Tool to look for several security related Android application vulnerabilities

Last update: Jan 2, 2023

Related tags

Overview

Quick Android Review Kit

This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating "Proof-of-Concept" deployable APKs and/or ADB commands, capable of exploiting many of the vulnerabilities it finds. There is no need to root the test device, as this tool focuses on vulnerabilities that can be exploited under otherwise secure conditions.

Requirements

Tested on Python 2.7.13 and 3.6 Tested on OSX, Linux, and Windows

Usage

For more options please see the --help command.

APK:

~ qark --apk path/to/my.apk

Java source code files:

~ qark --java path/to/parent/java/folder
~ qark --java path/to/specific/java/file.java

Results

A report is generated in JSON and can be built into other format types, to change the report type please use the --report-type flag.

Installation

With pip (no security checks on requirements):

~ pip install --user qark  # --user is only needed if not using a virtualenv
~ qark --help

With requirements.txt (security checks on requirements):

~ git clone https://github.com/linkedin/qark
~ cd qark
~ pip install -r requirements.txt
~ pip install . --user  # --user is only needed if not using a virtualenv
~ qark --help

Exploit APK

QARK can generate a basic exploit APK for a few of the vulnerabilities that have been found.

To generate the exploit APK there are a few steps to follow. You need to have the Android SDK v21 and build-tools v21.1.2

Install the android SDK, you can get it under the 'command line tools': https://developer.android.com/studio/#downloads
Unzip the android SDK
Go into the new directory and generate the licenses with bin/sdkmanager --licenses
Make sure the generated licenses are in the android SDK directory.
Install the SDK and the proper build-tools version: bin/sdkmanager --install "platforms;android-21" "sources;android-21" "build-tools;21.1.2"

Checks

QARK is an easy to use tool capable of finding common security vulnerabilities in Android applications. Unlike commercial products, it is 100% free to use. QARK features educational information allowing security reviewers to locate precise, in-depth explanations of the vulnerabilities. QARK automates the use of multiple decompilers, leveraging their combined outputs, to produce superior results, when decompiling APKs. Finally, the major advantage QARK has over traditional tools, that just point you to possible vulnerabilities, is that it can produce ADB commands, or even fully functional APKs, that turn hypothetical vulnerabilities into working "POC" exploits.

Included in the types of security vulnerabilities this tool attempts to find are:

Inadvertently exported components
Improperly protected exported components
Intents which are vulnerable to interception or eavesdropping
Improper x.509 certificate validation
Creation of world-readable or world-writeable files
Activities which may leak data
The use of Sticky Intents
Insecurely created Pending Intents
Sending of insecure Broadcast Intents
Private keys embedded in the source
Weak or improper cryptography use
Potentially exploitable WebView configurations
Exported Preference Activities
Tapjacking
Apps which enable backups
Apps which are debuggable
Apps supporting outdated API versions, with known vulnerabilities

Notice

Note: QARK decompiles Android applications back to raw source code. Please do not use this tool if this may be considered illegal in your juristdiction. If you are unsure, seek legal counsel.

If you run into issues on OSX, especially relating to the outbound call to the Play Store, or the downloading of the SDK, it is likely due to your Python/OpenSSL configuration and the fact that recent changes in OSX impacted Python installed via brew. Nuking your Python installation(s) and re-installing from source may fix your issues.

License

You may obtain a copy of the License here. Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

Comments

ERROR - Problem with reporting; No html report generated. Please see the readme file for possible solutions

I have this problem

ERROR - failed to write report Traceback (most recent call last): File "/root/qark/qark/modules/report.py", line 199, in writeSection pre_rendered_html2.find("div", id=str(section[sec] + "-issues-list")).append(new_div_tag_1) AttributeError: 'NoneType' object has no attribute 'append' ISSUES - PLUGIN ISSUES ... INFO - The apk can be found in the /root/qark/qark/build/qark directory ERROR - Problem with reporting; No html report generated. Please see the readme file for possible solutions. Goodbye!

last version

The Command Line: python ./qarkMain.py --acceptterms ACCEPTTERMS --source 1 --pathtoapk "/tmp/base.apk" --debug 10 --exploit 1 --reportdir $(pwd)"/Report_base.apk"

opened by ulises2k 18
Jenkins integration?

