diff options
| -rw-r--r-- | .gitignore | 1 | ||||
| -rw-r--r-- | python-quark-engine.spec | 480 | ||||
| -rw-r--r-- | sources | 1 |
3 files changed, 482 insertions, 0 deletions
@@ -0,0 +1 @@ +/quark-engine-23.3.1.tar.gz diff --git a/python-quark-engine.spec b/python-quark-engine.spec new file mode 100644 index 0000000..c2db8a0 --- /dev/null +++ b/python-quark-engine.spec @@ -0,0 +1,480 @@ +%global _empty_manifest_terminate_build 0 +Name: python-quark-engine +Version: 23.3.1 +Release: 1 +Summary: An Obfuscation-Neglect Android Malware Scoring System +License: GNU General Public License v3 (GPLv3) +URL: https://github.com/quark-engine/quark-engine +Source0: https://mirrors.nju.edu.cn/pypi/web/packages/e2/68/ff845f0740e3ab05b10abfd97712420885fc907df1249474a6966cf2e67c/quark-engine-23.3.1.tar.gz +BuildArch: noarch + +Requires: python3-prettytable +Requires: python3-androguard +Requires: python3-tqdm +Requires: python3-colorama +Requires: python3-graphviz +Requires: python3-prompt-toolkit +Requires: python3-plotly +Requires: python3-rzpipe +Requires: python3-click + +%description +<p align="center"> + <a href="https://www.blackhat.com/asia-21/arsenal/schedule/index.html#quark-engine-storyteller-of-android-malware-22458"> + <img alt="Black Hat Arsenal" src="https://img.shields.io/badge/Black%20Hat%20Arsenal-Asia%202021-blue"> + </a> + <a href="https://conference.hitb.org/hitb-lockdown002/sessions/quark-engine-an-obfuscation-neglect-android-malware-scoring-system/"> + <img alt="HITB" src="https://img.shields.io/badge/HITB-Lockdown%20002-red"> + </a> + <a href="https://www.youtube.com/watch?v=SOH4eqrv9_g&ab_channel=ROOTCONHackingConference"> + <img alt="rootcon" src="https://img.shields.io/badge/ROOTCON-2020-orange"> + </a> + <a href="https://www.youtube.com/watch?v=XK-yqHPnsvc&ab_channel=DEFCONConference"> + <img alt="defcon" src="https://img.shields.io/badge/DEFCON%2028-BTV-blue"> + </a><br> + <a href="https://github.com/quark-engine/quark-engine/actions/workflows/pytest.yml"> + <img alt="build status" src="https://github.com/quark-engine/quark-engine/actions/workflows/pytest.yml/badge.svg"> + </a> + <a href="https://codecov.io/gh/quark-engine/quark-engine"> + <img alt="codecov" src="https://codecov.io/gh/quark-engine/quark-engine/branch/master/graph/badge.svg"> + </a> + <a href="https://github.com/18z/quark-rules/blob/master/LICENSE"> + <img alt="license" src="https://img.shields.io/badge/License-GPLv3-blue.svg"> + </a> + <a href="https://www.python.org/downloads/release/python-360/"> + <img alt="python version" src="https://img.shields.io/badge/python-3.8-blue.svg"> + </a> + <a href="https://pypi.org/project/quark-engine/"> + <img alt="PyPi Download" src="https://pepy.tech/badge/quark-engine"> + </a><br> + <a href="https://twitter.com/quarkengine"> + <img alt="Twitter" src="https://img.shields.io/twitter/follow/quarkengine?style=social"> + </a><br> + <img src="https://i.imgur.com/8GwkWei.png"/> +</p> + +# Quark Script - Dig Vulnerabilities in the BlackBox + +### Innovative & Interactive + +* The goal of Quark Script aims to provide an innovative way for mobile security researchers to analyze or **pentest** the targets. +* Based on Quark, we integrate decent tools as Quark Script APIs and make them exchange valuable intelligence to each other. This enables security researchers to **interact** with staged results and perform **creative** analysis with Quark Script. + +### Dynamic & Static Analysis + +* In Quark script, we integrate not only static analysis tools (e.g. Quark itself) but also dynamic analysis tools (e.g. [objection](https://github.com/sensepost/objection)). + +### Re-Usable & Sharable + +* Once the user creates a Quark script for specific analysis scenario. The script can be used in another targets. Also, the script can be shared to other security researchers. This enables the exchange of knowledges. + +### More APIs to come + +* Quark Script is now in a beta version. We'll keep releasing practical APIs and analysis scenarios. +* **See API document [here](https://quark-engine.readthedocs.io/en/latest/quark_script.html#introduce-of-quark-script-apis).