mirror of
https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
synced 2026-10-12 02:06:59 +00:00
Ajin Abraham
b5da756615
- Added malware lookup using SHA2 with VirusTotal, Triage, Hybrid Analysis, and MetaDefender. - Fixed permissions of extracted files to counter anti-analysis techniques. - Resolved APK parsing errors in `androguard`. - Handled exceptions in `string_on_binary`. - Optimized APK ZIP analysis for improved performance. - Fixed untar permission errors in dynamic analysis. - Added bypass for SSL pinning in Boye's `AbstractVerifier`. - Updated bypass for SSL pinning in Appmattus's `CertificateTransparencyInterceptor`. - Introduced SSL pinning detector script. - Improved Frida intent dumper script. - Added Frida intent tracer script. - Introduced timeouts for all HTTP calls. - Added `django-q2`-based asynchronous scans for Android and iOS binaries and source code. - Fixed bug in certificate analysis. - Enabled asynchronous scans in Docker Compose setup. - Performed QA for Android and iOS SAST modules. - Added Frida script for `audit-webview`. - Introduced Frida script for `trace-javascript-interface`. - Upgraded `libsast` for improved file reading, multiprocessing, and multithreading. - Fixed PNG crush issues on Darwin systems. - Performed QA on the home screen UI. - Updated `httptools` and `libsast` dependencies.
495 lines
18 KiB
HTML
495 lines
18 KiB
HTML
{% extends "base/base_layout.html" %}
|
||
{% load static %}
|
||
{% block sidebar_option %}
|
||
sidebar-mini
|
||
{% endblock %}
|
||
{% block extra_css %}
|
||
<!-- DataTables -->
|
||
<link href="{% static "datatables/css/datatables.combined.min.css" %}" rel="stylesheet">
|
||
<style type="text/css" media="print">
|
||
@page { size: landscape; }
|
||
@media print {
|
||
.btn, #scan_options {
|
||
display: none;
|
||
}
|
||
}
|
||
</style>
|
||
<style>
|
||
#app_icon{
|
||
width: 64px;
|
||
height: 64px;
|
||
}
|
||
</style>
|
||
{% endblock %}
|
||
{% block sidebar %}
|
||
<!-- Main Sidebar Container -->
|
||
<!-- Sidebar -->
|
||
<div class="sidebar">
|
||
<!-- Sidebar user panel (optional) -->
|
||
<div class="user-panel mt-3 pb-3 mb-3 d-flex">
|
||
<div class="info">
|
||
<a href="#" class="d-block">Static Analyzer</a>
|
||
</div>
|
||
</div>
|
||
|
||
<!-- Sidebar Menu -->
|
||
<nav class="mt-2">
|
||
<ul class="nav nav-pills nav-sidebar flex-column nav-child-indent" data-widget="treeview" role="menu" data-accordion="false">
|
||
|
||
<li class="nav-item">
|
||
<a href="#information" class="nav-link">
|
||
<i class="nav-icon fas fa-info-circle"></i>
|
||
<p>
|
||
Information
|
||
</p>
|
||
</a>
|
||
</li>
|
||
<li class="nav-item">
|
||
<a href="#scan_options" class="nav-link">
|
||
<i class="nav-icon fas fa-cog"></i>
|
||
<p>
|
||
Scan Options
|
||
</p>
|
||
</a>
|
||
</li>
|
||
<li class="nav-item">
|
||
<a href="#binary_analysis" class="nav-link">
|
||
<i class="nav-icon fas fa-flag"></i>
|
||
<p>
|
||
Binary Analysis
|
||
</p>
|
||
</a>
|
||
</li>
|
||
<li class="nav-item">
|
||
<a href="#malware_lookup" class="nav-link">
|
||
<i class="fa fa-ban nav-icon"></i>
|
||
<p>
|
||
Malware Lookup
|
||
</p>
|
||
</a>
|
||
</li>
|
||