Hi

I am having some problems integrating qark with Jenkins

If i run it as a python script, it tells me that the syntax is incorrect (note that $apkpath.apk is hardcoded with the apk file)

qark/qark.py --source 1 --path $apkpath.apk --manifest 1 --exploit 0

If i run it as a shell script in jenkins

python qark/qark.py --source 1 --path $apkpath.apk --manifest 1 --exploit 0

It works fine until decompiling step. After that, it gives an unexpected failure

What could be the problem? If i run the same from command line (both my .sh or executing the python script directly) it works fine

Thanks
bug

opened by javixeneize 16
Reporting not working.

Get at issue at the tag end of the execution. "ERROR - Problem with reporting; No html report generated. Please see the readme file for possible solutions." Please try and address this. Will be helpful in presenting the analysis more efficiently to the audience. Do let me know once this is addressed.
bug

opened by ketank-sym 16
Qark doesn't complete anymore

Not sure why, but ever since I updated qark (I was using a build from February), it just doesn't complete anymore.

This is as far as it gets: INFO - Unpacking /home/sj/projects/firmware/apks/whatever.apk INFO - Zipfile: <zipfile.ZipFile object at 0x7fd6c17a85d0> INFO - Extracted APK to /home/sj/projects/firmware/apks/whatever.apk/

And that's it.. nothing happens after this.

opened by ghost 13
'qark' is not recognized as an internal or external command

Hi, I am installing qark on windows and facing challenge. I have followed the below commands but still it's not working. Please help me.

~ pip install -r requirements.txt ~ pip install . --user

C:\Software\Android\Static_Analysis\qark-master\qark>pip install qark

Requirement already satisfied: qark in c:\users\gaurav_w\appdata\roaming\python\python27\site-packages (3.0.1)

Requirement already satisfied: pluginbase in c:\python27\lib\site-packages (from qark) (0.5)

Requirement already satisfied: click in c:\python27\lib\site-packages (from qark) (6.7)

Requirement already satisfied: jinja2 in c:\python27\lib\site-packages (from qark) (2.10)

Requirement already satisfied: enum34; python_version < "3.4" in c:\python27\lib\site-packages (from qark) (1.1.6)

Requirement already satisfied: requests[security] in c:\python27\lib\site-packages (from qark) (2.18.4)

Requirement already satisfied: javalang in c:\python27\lib\site-packages (from qark) (0.11.0)

Requirement already satisfied: six in c:\python27\lib\site-packages (from qark) (1.11.0)

Requirement already satisfied: MarkupSafe>=0.23 in c:\python27\lib\site-packages (from jinja2->qark) (1.0)

Requirement already satisfied: idna<2.7,>=2.5 in c:\python27\lib\site-packages (from requests[security]->qark) (2.6)

Requirement already satisfied: urllib3<1.23,>=1.21.1 in c:\python27\lib\site-packages (from requests[security]->qark) (1.22)

Requirement already satisfied: certifi>=2017.4.17 in c:\python27\lib\site-packages (from requests[security]->qark) (2018.1.18)

Requirement already satisfied: chardet<3.1.0,>=3.0.2 in c:\python27\lib\site-packages (from requests[security]->qark) (3.0.4)

Requirement already satisfied: cryptography>=1.3.4; extra == "security" in c:\python27\lib\site-packages (from requests[security]->qark) (2.2.1)

Requirement already satisfied: pyOpenSSL>=0.14; extra == "security" in c:\python27\lib\site-packages (from requests[security]->qark) (17.5.0)