** + +# CWE Showcases +* [CWE-020](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-20-in-android-application-diva-apk) Improper Input Validation +* [CWE-022](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-22-in-android-application-ovaa-apk-and-insecurebankv2-apk) Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') +* [CWE-023](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-23-in-android-application-ovaa-apk-and-insecurebankv2-apk) Relative Path Traversal +* [CWE-089](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-89-in-android-application-androgoat-apk) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') +* [CWE-094](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-94-in-android-application-ovaa-apk) Improper Control of Generation of Code ('Code Injection') +* [CWE-295](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-295-in-android-application-insecureshop-apk) Improper Certificate Validation +* [CWE-312](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-312-in-android-application-ovaa-apk) Cleartext Storage of Sensitive Information +* [CWE-319](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-319-in-android-application-ovaa-apk) Cleartext Transmission of Sensitive Information +* [CWE-327](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-327-in-android-application-injuredandroid-apk) Use of a Broken or Risky Cryptographic Algorithm +* [CWE-328](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-328-in-android-application-allsafe-apk) Use of Weak Hash +* [CWE-338](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-338-in-android-application-pivva-apk) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) +* [CWE-489](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-489-in-android-application-allsafe-apk-androgoat-apk-pivaa-apk) Active Debug Code +* [CWE-532](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-532-in-android-application-dvba-apk) Insertion of Sensitive Information into Log File +* [CWE-749](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-749-in-android-application-mstg-android-java-apk) Exposed Dangerous Method or Function +* [CWE-780](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-780-in-android-application-mstg-android-java-apk) Use of RSA Algorithm without OAEP +* [CWE-798](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-798-in-android-application-ovaa-apk) Use of Hard-coded Credentials +* [CWE-921](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-921-in-android-application-ovaa-apk) Storage of Sensitive Data in a Mechanism without Access Control +* [CWE-926](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-926-in-android-application-dvba-apk) Improper Export of Android Application Components + +# Quick Start + +In this section, we will show how to detect CWE-798 with Quark Script. + +### Step 1: Environments Requirements + +* Quark requires Python 3.8 or above. + +### Step 2: Install Quark Engine + +* Install Quark Engine by running: + +```bash +$ pip3 install -U quark-engine +``` + +### Step 3: Prepare Quark Script, Detection Rule and the Sample File + +1. Get the CWE-798 Quark Script and the detection rule [here](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-798-in-android-application-ovaa-apk). +2. Get the sampe file (ovaa.apk) [here](https://github.com/dark-warlord14/ovaa/releases/tag/1.0). +3. Put the script, detection rule, and sample file in the same directory. +4. Edit accordingly to the file names: + +```bash +SAMPLE_PATH = "ovaa.apk" +RULE_PATH = "findSecretKeySpec.json" +# Now you are ready to run the script! +``` + +### Step 4: Run the script + +```bash +$ python3 CWE-798.py + +# You should now see the detection result in the terminal. +Found hard-coded AES key 49u5gh249gh24985ghf429gh4ch8f23f +``` + +* **Check the [document](https://quark-engine.readthedocs.io/en/latest/quark_script.html#quark-script) for more examples.