Mobile application penetration testing tool

Abstract

This invention relates to a mobile application penetration testing tool, which can be used to detect and analyze vulnerabilities in Android mobile applications using reverse engineering and static code analysis methods, characterized in that it comprises an interface containing a main script (1) on which a main menu and functions are present and through which a user enters the menu option; a processor that executes a sasting script (2) which is the first function of the main script (1) and reverse-engineers an APK file with an APKTool by getting an APK file path from a user, an hdcoding script (3) which is the second function of the main script (1), searches for specific keywords within the reverse-engineered APK files, detects vulnerabilities and notifies the user of them; a flagchecker script (4) which is the third function of the main script (1) and analyzes the AndroidManifest.xml file, checks the settings that may lead to potential security vulnerabilities and whether the specified features are turned on; a mainfinder script (5) which is the fourth function of the main script (1) and searches for certain features and permissions in the AndroidManifest.xml file using grep commands, saves them in various text files, reads the information in these files and notifies the user of them; and a verschecker script (6), which connects via the Android Debug Bridge by getting the IP and port information of an Android device or an emulator, checks the Android version of the device and reports it to a user.

Description

[0001] MOBILE APPLICATION PENETRATION TESTING TOOL

[0002] Technological Field:

[0003] This invention relates to a mobile application penetration testing tool, which can be used to detect and analyze vulnerabilities in Android mobile applications using reverse engineering and static code analysis methods.

[0004] State of the Art:

[0005] Nowadays, the detection of vulnerabilities in Android applications is usually carried out by manual methods. This process involved security experts and developers manually reviewing the application code to look for potential vulnerabilities. Manual security tests are carried out by providing detailed code reviews and various test scenarios. By analyzing the application's resource codes, security experts try to detect data leaks, weak encryption algorithms, insecure data storage methods, and other critical vulnerabilities. In addition, in-app behaviors and data flows are manually reviewed to understand the operation of the application. There are a few significant drawbacks of these manual methods. Being time-consuming: manual security tests are very timeconsuming as they require detailed and meticulous work. It can take weeks or even months to manually review all codes of an application and identify all potential vulnerabilities. Presence of a risk of error: the possibility of human error is quite high in this process. Even a small detail that security experts overlook can cause a major security vulnerability. In addition, since subjective evaluations may be made during manual reviews, inconsistencies may occur in the detection of security vulnerabilities. High cost: such detailed and time-consuming security tests lead to high labor costs. Employing expert security personnel and ensuring them to conduct detailed investigations brings serious costs to businesses. Limitation of Scope: in large and complex applications, the scope of manual testing is often limited. These drawbacks significantly limit the effectiveness and accuracy of manual security tests.

[0006] In the patent application no. CN107438078A, "Application Security Protection System and Application Security Protection Method" is described. The invention describes an application security protection system and an application security protection method. Application security protection method is comprises the steps of: after the mobile application is started, performing debugger attachment detection; detecting whether an application receives an attack; detecting whether the mobile equipment has been jailbroken; sending the UDID of the mobile equipment, the user login information, the jail identifier of the mobile equipment, a timestamp and MD5 values of the relevant parameters to a server side; using the server side to verify whether the user login information is correct; using the server side to verify whether the currently transmitted UDID of the mobile equipment is consistent with the latest original equipment UDID corresponding to an account stored by the server side; and using the server side to verify whether the jailbreak identification of the currently transmitted mobile equipment is consistent with the latest original jailbreak identification of the equipment corresponding to the account stored by the server side. The application security protection method is advantageous in that the security protection is automatically provided for the user's account, thereby improving the integrated security performance of the mobile application.

[0007] In patent application EP2715599A1 , "Application Security Testing" is described. The invention provides a system that includes a server hosting an application under test (AUT), an observer configured to monitor instructions executed by the AUT, and a computing device communicatively coupled to the AUT and the observer through a common communication channel. The computing device may be configured to send an application request to the AUT, wherein the application request is configured to expose a potential vulnerability of the AUT. The computing device may receive an application response from the AUT in accordance with the AUT's programming. The computing device may send a service request to the observer, and receive a service response from the observer that contains information corresponding to the instructions executed by the AUT due to the application request, information about the AUT, or information about a server hosting the AUT.

[0008] The above describes the inventions that describe the mobile application firewall and mobile application security testing. These inventions aim to protect the mobile application by means of the conventional methods and to test the firewall of this application. However, the prevalence of these methods causes the attacks to be revised according to these methods. Therefore, the security of the application cannot be fully ensured. In addition, security tests take a long time. Therefore, costs increase. Consequently, there is a need for a new technology which can overcome the disadvantages mentioned above.

[0009] Definition of the Invention:

[0010] This invention is a mobile application penetration testing tool that can overcome the above-mentioned disadvantages, characterized in that it is able to perform detailed security analysis, to obtain accurate and consistent results, to increase security, to protect the user data, to use reverse engineering techniques, and to save time and expenses.