Requirement already satisfied: cffi>=1.7; platform_python_implementation != "PyPy" in c:\python27\lib\site-packages (from cryptography>=1.3.4; extra == "security"->requests[security]->qark) (1.11.5)

Requirement already satisfied: asn1crypto>=0.21.0 in c:\python27\lib\site-packages (from cryptography>=1.3.4; extra == "security"->requests[security]->qark) (0.24.0)

Requirement already satisfied: ipaddress; python_version < "3" in c:\python27\lib\site-packages (from cryptography>=1.3.4; extra == "security"->requests[security]->qark) (1.0.19)

Requirement already satisfied: pycparser in c:\python27\lib\site-packages (from cffi>=1.7; platform_python_implementation != "PyPy"->cryptography>=1.3.4; extra == "security"->requests[security]->qark) (2.18)

C:\Software\Android\Static_Analysis\qark-master\qark>qark --help 'qark' is not recognized as an internal or external command, operable program or batch file.
duplicate

opened by gaurav1987127 11
Failed to download dex2jar jar

Hi, I am passing this command in cli:

python qarkMain.py --source 1 --pathtoapk /home/patryck/Desktop/100_APKS/AdTime-ead57e70c29080bf41ce7675df115055.apk --reportdir /home/patryck/Desktop/

and the tool sends me to interactive mode.

opened by Patryck95 11
Win32 support, initial proof of concept

This pull request allows things to at least start (more testing is needed on Windows), and avoids the POSIX-only dependencies from preventing the program from loading.

Requires pdcurses and the python wrappers to be installed, along with console before this will run.

opened by einhverfr 11
Problem With reporting

Hi, thanks for share this amazing soft :+1:

I have received this message when i try to generated the html report.

ERROR - problem with reporting; no Html report generated. Please see the readme file for possible solutions.

Any solutions??? Thanks!!

opened by XangoXML 10

Support for Windows

I am using python 2.7.10, but I can't get thing worked.Is this a compatible problem?

d:\Developer\CodeReview\qark>C:\Python27\python.exe qark.py
Traceback (most recent call last):
  File "qark.py", line 24, in <module>
    from modules import common,intents,webviews, report, unpackAPK
  File "d:\Developer\CodeReview\qark\modules\common.py", line 26, in <module>
    from lib.blessed import *
  File "d:\Developer\CodeReview\qark\lib\blessed\__init__.py", line 12, in <modu
    from terminal import Terminal
  File "d:\Developer\CodeReview\qark\lib\blessed\terminal.py", line 7, in <modul
    import termios
ImportError: No module named termios

enhancement

opened by gengjiawen 10

Can't run in Jenkins on macOS due to "termios.error: (25, 'Inappropriate ioctl for device')"

Not possible to run in Jenkins execute shall step on macOS. Any macOS-friendly alternative to script known?

Traceback (most recent call last):
  File "/Users/deploy/Code/qark/qark/qarkMain.py", line 1284, in <module>
    nonAutomatedParseArgs()
  File "/Users/deploy/Code/qark/qark/qarkMain.py", line 465, in nonAutomatedParseArgs
    main()
  File "/Users/deploy/Code/qark/qark/qarkMain.py", line 793, in main
    unpackAPK.decompile(common.pathToDEX)
  File "/Users/deploy/Code/qark/qark/modules/unpackAPK.py", line 165, in decompile
    with common.term.cbreak():
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/contextlib.py", line 17, in __enter__
    return self.gen.next()
  File "/Users/deploy/Code/qark/qark/lib/blessed/terminal.py", line 572, in cbreak
    save_mode = termios.tcgetattr(self.keyboard_fd)
termios.error: (25, 'Inappropriate ioctl for device')

Command:

/usr/bin/python {path_to_quark}/qarkMain.py --source 1 --pathtoapk {path_to_apk}/app.apk --exploit 1 --install -b {path_to_sdk}

Script commands didn't work on macOS for me including ones suggested in #175 and #51 and: script "<command>"

I can't use new v2 since it fails to run on macOS for me.

opened by dmarjanovic 9

Dockerized QARK
Hello,

Why

I believe docker pull could be more convenient than installing everything by yourself.

