Document Index
- 1.overview
- 2.startup
- 3.how to write rules
- 4.how to find compliance problems use appshark
- 5.a path traversal game
- 6.argument
- 7.engine config
- 8.result
- 9.faq
AppShark
Appshark is a static taint analysis platform to scan vulnerabilities in an Android app.
Prerequisites
Appshark requires a specific version of JDK -- JDK 11. After testing, it does not work on other LTS versions, JDK 8 and JDK 16, due to the dependency compatibility issue.
Building/Compiling AppShark
We assume that you are working in the root directory of the project repo. You can build the whole project with the gradle tool.
After executing the above command, you will see an artifact file AppShark-0.1.2-all.jar in the directory build/libs.
Running AppShark
Like the previous step, we assume that you are still in the root folder of the project. You can run the tool with
The config.json5 has the following configuration contents.
"apkPath": "/Users/apks/app1.apk"
}
Each JSON has these basic field.
- apkPath: the path of the apk file to analyze
- out: the path of the output directory
- rules: specifies the rules, split by
,. Default is all *.json files in the $rulePath directory - rulePath: specifies the rule's parent directory, default is ./config/rules
- maxPointerAnalyzeTime: the timeout duration in seconds set for the analysis started from an entry point
- debugRule: specify the rule name that enables logging for debugging
For more config field, please visit net.bytedance.security.app.ArgumentConfig
If you provide a configuration JSON file which sets the output path as out in the project root directory, you will
find the result file out/results.json after running the analysis.
Interpreting the Results
Below is an example of the results.json.
"AppInfo": {
"AppName": "test",
"PackageName": "net.bytedance.security.app",
"min_sdk": 17,
"target_sdk": 28,
"versionCode": 1000,
"versionName": "1.0.0"
},
"SecurityInfo": {
"FileRisk": {
"unZipSlip": {
"category": "FileRisk",
"detail": "",
"model": "2",
"name": "unZipSlip",
"possibility": "4",
"vulners": [
{
"details": {
"position": "
"Sink": "
"entryMethod": "
"Source": "
"url": "/Volumes/dev/zijie/appshark-opensource/out/vuln/1-unZipSlip.html",
"target": [
"
"pf{obj{
"
"
]
},
"hash": "ec57a2a3190677ffe78a0c8aaf58ba5aee4d2247",
"possibility": "4"
},
{
"details": {
"position": "
"Sink": "
"entryMethod": "
"Source": "
"url": "/Volumes/dev/zijie/appshark-opensource/out/vuln/2-unZipSlip.html",
"target": [
"
"pf{obj{
"
"
]
},
"hash": "26c6d6ee704c59949cfef78350a1d9aef04c29ad",
"possibility": "4"
}
],
"wiki": "",
"deobfApk": "/Volumes/dev/zijie/appshark-opensource/app.apk"
}
}
},
"DeepLinkInfo": {
},
"HTTP_API": [
],
"JsBridgeInfo": [
],
"BasicInfo": {
"ComponentsInfo": {
},
"JSNativeInterface": [
]
},
"UsePermissions": [
],
"DefinePermissions": {
},
"Profile": "/Volumes/dev/zijie/appshark-opensource/out/vuln/3-profiler.json"
}
License
AppShark is licensed under the APACHE LICENSE, VERSION 2.0
Security Notice
UI/Server is an auxiliary testing tool that should not be used in production environments and can only be deployed for local testing.