{% if virus_total %}
|
||
<li class="nav-item">
|
||
<a href="#virus_total" class="nav-link">
|
||
<i class="fas fa-spider nav-icon"></i>
|
||
<p>VirusTotal</p>
|
||
</a>
|
||
</li>
|
||
{% endif %}
|
||
<li class="nav-item">
|
||
<a href="#files" class="nav-link">
|
||
<i class="nav-icon far fa-copy"></i>
|
||
<p>
|
||
Files
|
||
</p>
|
||
</a>
|
||
</li>
|
||
<li class="nav-item">
|
||
<a href="{% url "pdf" checksum=md5 %}" class="nav-link">
|
||
<i class="nav-icon fas fa-file-pdf"></i>
|
||
<p>
|
||
PDF Report
|
||
</p>
|
||
</a>
|
||
</li>
|
||
<li class="nav-item">
|
||
<a href="javascript:window.print()" class="nav-link">
|
||
<i class="nav-icon fa fa-print"></i>
|
||
<p>
|
||
Print Report
|
||
</p>
|
||
</a>
|
||
</li>
|
||
</ul>
|
||
</nav>
|
||
<!-- /.sidebar-menu -->
|
||
</div>
|
||
<!-- /.sidebar -->
|
||
{% endblock %}
|
||
{% block content %}
|
||
<!-- Content Wrapper. Contains page content -->
|
||
<div class="content-wrapper">
|
||
<!-- Content Header (Page header) -->
|
||
<div class="content-header">
|
||
<!--
|
||
<div class="container-fluid">
|
||
<div class="row mb-2">
|
||
<div id="mobsf_header" align="center">
|
||
</div>
|
||
</div>
|
||
</div>-->
|
||
</div>
|
||
<!-- /.content-header -->
|
||
|
||
|
||
<!-- Main content -->
|
||
<a id="information" class="anchor"></a>
|
||
<section class="content">
|
||
<div class="container-fluid">
|
||
<div class="row">
|
||
<div class="col-lg-12">
|
||
|
||
<div class="card">
|
||
<div class="card-body">
|
||
<h5 class="card-title"></h5>
|
||
<div class="row">
|
||
<div class="col-2">
|
||
<p><strong><i class="fas fa-info"></i> APP INFORMATION </strong></p>
|
||
<span class="badge bg-primary">App Name</span>
|
||
{{ app_name }} <br/>
|
||
<span class="badge bg-primary">Publisher</span>
|
||
{{ publisher_name }} <br/>
|
||
<span class="badge bg-primary">Version</span>
|
||
{{ app_version }} <br/>
|
||
<span class="badge bg-primary">Arch</span>
|
||
{{ architecture }}
|
||
{% if virus_total and virus_total.items|length > 9 %}
|
||
{% if virus_total.positives > 0 %}
|
||
<span class="badge bg-danger">VirusTotal Detection</span> <strong>{{ virus_total.positives }}/{{ virus_total.total }}</strong><br/>
|
||
{% else %}
|
||
<span class="badge bg-success">VirusTotal Detection</span> <strong>{{ virus_total.positives }}/{{ virus_total.total }}</strong><br/>
|
||
{% endif %}
|
||
{% endif %}
|
||
</div>
|
||
<div class="col-5">
|
||
<p><strong><i class="fas fa-box-open"></i> FILE INFORMATION </strong></p>
|
||
<span class="badge bg-primary">File Name</span>
|
||
{{ file_name }} <br/>
|
||
<span class="badge bg-primary">Size</span>
|
||
{{ size }} <br/>
|
||
<span class="badge bg-primary">MD5</span>
|
||
{{ md5 }} <br/>
|
||
<span class="badge bg-primary">SHA1</span>
|
||
{{ sha1 }} <br/>
|
||
<span class="badge bg-primary">SHA256</span>
|
||
{{ sha256 }}
|
||
</p>
|
||
</div>
|
||
<div class="col-5">
|
||
<p><strong><i class="fas fa-file-code"></i> XML INFORMATION </strong></p>
|
||
<span class="badge bg-primary">Compiler Version</span>
|
||
{{ compiler_version }}
|
||
<span class="badge bg-primary">Visual Studio Version</span>
|
||
{{ visual_studio_version }} <br/>
