You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CWE-20/README.md
+20-22Lines changed: 20 additions & 22 deletions
Original file line number
Diff line number
Diff line change
@@ -1,38 +1,34 @@
1
1
# Detect CWE-20 in Android Application
2
2
3
+
This scenario seeks to find **Improper Input Validation** in the APK file.
3
4
4
-
This scenario seeks to find **Improper Input Validation** in the APK
5
-
file.
6
-
7
-
## CWE-20 Improper Input Validation
5
+
## CWE-20: Improper Input Validation
8
6
9
7
We analyze the definition of CWE-20 and identify its characteristics.
10
8
11
-
See [CWE-20](https://cwe.mitre.org/data/definitions/20.html) for more
12
-
details.
9
+
See [CWE-20](https://cwe.mitre.org/data/definitions/20.html) for more details.
13
10
14
-
11
+
15
12
16
13
## Code of CWE-20 in diva.apk
17
14
18
-
We use the [diva.apk](https://github.com/payatu/diva-android) sample to
19
-
explain the vulnerability code of CWE-20.
15
+
We use the [diva.apk](https://github.com/payatu/diva-android) sample to explain the vulnerability code of CWE-20.
20
16
21
-
17
+
22
18
23
-
## Quark Script CWE-20.py
19
+
## CWE-20 Detection Process Using Quark Script API
20
+
21
+
22
+
23
+
Let’s use the above APIs to show how the Quark script finds this vulnerability.
24
24
25
-
Let's use the above APIs to show how the Quark script finds this
26
-
vulnerability.
25
+
First, we design a detection rule ``openUrlThatUserInput.json``, to spot the behavior of opening the URL that the user inputs. Then, we use API ``behaviorInstance.getMethodsInArgs()`` to get a list of methods that the URL in ``loadUrl`` passes through. Finally, we check if any validation method is in the list. If No, the APK does not validate user input. That causes CWE-20 vulnerability.
27
26
28
-
First, we design a detection rule `openUrlThatUserInput.json`, to spot
29
-
the behavior of opening the URL that the user inputs. Then, we use API
30
-
`behaviorInstance.getMethodsInArgs()` to get a list of methods that the
31
-
URL in `loadUrl` passes through. Finally, we check if any validation
32
-
method is in the list. If No, the APK does not validate user input. That
33
-
causes CWE-20 vulnerability.
27
+
## Quark Script CWE-20.py
28
+
29
+
34
30
35
-
```python
31
+
```python
36
32
from quark.script import runQuarkAnalysis, Rule
37
33
38
34
SAMPLE_PATH="diva.apk"
@@ -54,7 +50,9 @@ for openUrl in result.behaviorOccurList:
54
50
55
51
## Quark Rule: openUrlThatUserInput.json
56
52
57
-
```json
53
+
54
+
55
+
```json
58
56
{
59
57
"crime": "Open the Url that user input",
60
58
"permission": [],
@@ -77,7 +75,7 @@ for openUrl in result.behaviorOccurList:
77
75
78
76
## Quark Script Result
79
77
80
-
```TEXT
78
+
```
81
79
$ python CWE-20.py
82
80
CWE-20 is detected in method, Ljakhar/aseem/diva/InputValidation2URISchemeActivity; get (Landroid/view/View;)V
Copy file name to clipboardExpand all lines: CWE-921/README.md
+21-20Lines changed: 21 additions & 20 deletions
Original file line number
Diff line number
Diff line change
@@ -1,36 +1,35 @@
1
1
# Detect CWE-921 in Android Application
2
2
3
-
This scenario seeks to find the **unsecured storage mechanism of
4
-
sensitive data** in the APK file.
3
+
This scenario seeks to find the **unsecured storage mechanism of sensitive data** in the APK file.
5
4
6
-
## CWE-921 Storage of Sensitive Data in a Mechanism without Access Control
5
+
## CWE-921: Storage of Sensitive Data in a Mechanism without Access Control
7
6
8
7
We analyze the definition of CWE-921 and identify its characteristics.
9
8
10
-
See [CWE-921](https://cwe.mitre.org/data/definitions/921.html) for more
11
-
details.
