.fullName)

‎CWE-338/README.md‎

Lines changed: 31 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,32 @@
1-
# Detect CWE-338 in Android Application (pivva.apk)
1+
# Detect CWE-338 in Android Application
22

3-
This scenario aims to detect the **Use of Cryptographically Weak
4-
Pseudo-Random Number Generator (PRNG).** See
5-
[CWE-338](https://cwe.mitre.org/data/definitions/338.html) for more
6-
details.
3+
This scenario seeks to find **Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)**.
74

8-
To demonstrate how the Quark script finds this vulnerability, we will
9-
use the [pivaa](https://github.com/HTBridge/pivaa) APK file and the
10-
above APIs.
5+
## CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
116

12-
First, we design a detection rule `useMethodOfPRNG.json` to spot on
13-
behavior that uses Pseudo Random Number Generator (PRNG). Then, we use
14-
API `methodInstance.getXrefFrom()` to get the caller method of PRNG.
15-
Finally, we use some keywords such as "token", "password", and "encrypt"
16-
to check if the PRNG is for credential usage.
7+
We analyze the definition of CWE-338 and identify its characteristics.
8+
9+
See [CWE-338](https://cwe.mitre.org/data/definitions/338.html) for more details.
10+
11+
![image](https://imgur.com/aLybax5.jpg)
12+
13+
## Code of CWE-338 in pivaa.apk
14+
15+
We use the [pivaa.apk](https://github.com/HTBridge/pivaa) sample to explain the vulnerability code of CWE-338.
16+
17+
![image](https://i.postimg.cc/mr5rpTDz/image.png)
18+
19+
## CWE-338 Detection Process Using Quark Script API
20+
21+
![image](https://imgur.com/yWLNwZV.jpg)
22+
23+
First, we design a detection rule `useMethodOfPRNG.json` to spot on behavior that uses Pseudo Random Number Generator (PRNG). Then, we use API `methodInstance.getXrefFrom()` to get the caller method of PRNG. Finally, we use some keywords such as "token", "password", and "encrypt" to check if the PRNG is for credential usage.
1724

1825
## Quark Script CWE-338.py
1926

20-
``` python
27+
![image](https://i.postimg.cc/xdt54Lft/image.png)
28+
29+
```python
2130
from quark.script import runQuarkAnalysis, Rule
2231

2332
SAMPLE_PATH = "pivaa.apk"
@@ -33,14 +42,17 @@ quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)
3342

3443
for usePRNGMethod in quarkResult.behaviorOccurList:
3544
for prngCaller in usePRNGMethod.methodCaller.getXrefFrom():
36-
if any(keyword in prngCaller.fullName
37-
for keyword in CREDENTIAL_KEYWORDS):
45+
if any(
46+
keyword in prngCaller.fullName for keyword in CREDENTIAL_KEYWORDS
47+
):
3848
print("CWE-338 is detected in %s" % prngCaller.fullName)
3949
```
50+
51+
## Quark Rule: useMethodOfPRNG.json
4052

41-
## useMethodOfPRNG.json
53+
![image](https://i.postimg.cc/jS6x74Kg/image.png)
4254

43-
``` json
55+
```json
4456
{
4557
"crime": "Use method of PRNG",
4658
"permission": [],
@@ -63,7 +75,7 @@ for usePRNGMethod in quarkResult.behaviorOccurList:
6375

6476
## Quark Script Result
6577

66-
``` TEXT
78+
```TEXT
6779
$ python CWE-338.py
6880
CWE-338 is detected in Lcom/htbridge/pivaa/EncryptionActivity$2; onClick (Landroid/view/View;)V
6981
```

‎CWE-338/useMethodOfPRNG.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,4 @@
1515
],
1616
"score": 1,
1717
"label": []
18-
}
18+
}

‎CWE-489/CWE-489.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@
33
SAMPLE_PATH = "allsafe.apk"
44

55
if getApplication(SAMPLE_PATH).isDebuggable():
6-
print(f"CWE-489 is detected in {SAMPLE_PATH}.")
6+
print(f"CWE-489 is detected in {SAMPLE_PATH}.")

‎CWE-489/README.md‎

Lines changed: 23 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,32 @@
1-
# Detect CWE-489 in Android Application (allsafe.apk, AndroGoat.apk, pivaa.apk)
1+
# Detect CWE-489 in Android Application
22

3+
This scenario seeks to find **active debug code**.
34

4-
This scenario seeks to find **active debug code** in the APK file. See
5-
[CWE-489](https://cwe.mitre.org/data/definitions/489.html) for more
6-
details.
5+
## CWE-489: Active Debug Code
76

8-
Let\'s use [allsafe.apk](https://github.com/t0thkr1s/allsafe),
9-
[AndroGoat.apk](https://github.com/satishpatnayak/AndroGoat),
10-
[pivaa.apk](https://github.com/HTBridge/pivaa), and the above APIs to
11-
show how the Quark script finds this vulnerability.
7+
We analyze the definition of CWE-489 and identify its characteristics.
128

