安全分析报告： E.B.xs工具箱 v3.0

安全分数


安全分数 53/100

风险评级


等级

  1. A
  2. B
  3. C
  4. F

严重性分布 (%)


隐私风险

0

用户/设备跟踪器


调研结果

高危 2
中危 8
信息 2
安全 2
关注 0

高危 如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击 

如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-7

Files:
com/iapp/app/c.java, line(s) 100,105,10

高危 启用了调试配置。生产版本不能是可调试的 

启用了调试配置。生产版本不能是可调试的
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04c-Tampering-and-Reverse-Engineering.md#debugging-and-tracing

Files:
com/LoverZS/dx/BuildConfig.java, line(s) 3,4

中危 应用程序已启用明文网络流量 

[android:usesCleartextTraffic=true]
应用程序打算使用明文网络流量，例如明文HTTP，FTP协议，DownloadManager和MediaPlayer。针对API级别27或更低的应用程序，默认值为“true”。针对API级别28或更高的应用程序，默认值为“false”。避免使用明文流量的主要原因是缺乏机密性，真实性和防篡改保护；网络攻击者可以窃听传输的数据，并且可以在不被检测到的情况下修改它。

中危 可能存在跨域漏洞。在 WebView 中启用从 URL 访问文件可能会泄漏文件系统中的敏感信息 

可能存在跨域漏洞。在 WebView 中启用从 URL 访问文件可能会泄漏文件系统中的敏感信息
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-6

Files:
c/b/a/a/t.java, line(s) 5131,2057,5115
com/iapp/app/Aid_YuCodeX.java, line(s) 1767,1799,1751,1783,3563
com/iapp/app/Aid_javaCode.java, line(s) 1155,1139,2069,2178
com/iapp/app/Aid_jsCode.java, line(s) 1793,1777,2643,2752
com/iapp/app/Aid_luaCode.java, line(s) 1695,1679,2628,2744
com/iapp/app/Webview.java, line(s) 390,373
com/iapp/app/c.java, line(s) 45,70,46,71
com/iapp/app/run/main.java, line(s) 728,712
com/iapp/app/run/main2.java, line(s) 468,452
com/iapp/app/run/main3.java, line(s) 710,694
com/iapp/app/run/mian.java, line(s) 1127,1159,1111,1143

中危 不安全的Web视图实现。可能存在WebView任意代码执行漏洞 

不安全的Web视图实现。可能存在WebView任意代码执行漏洞
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#testing-javascript-execution-in-webviews-mstg-platform-5

Files:
c/b/a/a/t.java, line(s) 2074,5905,2057,5115
com/iapp/app/Aid_YuCodeX.java, line(s) 3580,4977,1751,1783,3563
com/iapp/app/Aid_javaCode.java, line(s) 2086,2195,3004,1139,2069,2178
com/iapp/app/Aid_jsCode.java, line(s) 2660,2769,3646,4470,1777,2643,2752
com/iapp/app/Aid_luaCode.java, line(s) 2645,2761,3583,1679,2628,2744
com/iapp/app/c.java, line(s) 63,88,46,71

中危 应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库 

应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2

Files:
c/b/a/a/n.java, line(s) 6,97,99,108
c/b/a/a/t.java, line(s) 15,7380
com/iapp/app/Aid_YuCodeX.java, line(s) 15,6394
com/iapp/app/Aid_javaCode.java, line(s) 14,3809
com/iapp/app/Aid_jsCode.java, line(s) 13,4360
com/iapp/app/Aid_luaCode.java, line(s) 14,4477

中危 应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据 

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
c/b/a/a/d.java, line(s) 312,329,20
com/i24998b4d5daee70a/CrashHandler.java, line(s) 65
com/iapp/app/p.java, line(s) 27
top/canyie/pine/C0109.java, line(s) 133
top/canyie/pine/C0132.java, line(s) 132

中危 SHA-1是已知存在哈希冲突的弱哈希 

SHA-1是已知存在哈希冲突的弱哈希
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
org/jf/dexlib2/writer/DexWriter.java, line(s) 284