Details

My Dockerfile uses OpenJDK 7, python 2.7 and Android SDK r24.3.4 - the very same version as declared in sdkManager.py.

The CMD command is a subject to discuss, so I commented it out by now.

I set debian as the default base image because it just makes tinkering with the underlying container os easier, but I also made lightweight alpine version if somebody interested.

How to test dockerized version

You can pull my automated build this way (~~~1GB~~ Update: 675MB):

docker pull ilyaglow/qark

or the alpine version (~~~780MB~~ Update: 436 MB):

docker pull ilyaglow/qark:alpine

Then run it. Change /assessment/apks to your local path with an apk file or app sources:

docker run -it --rm -v /assessment/apks:/apk ilyaglow/qark --source 1 --pathtoapk /apk/yourvulnapp.apk --exploit 0 --reportdir /apk --basesdk /qark/android-sdk-linux

The report will be on the same folder

How to build it by yourself (assuming you're on the QARK repo):

git fetch origin pull/82/head:dockerized git checkout dockerized docker build -t my-qark -f Dockerfile .

Hope somebody will find it useful.

Cheers.
opened by ilyaglow 9
Bump certifi from 2018.1.18 to 2022.12.7
Bumps certifi from 2018.1.18 to 2022.12.7.

Commits

9e9e840 2022.12.07

b81bdb2 2022.09.24

939a28f 2022.09.14

aca828a 2022.06.15.2

de0eae1 Only use importlib.resources's new files() / Traversable API on Python ≥3.11 ...

b8eb5e9 2022.06.15.1

47fb7ab Fix deprecation warning on Python 3.11 (#199)

b0b48e0 fixes #198 -- update link in license

9d514b4 2022.06.15

4151e88 Add py.typed to MANIFEST.in to package in sdist (#196)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
Broken logic since multidex

The dex2jar is only running on the first classes.dex file and putting this into a .jar. So the whole decompiling is only done on a split part of the whole apk code. This can be fixed by updating to dex2jar 2.1 and using it directly on the apk. dex2jar 2.1 supports multidex

opened by GanbaruTobi 0
npm run generate error

hey developers, i am getting this error whenever i tried to use command ''npm run generate'' i followed a youtube video each and every step but his command did work but I am not able to do it. Can anyone help me out, how can i resolve this error? Thanks!

[email protected] generate node index.js

(node:17356) [DEP0147] DeprecationWarning: In future versions of Node.js, fs.rmdir(path, { recursive: true }) will be removed. Use fs.rm(path, { recursive: true }) instead (Use node --trace-deprecation ... to show where the warning was created) F:\NFT\hashlips_art_engine-1.1.2_patch_v1\hashlips_art_engine-1.1.2_patch_v1\src\main.js:183 const image = await loadImage(${_layer.selectedElement.path}); ^

TypeError: Cannot read properties of undefined (reading 'path') at F:\NFT\hashlips_art_engine-1.1.2_patch_v1\hashlips_art_engine-1.1.2_patch_v1\src\main.js:183:61
at new Promise () at loadLayerImg (F:\NFT\hashlips_art_engine-1.1.2_patch_v1\hashlips_art_engine-1.1.2_patch_v1\src\main.js:182:10) at F:\NFT\hashlips_art_engine-1.1.2_patch_v1\hashlips_art_engine-1.1.2_patch_v1\src\main.js:363:31
at Array.forEach () at startCreating (F:\NFT\hashlips_art_engine-1.1.2_patch_v1\hashlips_art_engine-1.1.2_patch_v1\src\main.js:362:17) at F:\NFT\hashlips_art_engine-1.1.2_patch_v1\hashlips_art_engine-1.1.2_patch_v1\index.js:6:3 at Object. (F:\NFT\hashlips_art_engine-1.1.2_patch_v1\hashlips_art_engine-1.1.2_patch_v1\index.js:7:3) at Module._compile (node:internal/modules/cjs/loader:1101:14) at Object.Module._extensions..js (node:internal/modules/cjs/loader:1153:10)

