-
-
Notifications
You must be signed in to change notification settings - Fork 3.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix untar permission errors, update ssl pinning scripts, add intent t…
…race and update intent dumper
- Loading branch information
1 parent
d932575
commit e3ce0cf
Showing
10 changed files
with
506 additions
and
249 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
20 changes: 20 additions & 0 deletions
20
mobsf/DynamicAnalyzer/tools/frida_scripts/android/others/detect-ssl-pinning.js
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| try { | ||
| var UnverifiedCertError = Java.use('javax.net.ssl.SSLPeerUnverifiedException'); | ||
| UnverifiedCertError.$init.implementation = function(str) { | ||
| send('Unexpected SSLPeerUnverifiedException occurred'); | ||
| try { | ||
| var stackTrace = Java.use('java.lang.Thread').currentThread().getStackTrace(); | ||
| var exceptionStackIndex = stackTrace.findIndex(stack => stack.getClassName() === "javax.net.ssl.SSLPeerUnverifiedException"); | ||
| var callingFunctionStack = stackTrace[exceptionStackIndex + 1]; | ||
| var className = callingFunctionStack.getClassName(); | ||
| var methodName = callingFunctionStack.getMethodName(); | ||
| var callingClass = Java.use(className); | ||
| var callingMethod = callingClass[methodName]; | ||
| send('SSL exception caused: ' + className + '.' + methodName + '. Patch this method to bypass pinning.'); | ||
| if (callingMethod.implementation) { | ||
| return; | ||
| } | ||
| } catch (e) {} | ||
| return this.$init(str); | ||
| }; | ||
| } catch (err) {} |
110 changes: 91 additions & 19 deletions
110
mobsf/DynamicAnalyzer/tools/frida_scripts/android/others/dump-intent.js
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,21 +1,93 @@ | ||
| // https://gist.github.com/bet4it/b62ac2d5bd45b8cb699905fa498baf5e | ||
| Java.perform(function () { | ||
| var act = Java.use("android.app.Activity"); | ||
| act.getIntent.overload().implementation = function () { | ||
| var intent = this.getIntent() | ||
| var cp = intent.getComponent() | ||
| send("[Intent Dumper] Starting " + cp.getPackageName() + "/" + cp.getClassName()) | ||
| var ext = intent.getExtras(); | ||
| if (ext) { | ||
| var keys = ext.keySet() | ||
| var iterator = keys.iterator() | ||
| while (iterator.hasNext()) { | ||
| var k = iterator.next().toString() | ||
| var v = ext.get(k) | ||
| send("\t" + v.getClass().getName()) | ||
| send("\t" + k + ' : ' + v.toString()) | ||
| } | ||
| var Activity = Java.use("android.app.Activity"); | ||
|
|
||
| Activity.getIntent.overload().implementation = function () { | ||
| var intent = this.getIntent(); | ||
| var component = intent.getComponent(); | ||
|
|
||
| send("[Intent Dumper] Captured Intent for Activity:"); | ||
|
|
||
| // Component (target package and class) | ||
| if (component) { | ||
| send(" Component:"); | ||
| send(" Package: " + component.getPackageName()); | ||
| send(" Class: " + component.getClassName()); | ||
| } else { | ||
| send(" Component: None"); | ||
| } | ||
| return intent; | ||
| }; | ||
| }) | ||
|
|
||
| // Action | ||
| var action = intent.getAction(); | ||
| send(" Action: " + (action ? action : "None")); | ||
|
|
||
| // Data URI | ||
| var dataUri = intent.getDataString(); | ||
| send(" Data URI: " + (dataUri ? dataUri : "None")); | ||
|
|
||
| // Flags | ||
| var flags = intent.getFlags(); | ||
| send(" Flags: " + flags); | ||
|
|
||
| // Dumping extras in the Intent | ||
| var extras = intent.getExtras(); | ||
| if (extras) { | ||
| send(" Extras:"); | ||
| var iterator = extras.keySet().iterator(); | ||
| while (iterator.hasNext()) { | ||
| var key = iterator.next(); | ||
| var value = extras.get(key); | ||
| if (value !== null) { | ||
| send(" " + key + " (" + value.getClass().getName() + "): " + valueToString(value)); | ||
| } | ||
| } | ||
| } else { | ||
| send(" Extras: None"); | ||
| } | ||
|
|
||
| return intent; | ||
| }; | ||
|
|
||
| // Helper function to convert intent extras to a readable string | ||
| function valueToString(value) { | ||
| var valueType = value.getClass().getName(); | ||
|
|
||
| if (valueType === "android.os.Bundle") { | ||
| return bundleToString(Java.cast(value, Java.use("android.os.Bundle"))); | ||
| } else if (valueType === "java.lang.String") { | ||
| return '"' + value + '"'; | ||
| } else if (valueType === "java.lang.Integer" || valueType === "java.lang.Float" || valueType === "java.lang.Boolean") { | ||
| return value.toString(); | ||
| } else if (valueType === "java.util.ArrayList") { | ||
| return arrayListToString(Java.cast(value, Java.use("java.util.ArrayList"))); | ||
| } else { | ||
| send("Unsupported extra type for key. Type: " + valueType); | ||
| return value.toString(); | ||
| } | ||
| } | ||
|
|
||
| // Function to handle nested Bundles | ||
| function bundleToString(bundle) { | ||
| var result = "{"; | ||
| var iterator = bundle.keySet().iterator(); | ||
| while (iterator.hasNext()) { | ||
| var key = iterator.next(); | ||
| var value = bundle.get(key); | ||
| result += key + ": " + (value !== null ? valueToString(value) : "null") + ", "; | ||
| } | ||
| result = result.slice(0, -2); // Remove trailing comma and space | ||
| result += "}"; | ||
| return result; | ||
| } | ||
|
|
||
| // Function to handle ArrayLists (if any) | ||
| function arrayListToString(arrayList) { | ||
| var result = "["; | ||
| for (var i = 0; i < arrayList.size(); i++) { | ||
| var item = arrayList.get(i); | ||
| result += valueToString(item) + ", "; | ||
| } | ||
| result = result.slice(0, -2); // Remove trailing comma and space | ||
| result += "]"; | ||
| return result; | ||
| } | ||
| }); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.