|
||
<span class="badge bg-primary">Visual Studio Edition</span>
|
||
{{ visual_studio_edition }} <br/>
|
||
<span class="badge bg-primary">Target OS</span>
|
||
{{ target_os }} <br/>
|
||
<span class="badge bg-primary">APPX DLL Version</span>
|
||
{{ appx_dll_version }} <br/>
|
||
<span class="badge bg-primary">Proj GUID</span>
|
||
{{ proj_guid }} <br/>
|
||
<span class="badge bg-primary">Opti Tool</span>
|
||
{{ opti_tool }} <br/>
|
||
<span class="badge bg-primary">Target Run</span>
|
||
{{ target_run }}
|
||
</div>
|
||
|
||
|
||
</div>
|
||
|
||
</div>
|
||
</div>
|
||
</div>
|
||
<!-- /.col -->
|
||
<!-- row and container-->
|
||
</div>
|
||
</div>
|
||
</section>
|
||
<!-- =========================end information==================================== -->
|
||
|
||
|
||
|
||
<a id="scan_options" class="anchor"></a>
|
||
<section class="content">
|
||
<div class="container-fluid">
|
||
<div class="row">
|
||
<div class="col-lg-12">
|
||
<div class="card">
|
||
<div class="card-body">
|
||
<p>
|
||
<strong><i class="fas fa-cog"></i> SCAN OPTIONS</strong>
|
||
</p>
|
||
<p align="center">
|
||
<a href="{% url 'static_analyzer_windows' checksum=md5 %}?rescan=1" class="btn btn-info" role="button"><i class="fa fa-sync"></i> Rescan</a>
|
||
<a href="#" data-target="#mstrings" role="button" class="btn btn-primary" data-toggle="modal"><i class="fa fa-table"></i> View Strings</a>
|
||
<button type="button" class="btn btn-warning" data-toggle="modal" data-target=".scan-logs-mdl"><i class="fa fa-list" aria-hidden="true"></i> Scan Logs</button>
|
||
</p>
|
||
</div>
|
||
</div><!-- /.card -->
|
||
</div>
|
||
<!-- end row -->
|
||
</div>
|
||
</div>
|
||
</section>
|
||
|
||
<a id="binary_analysis" class="anchor"></a>
|
||
<section class="content">
|
||
<div class="container-fluid">
|
||
<div class="row">
|
||
<div class="col-lg-12">
|
||
<div class="card">
|
||
<div class="card-body">
|
||
<p>
|
||
<strong><i class="fas fa-flag"></i> APPX BINARY ANALYSIS</strong>
|
||
</p>
|
||
<div class="table-responsive">
|
||
<table class="table table-bordered table-hover table-striped">
|
||
<thead>
|
||
<tr>
|
||
<th>ISSUE</th>
|
||
<th>STATUS</th>
|
||
<th>DESCRIPTION</th>
|
||
<th>INFO</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
{% for result in binary_analysis %}
|
||
<tr>
|
||
<td>{{ result.rule_id }}</td>
|
||
<td>
|
||
{% if result.status == "Insecure" %}
|
||
<span class='badge bg-danger'>
|
||
{% endif %}
|
||
{% if result.status == "Secure" %}
|
||
<span class='badge bg-success'>
|
||
{% endif %}
|
||
{% if result.status == "Info" %}
|
||
<span class='badge bg-info'>
|
||
{% endif %}
|
||
{{ result.status }}
|
||
</span>
|
||
</td>
|
||
<td>{{ result.desc }}</td>
|
||
<td>{{ result.info }}</td>
|
||
</tr>
|
||
{% endfor %}
|
||
{% for warn in binary_warnings %}
|
||
<tr>
|
||
<td>{{ warn.rule_id }}</td>
|
||
<td>
|
||
<span class='badge bg-info'>
|
||
{{ warn.status }}
|
||
</span>
|
||
</td>
|
||
<td>{{ warn.desc }}</td>
|
||
<td>{{ warn.info }}
|
||
</tr>
|
||
{% endfor %}
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
|
||
</div>
|
||
</div><!-- /.card -->
|
||
</div>
|
||
<!-- end row -->
|
||
</div>