opened by desmax-designer 0
Error running dex2jar command

Platform: Windows 10 Python 3.8 Java 1.8.0_191 Qark version 4.0.0

Error: C:\Users\yyyyyyyyyyyyyyy>qark --apk .\Downloads\xxxxxxxxxxyyyyyyyyyyyyyyy.apk Decompiling... Error running dex2jar command: b'C:\\Users\\yyyyyyyyyyyyyy\\AppData\\Roaming\\Python\\Python38\\site-packages\\qark\\decompiler\\..\\lib\\dex2jar-2.0\\d2j-dex2jar.bat C:\\Users\\yyyyyyyyyyyy\\build\\qark\\classes.dex -o C:\\Users\\yyyyyyyyy\\build\\qark\\xxxxxxxyyyyyyyyyy.jar' Traceback (most recent call last): File "C:\Users\yyyyyyyyyyyy\AppData\Roaming\Python\Python38\site-packages\qark\decompiler\decompiler.py", line 206, in _run_dex2jar ret_code = subprocess.call(shlex.split(dex2jar_command)) File "c:\python38\lib\shlex.py", line 311, in split return list(lex) File "c:\python38\lib\shlex.py", line 300, in next token = self.get_token() File "c:\python38\lib\shlex.py", line 109, in get_token raw = self.read_token() File "c:\python38\lib\shlex.py", line 140, in read_token nextchar = self.instream.read(1) AttributeError: 'bytes' object has no attribute 'read' Error running dex2jar command

opened by giridharkl 0
ImportError: No module named termios

I am trying to run the tool on windows for older version of qark. Please suggest an alternate library for termios [as someone suggested, windows doesn't have pseudo terminal like linux] on windows?

opened by pradeeptewary 0

exploit-apk not working on windows

qark --apk app-debug.apk --report-type html --exploit-apk --sdk-path apkpathgoeshere
....
Finish writing report to c:\programdata\miniconda3\envs\qark\lib\site-packages\qark\report\report.html ...
Building exploit APK...
Error running command %s
Traceback (most recent call last):
  File "c:\programdata\miniconda3\envs\qark\lib\site-packages\qark\apk_builder.py", line 115, in _build_apk
    subprocess.call(shlex.split(command))
  File "c:\programdata\miniconda3\envs\qark\lib\subprocess.py", line 172, in call
    return Popen(*popenargs, **kwargs).wait()
  File "c:\programdata\miniconda3\envs\qark\lib\subprocess.py", line 394, in __init__
    errread, errwrite)
  File "c:\programdata\miniconda3\envs\qark\lib\subprocess.py", line 644, in _execute_child
    startupinfo)
WindowsError: [Error 193] %1 is not a valid Win32 application
Traceback (most recent call last):
  File "c:\programdata\miniconda3\envs\qark\lib\runpy.py", line 174, in _run_module_as_main
    "__main__", fname, loader, pkg_name)
  File "c:\programdata\miniconda3\envs\qark\lib\runpy.py", line 72, in _run_code
    exec code in run_globals
  File "C:\ProgramData\Miniconda3\envs\qark\Scripts\qark.exe\__main__.py", line 7, in <module>
  File "c:\programdata\miniconda3\envs\qark\lib\site-packages\click\core.py", line 829, in __call__
    return self.main(*args, **kwargs)
  File "c:\programdata\miniconda3\envs\qark\lib\site-packages\click\core.py", line 782, in main
    rv = self.invoke(ctx)
  File "c:\programdata\miniconda3\envs\qark\lib\site-packages\click\core.py", line 1066, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "c:\programdata\miniconda3\envs\qark\lib\site-packages\click\core.py", line 610, in invoke
    return callback(*args, **kwargs)
  File "c:\programdata\miniconda3\envs\qark\lib\site-packages\click\decorators.py", line 21, in new_func
    return f(get_current_context(), *args, **kwargs)
  File "c:\programdata\miniconda3\envs\qark\lib\site-packages\qark\qark.py", line 102, in cli
    exploit_builder.build()
  File "c:\programdata\miniconda3\envs\qark\lib\site-packages\qark\apk_builder.py", line 76, in build
    self._build_apk()
  File "c:\programdata\miniconda3\envs\qark\lib\site-packages\qark\apk_builder.py", line 116, in _build_apk
    subprocess.call(shlex.split(command))
  File "c:\programdata\miniconda3\envs\qark\lib\subprocess.py", line 172, in call
    return Popen(*popenargs, **kwargs).wait()
  File "c:\programdata\miniconda3\envs\qark\lib\subprocess.py", line 394, in __init__
    errread, errwrite)
  File "c:\programdata\miniconda3\envs\qark\lib\subprocess.py", line 644, in _execute_child
    startupinfo)
WindowsError: [Error 193] %1 is not a valid Win32 application