13-
First, we use Quark API `getApplication(samplePath)` to get the
14-
application element in the manifest file. Then we use
15-
`applicationInstance.isDebuggable()` to check if the application element
16-
sets the attribute `android:debuggable` to true. If **Yes**, that causes
17-
CWE-489 vulnerabilities.
9+
See [CWE-489](https://cwe.mitre.org/data/definitions/489.html) for more details.
10+
11+
![image](https://imgur.com/UuDNFXW.jpg)
12+
13+
## Code of CWE-489 in allsafe.apk
14+
15+
We use the [allsafe.apk](https://github.com/t0thkr1s/allsafe) sample to explain the vulnerability code of CWE-489.
16+
17+
![image](https://imgur.com/QSrATmt.jpg)
18+
19+
## CWE-489 Detection Process Using Quark Script API
20+
21+
![image](https://imgur.com/ydGfkV4.jpg)
22+
23+
First, we use Quark API ``getApplication(samplePath)`` to get the application element in the manifest file. Then we use ``applicationInstance.isDebuggable()`` to check if the application element sets the attribute ``android:debuggable`` to true. If **Yes**, that causes CWE-489 vulnerabilities.
1824

1925
## Quark Script CWE-489.py
2026

21-
The Quark Script below uses allsafe.apk to demonstrate. You can change
22-
the `SAMPLE_PATH` to the sample you want to detect. For example,
23-
`SAMPLE_PATH = AndroGoat.apk` or `SAMPLE_PATH = pivaa.apk`.
27+
![image](https://imgur.com/ToCAmD3.jpg)
2428

25-
``` python
29+
```python
2630
from quark.script import getApplication
2731

2832
SAMPLE_PATH = "allsafe.apk"
@@ -33,23 +37,7 @@ if getApplication(SAMPLE_PATH).isDebuggable():
3337

3438
## Quark Script Result
3539

36-
- **allsafe.apk**
37-
38-
``` TEXT
39-
$ python3 CWE-489.py
40-
CWE-489 is detected in allsafe.apk
41-
```
42-
43-
- **AndroGoat.apk**
44-
45-
``` TEXT
46-
$ python3 CWE-489.py
47-
CWE-489 is detected in AndroGoat.apk
48-
```
49-
50-
- **pivaa.apk**
51-
52-
``` TEXT
40+
```TEXT
5341
$ python3 CWE-489.py
54-
CWE-489 is detected in pivaa.apk
42+
CWE-489 is detected in allsafe.apk.
5543
```

‎CWE-532/CWE-532.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,4 @@
1919

2020
for keyword in CREDENTIAL_KEYWORDS:
2121
if keyword in arguments[1]:
22-
print(f"CWE-532 is detected in method, {debugLogger.fullName}")
22+
print(f"CWE-532 is detected in method, {debugLogger.fullName}")

‎CWE-532/README.md‎

Lines changed: 29 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,36 @@
1-
# Detect CWE-532 in Android Application (dvba.apk)
1+
# Detect CWE-532 in Android Application
22

3-
This scenario seeks to find **insertion of sensitive information into
4-
Log file**. See
5-
[CWE-532](https://cwe.mitre.org/data/definitions/532.html) for more
6-
details.
3+
This scenario seeks to find **insertion of sensitive information into Log file** in the APK file.
74

8-
Let's use this
9-
[APK](https://github.com/rewanthtammana/Damn-Vulnerable-Bank) and the
10-
above APIs to show how the Quark script finds this vulnerability.
5+
## CWE-532: Insertion of Sensitive Information into Log File
116

12-
First, we use API `findMethodInAPK(samplePath, targetMethod)` to locate
13-
`log.d` method. Then we use API `methodInstance.getArguments()` to get
14-
the argument that input to `log.d`. Finally, we use some keywords such
15-
as \"token\", \"password\", and \"decrypt\" to check if arguments
16-
include sensitive data. If the answer is YES, that may cause sensitive
17-
data leakage into log file.
7+
We analyze the definition of CWE-532 and identify its characteristics.
188

19-
You can use your own keywords in the keywords list to detect sensitive
20-
data.
9+
See [CWE-532](https://cwe.mitre.org/data/definitions/532.html) for more details.
2110

22-
## Quark Script CWE-532.py
11+
![image](https://imgur.com/6WzpyId.jpg)
2312

24-
``` python
13+
## Code of CWE-532 in dvba.apk
14+
15+
We use the [dvba.apk](https://github.com/rewanthtammana/Damn-Vulnerable-Bank) sample to explain the vulnerability code of CWE-532.
16+
17+
![image](https://imgur.com/cLzBvh2.jpg)
18+
19+
## CWE-532 Detection Process Using Quark Script API
20+
21+
![image](https://imgur.com/KLbnflF.jpg)
22+
23+
Let's use the above APIs to show how the Quark script finds this vulnerability.
24+
25+
First, we use the API ``findMethodInAPK(samplePath, targetMethod)`` to locate ``log.d`` method. Then we use API ``methodInstance.getArguments()`` to get the argument that input to ``log.d``. Finally, we use some keywords such as "token", "password", and "decrypt" to check if arguments include sensitive data. If the answer is **YES**, that may cause sensitive data leakage into log file.
26+
27+
You can use your own keywords in the keywords list to detect sensitive data.
28+
29+
## Quark Script: CWE-532.py
30+
31+
![image](https://imgur.com/L9Ciqlp.jpg)
32+
33+
```python
2534
from quark.script import findMethodInAPK
2635

2736
SAMPLE_PATH = "dvba.apk"
@@ -48,7 +57,7 @@ for debugLogger in methodsFound:
4857

4958
## Quark Script Result
5059

51-
``` TEXT
60+
```TEXT
5261
$ python CWE-532.py
5362
CWE-532 is detected in method, Lcom/google/firebase/auth/FirebaseAuth; d (Lc/c/b/h/o;)V
54-
```
63+
```

0 commit comments

Comments
 (0)