|
||
</div>
|
||
</section>
|
||
<!-- ===========================end binary analysis ================================== -->
|
||
<!---Malware Analysis Section-->
|
||
<a id="malware_lookup" class="anchor"></a>
|
||
<section class="content">
|
||
<div class="container-fluid">
|
||
<div class="row">
|
||
<div class="col-lg-12">
|
||
<div class="card">
|
||
<div class="card-body">
|
||
<p>
|
||
<strong><i class="fa fa-ban"></i> MALWARE LOOKUP</strong>
|
||
</p>
|
||
<div class="table-responsive">
|
||
<div class="row">
|
||
<div class="col-sm-3 col-6">
|
||
<div class="description-block border-right">
|
||
<span class="text-danger"><a href="https://www.virustotal.com/gui/file/{{ sha256 }}" target="_blank" rel="noopener"><i class="fa fa-eye"></i> VirusTotal Report</a></span>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="col-sm-3 col-6">
|
||
<div class="description-block border-right">
|
||
<span class="text-warning"></i><a href="https://tria.ge/s?q={{ sha256 }}" target="_blank" rel="noopener"><i class="fa fa-eye"></i> Triage Report</a>
|
||
</span>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="col-sm-3 col-6">
|
||
<div class="description-block border-right">
|
||
<span class="text-info"><a href="https://metadefender.com/results/hash/{{ sha256 }}" target="_blank" rel="noopener"><i class="fa fa-eye"></i> MetaDefender Report</a>
|
||
</span>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="col-sm-3 col-6">
|
||
<div class="description-block border-right">
|
||
<span class="text-success"><a href="https://www.hybrid-analysis.com/search?query={{ sha256 }}" target="_blank" rel="noopener"><i class="fa fa-eye"></i> Hybrid Analysis Report</a>
|
||
</span>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div><!-- /.card -->
|
||
</div>
|
||
<!-- end row -->
|
||
</div>
|
||
</div>
|
||
</section>
|
||
<!-- ===========================end malware lookup ================================== -->
|
||
{% if virus_total %}
|
||
<a id="virus_total" class="anchor"></a>
|
||
<section class="content">
|
||
<div class="container-fluid">
|
||
<div class="row">
|
||
<div class="col-lg-12">
|
||
<div class="card">
|
||
<div class="card-body">
|
||
<p>
|
||
<strong><i class="fas fa-spider"></i> VIRUSTOTAL SCAN</strong>
|
||
</p>
|
||
<div class="table-responsive">
|
||
{% if virus_total.items|length < 9 %} {% comment %} Basic check to determine if the response is a msg or a result {% endcomment %}
|
||
<p align="left"> <strong>{{ virus_total.verbose_msg }}</strong></p>
|
||
{% else %}
|
||
<p align="left"> <strong> {{ virus_total.positives }} / {{ virus_total.total }} AVs found this file Malicious! </strong> <a href="{{ virus_total.permalink }}" target="_blank" rel="noopener"><i class="fas fa-th-list"></i> Full Report</a></p>
|
||
{% if virus_total.positives > 0 %}
|
||
<table id="table_vt" class="table table-bordered table-hover table-striped">
|
||
<thead>
|
||
<tr>
|
||
<th>AV</th>
|
||
<th>DETECTION</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
{% for av_name,av_result in virus_total.scans.items %}
|
||
{% if av_result.detected == True %}
|
||
<tr>
|
||
<td>
|
||
{{ av_name }}
|
||
</td>
|
||
<td>
|
||