Problem seems to be in this file: c:\programdata\miniconda3\envs\qark\lib\site-packages\qark\apk_builder.py

After inspecting the file, line 115 is attempting to launch ./gradlew. this obviously isnt suitable to Windows environments and would have to be changed to gradlew.bat

Suggested change in the project is to include an if os.name == 'nt': check and then make use of either ./gradlew or gradlew.bat.

Willing to create a pull request, but not sure of other impacts this may have.

opened by DarkSurferZA 0

Releases(v0.9-alpha.10)

v0.9-alpha.10(Sep 17, 2015)
New Features

Added support for handling inheritance

Added support for resolving Extras which are not string literals

Improvements

Converted functionality of detecting extras to use parser, rather than regex

Added regex fall-back for extra detection when file cannot be parsed properly

Refactoring of function names

Bug Fixes

Resolved HTML report generation issues

Resolved issue with inadvertent use of previously installed SDK

Resolved issues where exploit APK could not be built by certain SDK versions

Changed text in Broadcast Listener to display what was actually going on to avoid confusion

Resolved issues where Extras may be duplicated in the exploit APK or ADB commands

Source code(tar.gz)
Source code(zip)
v0.9-alpha.1(Aug 17, 2015)
v0.9-alpha.1

Component names are now normalized

Source code(tar.gz)
Source code(zip)

Owner

GitHub

MMDUtils is a library for read/write mmd related file in java

MMDUtils MMDUtils is a library for read/write mmd related file in java Features Read/Write VMD(Vocaloid Motion Data) file Read/Write PMX(Polygon Model

5 Jan 28, 2022

FractalUtils - A collection of utility functions and classes, with an emphasis on game related utilities

A collection of utility functions and classes written in Kotlin. There is some emphasis on utilities useful for games (Geometry, Random, Time, Updating, etc).

2 Nov 11, 2022

Android Shared preference wrapper than encrypts the values of Shared Preferences. It's not bullet proof security but rather a quick win for incrementally making your android app more secure.

Secure-preferences - Deprecated Please use EncryptedSharedPreferences from androidx.security in preferenced to secure-preference. (There are no active

1.5k Dec 24, 2022

recompose is a tool for converting Android layouts in XML to Kotlin code using Jetpack Compose.

565 Jan 2, 2023

A tool to validate text inside TextInputLayout

Download dependencies { implementation 'com.github.anderscheow:validator:2.2.1' } Usage Available rules LengthRule MaxRule MinRule NotEmptyRule NotN

129 Nov 25, 2022

An easy-to-use, cross-platform measurement tool that pulls data out of CD pipelines and analysis the four key metrics for you.

Maintained by SEA team, ThoughtWorks Inc. Read this in other languages: English, 简体中文 Table of Contents About the Project Usage How to Compute Contrib