9
+
See [CWE-921](https://cwe.mitre.org/data/definitions/921.html) for more details.
10
+
11
+
12
12
13
-
14
13
15
14
## Code of CWE-921 in ovaa.apk
16
15
17
-
We use the [ovaa.apk](https://github.com/oversecured/ovaa) sample to
18
-
explain the vulnerability code of CWE-921.
16
+
We use the [ovaa.apk](https://github.com/oversecured/ovaa) sample to explain the vulnerability code of CWE-921.
19
17
20
-
18
+
21
19
22
-
## Quark Script: CWE-921.py
20
+
## CWE-921 Detection Process Using Quark Script API
21
+
22
+
23
+
24
+
Let’s use the above APIs to show how the Quark script finds this vulnerability.
23
25
24
-
Let's use the above APIs to show how the Quark script finds this
25
-
vulnerability.
26
+
First, we design a detection rule ``checkFileExistence.json`` to spot on behavior that checks if a file exists on a given storage mechanism. Then, we use API ``methodInstance.getArguments()`` to get the file path. Finally, CWE-921 is found if the file path contains the keyword ``sdcard``.
26
27
27
-
First, we design a detection rule `checkFileExistence.json` to spot on
28
-
behavior that checks if a file exists on a given storage mechanism.
29
-
Then, we use API `methodInstance.getArguments()` to get the file path.
30
-
Finally, CWE-921 is found if the file path contains the keyword
31
-
`sdcard`.
28
+
## Quark Script: CWE-921.py
29
+
30
+
32
31
33
-
```python
32
+
```python
34
33
from quark.script import runQuarkAnalysis, Rule
35
34
36
35
SAMPLE_PATH="ovaa.apk"
@@ -48,7 +47,9 @@ for existingFile in quarkResult.behaviorOccurList:
48
47
49
48
## Quark Rule: checkFileExistence.json
50
49
51
-
```json
50
+
51
+
52
+
```json
52
53
{
53
54
"crime": "Check file existence",
54
55
"permission": [],
@@ -71,7 +72,7 @@ for existingFile in quarkResult.behaviorOccurList:
Copy file name to clipboardExpand all lines: CWE-94/README.md
+28-28Lines changed: 28 additions & 28 deletions
Original file line number
Diff line number
Diff line change
@@ -1,57 +1,55 @@
1
1
# Detect CWE-94 in Android Application
2
2
3
+
This scenario seeks to find **code injection** in the APK file.
3
4
4
-
This scenario seeks to find **code injection** in the APK file.
5
-
6
-
## CWE-94 Improper Control of Generation of Code
5
+
## CWE-94: Improper Control of Generation of Code
7
6
8
7
We analyze the definition of CWE-94 and identify its characteristics.
9
8
10
-
See [CWE-94](https://cwe.mitre.org/data/definitions/94.html) for more
11
-
details.
9
+
See [CWE-94](https://cwe.mitre.org/data/definitions/94.html) for more details.
12
10
13
-
11
+
14
12
15
13
## Code of CWE-94 in ovaa.apk
16
14
17
-
We use the [ovaa.apk](https://github.com/oversecured/ovaa) sample to
18
-
explain the vulnerability code of CWE-94.
15
+
We use the [ovaa.apk](https://github.com/oversecured/ovaa) sample to explain the vulnerability code of CWE-94.
19
16
20
-
17
+
21
18
22
-
## Quark Script: CWE-94.py
19
+
## CWE-94 Detection Process Using Quark Script API
20
+
21
+
Let's use the above APIs to show how the Quark script finds this vulnerability.
23
22
24
-
Let\'s use the above APIs to show how the Quark script finds this
25
-
vulnerability.
23
+
First, we design a detection rule ``loadExternalCode.json`` to spot on behavior using the method ``createPackageContext``. Then, we find the caller method that calls the ``createPackageContext``. Finally, we check if the method ``checkSignatures`` is called in the caller method for verification.
26
24
27
-
First, we design a detection rule `loadExternalCode.json` to spot on
28
-
behavior using the method `createPackageContext`. Then, we find the
29
-
caller method that calls the `createPackageContext`. Finally, we check
30
-
if the method `checkSignatures` is called in the caller method for
0 commit comments