<span class="badge bg-danger">{{ av_result.result }}</span>
|
||
</td>
|
||
</tr>
|
||
{% endif %}
|
||
{% endfor %}
|
||
</tbody>
|
||
</table>
|
||
{% endif %}{% comment %} if results.positive > 0 {% endcomment %}
|
||
{% endif %}{% comment %} if this is the upload msg or a result {% endcomment %}
|
||
</div>
|
||
</div>
|
||
</div><!-- /.card -->
|
||
</div>
|
||
<!-- end row -->
|
||
</div>
|
||
</div>
|
||
</section>
|
||
{% endif %}
|
||
<!-- ===========================end virus total ================================== -->
|
||
<a id="files" class="anchor"></a>
|
||
<section class="content">
|
||
<div class="container-fluid">
|
||
<div class="row">
|
||
<div class="col-lg-12">
|
||
<div class="card">
|
||
<div class="card-body">
|
||
<p>
|
||
<strong><i class="far fa-copy"></i> FILES</strong>
|
||
</p>
|
||
<div class="list-group">
|
||
<p>
|
||
{% for file in files %}
|
||
{{ file}} <br>
|
||
{% endfor %}
|
||
</p>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div><!-- /.card -->
|
||
</div>
|
||
<!-- end row -->
|
||
</div>
|
||
</section>
|
||
<!-- ===========================end files ================================== -->
|
||
<!-- end of contents -->
|
||
</div>
|
||
|
||
<!-- Modal -->
|
||
|
||
<div class="modal" id="mstrings" tabindex="-1" role="dialog">
|
||
<div class="modal-dialog modal-xl">
|
||
<div class="modal-content">
|
||
<div class="modal-header">
|
||
<h4 class="modal-title">Strings</h4>
|
||
<button type="button" class="close" data-dismiss="modal" aria-label="Close">
|
||
<span aria-hidden="true">×</span>
|
||
</button>
|
||
</div>
|
||
<div class="modal-body">
|
||
<pre><code>
|
||
{% for string in strings %}
|
||
{{string | safe}}
|
||
{% endfor %}
|
||
</code></pre>
|
||
</div>
|
||
</div>
|
||
<!-- /.modal-content -->
|
||
</div>
|
||
<!-- /.modal-dialog -->
|
||
</div>
|
||
|
||
|
||
{% endblock %}
|
||
<!--end new UI-->
|
||
{% block extra_scripts %}
|
||
<!-- DataTables -->
|
||
<script src="{% static "datatables/js/pdfmake.min.js" %}"></script>
|
||
<script src="{% static "datatables/js/vfs_fonts.js" %}"></script>
|
||
<script src="{% static "datatables/js/datatables.combined.min.js" %}"></script>
|
||
<script src="{% static "others/js/datatables_init.js" %}"></script>
|
||
<script>
|
||
|
||
// Remove rescan parameter
|
||
window.history.replaceState({}, '', window.location.pathname);
|
||
|
||
// Navbar Active
|
||
$(".nav-link").on("click", function() {
|
||
$(".nav-link").removeClass("active");
|
||
$(this).addClass("active");
|
||
});
|
||
</script>
|
||
{% endblock %}
|
||
{% block scan_logs %}
|
||
<table id="scan_logs" class="table table-bordered table-hover table-striped">
|
||
<tr>
|
||
<th>Timestamp</th>
|
||
<th>Event</th>
|
||
<th>Error</th>
|
||
</tr>
|
||
<tbody>
|
||
{% for log in logs %}
|
||
<tr>
|
||
<td>
|
||
{{log.timestamp}}
|
||
</td>
|
||
<td>
|
||
{{log.status}}
|
||
</td>
|
||
<td>
|
||
{% if not log.exception %}
|
||
<p class="text-success">
|
||
OK
|
||
</p>
|
||
{% else %}
|
||
<p class="text-danger">
|
||
{{log.exception}}
|
||
</p>
|
||
{% endif %}
|
||
</td>
|
||
</tr>
|
||
{% endfor %}
|
||
</tbody>
|
||
</table>
|
||
|
||
{% endblock %} |