中危 应用程序使用不安全的随机数生成器 

应用程序使用不安全的随机数生成器
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
c/b/a/a/g.java, line(s) 29

中危 此应用可能包含硬编码机密信息 

从应用程序中识别出以下机密确保这些不是机密或私人信息
A1ODBdI6WtkY15xaJo3FX0QYGxcLv4O1bDHzryYBLk2UYvtP5
A2tfZHAY7YWCXPdOBftb5Gnplg5fdSVUmh1SzzFnBtGxMvYsv
XNb7mBRVD8adQ1MLcLV3CbYvW8sQq
A4OQN5VJ39Qtg0ZyhaRUC787NH96xJxMtkGOKyLuFJGBH4vSh
A76nEfp06rOOpqoR1OhSC3o1zHQoqDXtXFEPgPHSFXFAHVdkh
A1xwY9cpCS2f2NDdA3YccdZxssohzdDhbsIpyzvGAUypyJ7Pl
A7U848IOhL6yTgLSb1Ai997yOEn8E7rjN9mNxTYr6bUO4d4MG
A3Gutv9yrUekRrMgbqidYmJWJJuT42WWwclnYP6yyUVjmiRnY
A7dXO4pmxehRr5FrqvehkiCEorU0IluUq3YTIxinulBFqUxB2
A40ZNGO1eL9CRncbumDTT1gnDvZr5Fdmn3nUukFJjlhnsrvg3