[0011] The invention automates the time-consuming and error-prone processes of manual security testing, thereby providing faster and more accurate results. The invention analyzes APK files by reverse engineering methods, makes the resource codes readable and performs a static code analysis. This analysis identifies critical vulnerabilities such as data leaks, weak encryption algorithms, and insecure network communication in accordance with OWASP standards. Thanks to its user-friendly interface, it can be easily used by both developers and security experts. In addition, its automated analysis capabilities provide an economical solution by reducing the cost of the security tests. The invention aims to contribute to the protection of users' personal and financial information by increasing the mobile application security. This innovative approach eliminates the time-consuming and error-prone drawbacks of the existing manual testing, thereby improving the accuracy and validity of the security assessments.

[0012] Description of the Drawings:

[0013] The invention will be described with reference to the accompanying drawings, so that the features of the invention will be more clearly understood and appreciated, but it is not intended to limit the invention to these particular embodiments. On the contrary, it is intended to cover all alternatives, modifications and equivalents of the invention which may be included within the scope of the invention as defined by the appended claims. It should be understood that the details shown are only for illustration of the preferred embodiments of the invention, and are presented for the purpose of providing the most useful and easy-to-understand description of both the embodiment of the methods and the rules and conceptual features of the invention. In these drawings:

[0014] Fig. 1 is a schematic view of the system.

[0015] The figures which will help to understand this invention are numbered as indicated in the attached drawings and are given below with their names.

[0016] Description of the References:

[0017] 1 . Main Script

[0018] 2. Sasting Script

[0019] 3. Hdcoding Script

[0020] 4. Flagchecker Script

[0021] 5. Mainfinder Script

[0022] 6. Verschecker Script

[0023] Description of the Invention:

[0024] The invention includes a main script (1) on which a main menu and functions are present and through which a user enters the menu option; a sasting script (2) which is the first function of the main script (1) and reverse-engineers an APK file with an APKTool by getting an APK file path from a user, a hdcoding script (3) which is the second function of the main script (1), searches for specific keywords within the reverse-engineered APK files, detects vulnerabilities and notifies the user of them; a flagchecker script (4) which is the third function of the main script (1) and analyzes the AndroidManifest.xml file, checks the settings that may lead to potential security vulnerabilities and whether the specified features are turned on; a mainfinder script (5) which is the fourth function of the main script (1) and searches for certain features and permissions in the AndroidManifest.xml file using grep commands, saves them in various text files, reads the information in these files and notifies the user of them; and a verschecker script (6), which connects via the Android Debug Bridge by getting the IP and port information of an Android device or an emulator, checks the Android version of the device and reports it to a user. All of these scripts run synchronously through the processor. In other words, the software is encoded on the processor. The main script (1) is integrated on the application interface.

[0025] In addition, the mainfinder script (5) alerts the user when features that indicate certain security risks are detected.

[0026] Detailed Description of the Invention:

[0027] The parts that make up the invention are essentially a main script is (1), a sasting script (2), an hdcoding script (3), a flagchecker script (4), a mainfinder script (5) and a verschecker script (6).

[0028] The invention contains a main script (1) on which a main menu and functions are present and through which a user enters the menu option. A sasting script (2) is present, which is the first function of the main script (1) and reverse-engineers an APK file with an APKTool by getting an APK file path from a user. An hdcoding script (3) is present, which is the second function of the main script (1) and searches for specific keywords within the reverse-engineered APK files, detects vulnerabilities and notifies the user of them. A flagchecker script (4) is present, which is the third function of the main script (1) and analyzes the AndroidManifest.xml file, checks the settings that may lead to potential security vulnerabilities and whether the specified features are turned on. There exist a mainfinder script (5) which is the fourth function of the main script (1) and searches for certain features and permissions in the AndroidManifest.xml file using grep commands, saves them in various text files, reads the information in these files and notifies the user of them; and a verschecker script (6), which connects via the Android Debug Bridge by getting the IP and port information of an Android device or an emulator, checks the Android version of the device and reports it to a user. The Mainfinder script (5) alerts the user when features that indicate certain security risks are detected.

Claims

CLAIMS1 . A mobile application penetration testing tool, characterized in that it comprises:— an interface containing a main script (1) on which a main menu and functions are present and through which a user enters the menu option,— a processor that executes a sasting script (2) which is the first function of the main script (1) and reverse-engineers an APK file with an APKTool by getting an APK file path from a user, an hdcoding script (3) which is the second function of the main script (1) and searches for specific keywords within the reverse-engineered APK files, detects vulnerabilities and notifies the user of them; a flagchecker script (4) which is the third function of the main script (1) and analyzes the AndroidManifest.xml file, checks the settings that may lead to potential security vulnerabilities and whether the specified features are turned on; a mainfinder script (5) which is the fourth function of the main script (1) and searches for certain features and permissions in the AndroidManifest.xml file using grep commands, saves them in various text files, reads the information in these files and notifies the user of them; and a verschecker script (6), which connects via the Android Debug Bridge by getting the IP and port information of an Android device or an emulator, checks the Android version of the device and reports it to a user.

Images