信息 应用程序记录日志信息,不得记录敏感信息 

应用程序记录日志信息,不得记录敏感信息
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs

Files:
android2/content/res/Resources.java, line(s) 31
bsh/BshClassManager.java, line(s) 320
bsh/CommandLineReader.java, line(s) 20
bsh/Console.java, line(s) 12,9
bsh/NameSpace.java, line(s) 302
bsh/Parser.java, line(s) 2304
bsh/Remote.java, line(s) 44,97,105,142
bsh/SimpleNode.java, line(s) 32
bsh/classpath/BshClassPath.java, line(s) 466,475,672
bsh/classpath/ClassManagerImpl.java, line(s) 246
bsh/util/ClassBrowser.java, line(s) 470
bsh/util/Httpd.java, line(s) 23
bsh/util/JDemoApplet.java, line(s) 27,30
bsh/util/Sessiond.java, line(s) 22
bsh/util/SessiondConnection.java, line(s) 29
c/b/a/a/f.java, line(s) 70
c/d/a/k.java, line(s) 79,82,191,275,278,315,334,337
cn/hugo/android/scanner/CaptureActivity.java, line(s) 283,105,115,118
cn/hugo/android/scanner/b.java, line(s) 41
cn/hugo/android/scanner/d.java, line(s) 28,79,85
cn/hugo/android/scanner/f/a.java, line(s) 54,64,74
cn/hugo/android/scanner/f/b.java, line(s) 60,68,81,86,103,114,125,166,178,188,54,185,190,211
cn/hugo/android/scanner/f/c.java, line(s) 73,100,101,102,177,141,140,149
cn/hugo/android/scanner/f/e.java, line(s) 25,28,12
cn/hugo/android/scanner/f/f.java, line(s) 30
cn/hugo/android/scanner/h/c.java, line(s) 77,90,98,113,117,109
cn/hugo/android/scanner/h/f.java, line(s) 49
com/beust/jcommander/internal/DefaultConsole.java, line(s) 11,16
com/swift/sandhook/ClassNeverCall.java, line(s) 10
com/swift/sandhook/HookLog.java, line(s) 10,14,18,22,26,30
com/swift/sandhook/PendingHookHandler.java, line(s) 49,44
com/swift/sandhook/SandHook.java, line(s) 252
com/swift/sandhook/utils/FileUtils.java, line(s) 71,106
com/swift/sandhook/utils/ReflectionUtils.java, line(s) 23
com/swift/sandhook/utils/Unsafe.java, line(s) 88,32
fr/castorflex/android/verticalviewpager/VerticalViewPager.java, line(s) 1572,1578,1595
jas/StackMap.java, line(s) 53,57
jasmin/ClassFile.java, line(s) 92,94,106,108,111,113,116
jasmin/Main.java, line(s) 24,29,51,57,90,109,115,88,119
java_cup/runtime/lr_parser.java, line(s) 55,156
junit/runner/BaseTestRunner.java, line(s) 273
junit/textui/TestRunner.java, line(s) 37,89,108
np/protect/assets/p/C0073.java, line(s) 58,543
np/protect/assets/p/C0075.java, line(s) 335
org/antlr/runtime/BaseRecognizer.java, line(s) 163
org/jf/baksmali/Adaptors/ClassDefinition.java, line(s) 194,227,230,231,299,300
org/jf/baksmali/AnalysisArguments.java, line(s) 66,68
org/jf/baksmali/Baksmali.java, line(s) 84,95,104,111,121,131,138,149
org/jf/baksmali/DeodexCommand.java, line(s) 43,49
org/jf/baksmali/DexInputCommand.java, line(s) 47,58
org/jf/baksmali/DisassembleCommand.java, line(s) 109,119,152,166,174,178,208,125
org/jf/baksmali/DumpCommand.java, line(s) 34,42
org/jf/baksmali/HelpCommand.java, line(s) 61,35,43,49,55,63,69
org/jf/baksmali/ListClassesCommand.java, line(s) 30,38
org/jf/baksmali/ListDependenciesCommand.java, line(s) 47,55,75,78,62,70
org/jf/baksmali/ListDexCommand.java, line(s) 41,48,54
org/jf/baksmali/ListFieldOffsetsCommand.java, line(s) 39,70
org/jf/baksmali/ListHelpCommand.java, line(s) 39,31,41,46
org/jf/baksmali/ListReferencesCommand.java, line(s) 28,36
org/jf/baksmali/ListVtablesCommand.java, line(s) 54,106
org/jf/baksmali/Main.java, line(s) 63,64,65
org/jf/dexlib2/dexbacked/DexBackedMethodImplementation.java, line(s) 129,133
org/jf/dexlib2/dexbacked/raw/StringIdItem.java, line(s) 22,23
org/jf/dexlib2/dexbacked/raw/util/DexAnnotator.java, line(s) 151
org/jf/smali/HelpCommand.java, line(s) 38,31,41,45
org/jf/smali/Main.java, line(s) 62,63,64
org/jf/smali/Smali.java, line(s) 137,152,191
org/jf/smali/smaliFlexLexer.java, line(s) 170,176
org/jf/util/jcommander/Command.java, line(s) 19
org/keplerproject/luajava/Console.java, line(s) 38,39,24
org/keplerproject/luajava/LuaObject.java, line(s) 354
org/objectweb/asm/commons/JSRInlinerAdapter.java, line(s) 220
org/objectweb/asm/util/ASMifier.java, line(s) 301,302
org/objectweb/asm/util/ASMifierClassVisitor.java, line(s) 49,50
org/objectweb/asm/util/CheckClassAdapter.java, line(s) 352,353
org/objectweb/asm/util/Textifier.java, line(s) 289,290
org/objectweb/asm/xml/Processor.java, line(s) 595,596,646,647,648,722
p/rn/name/RenamerMain.java, line(s) 28
p/rn/owner/WebApp.java, line(s) 14,33,42,64
top/canyie/pine/Pine.java, line(s) 81,157,912

信息 此应用程序将数据复制到剪贴板。敏感数据不应复制到剪贴板，因为其他应用程序可以访问它 

此应用程序将数据复制到剪贴板。敏感数据不应复制到剪贴板，因为其他应用程序可以访问它
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04b-Mobile-App-Security-Testing.md#clipboard

Files:
com/i24998b4d5daee70a/CrashHandler.java, line(s) 7,186
com/iapp/app/ays.java, line(s) 8,148

安全 此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击 

此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-4

Files:
c/b/a/a/g.java, line(s) 574,576

安全 此应用程序没有隐私跟踪程序 

此应用程序不包括任何用户或设备跟踪器。在静态分析期间没有找到任何跟踪器。

安全评分: ( E.B.xs工具箱 3.0)