** + +# Acknowledgments + +### The Honeynet Project + +<a href="https://www.honeynet.org"> <img style="border: 0.2px solid black" width=115 height=150 src="https://i.imgur.com/znu7cMJ.png" alt="Honeynet.org logo"> </a> + +### Google Summer Of Code + +Quark-Engine has been participating in the GSoC under the Honeynet Project! + +* 2021: + * [YuShiang Dang](https://twitter.com/YushianhD): [New Rule Generation Technique & Make Quark Everywhere Among Security Open Source Projects](https://quark-engine.github.io/2021/08/17/GSoC-2021-YuShiangDang/) + * [Sheng-Feng Lu](https://twitter.com/haeter525): [Replace the core library of Quark-Engine](https://quark-engine.github.io/2021/08/17/GSoC-2021-ShengFengLu/) + +Stay tuned for the upcoming GSoC! Join the [Honeynet Slack chat](https://gsoc-slack.honeynet.org/) for more info. + +# Core Values of Quark Engine Team + +* We love **battle fields**. We embrace **uncertainties**. We challenge **impossibles**. We **rethink** everything. We change the way people think. And the most important of all, we benefit ourselves by benefit others **first**. + + +%package -n python3-quark-engine +Summary: An Obfuscation-Neglect Android Malware Scoring System +Provides: python-quark-engine +BuildRequires: python3-devel +BuildRequires: python3-setuptools +BuildRequires: python3-pip +%description -n python3-quark-engine +<p align="center"> + <a href="https://www.blackhat.com/asia-21/arsenal/schedule/index.html#quark-engine-storyteller-of-android-malware-22458"> + <img alt="Black Hat Arsenal" src="https://img.shields.io/badge/Black%20Hat%20Arsenal-Asia%202021-blue"> + </a> + <a href="https://conference.hitb.org/hitb-lockdown002/sessions/quark-engine-an-obfuscation-neglect-android-malware-scoring-system/"> + <img alt="HITB" src="https://img.shields.io/badge/HITB-Lockdown%20002-red"> + </a> + <a href="https://www.youtube.com/watch?v=SOH4eqrv9_g&ab_channel=ROOTCONHackingConference"> + <img alt="rootcon" src="https://img.shields.io/badge/ROOTCON-2020-orange"> + </a> + <a href="https://www.youtube.com/watch?v=XK-yqHPnsvc&ab_channel=DEFCONConference"> + <img alt="defcon" src="https://img.shields.io/badge/DEFCON%2028-BTV-blue"> + </a><br> + <a href="https://github.com/quark-engine/quark-engine/actions/workflows/pytest.yml"> + <img alt="build status" src="https://github.com/quark-engine/quark-engine/actions/workflows/pytest.yml/badge.svg"> + </a> + <a href="https://codecov.io/gh/quark-engine/quark-engine"> + <img alt="codecov" src="https://codecov.io/gh/quark-engine/quark-engine/branch/master/graph/badge.svg"> + </a> + <a href="https://github.com/18z/quark-rules/blob/master/LICENSE"> + <img alt="license" src="https://img.shields.io/badge/License-GPLv3-blue.svg"> + </a> + <a href="https://www.python.org/downloads/release/python-360/"> + <img alt="python version" src="https://img.shields.io/badge/python-3.8-blue.svg"> + </a> + <a href="https://pypi.org/project/quark-engine/"> + <img alt="PyPi Download" src="https://pepy.tech/badge/quark-engine"> + </a><br> + <a href="https://twitter.com/quarkengine"> + <img alt="Twitter" src="https://img.shields.io/twitter/follow/quarkengine?style=social"> + </a><br> + <img src="https://i.imgur.com/8GwkWei.png"/> +</p> + +# Quark Script - Dig Vulnerabilities in the BlackBox + +### Innovative & Interactive + +* The goal of Quark Script aims to provide an innovative way for mobile security researchers to analyze or **pentest** the targets. +* Based on Quark, we integrate decent tools as Quark Script APIs and make them exchange valuable intelligence to each other. This enables security researchers to **interact** with staged results and perform **creative** analysis with Quark Script. + +### Dynamic & Static Analysis + +* In Quark script, we integrate not only static analysis tools (e.g. Quark itself) but also dynamic analysis tools (e.g. [objection](https://github.com/sensepost/objection)). + +### Re-Usable & Sharable + +* Once the user creates a Quark script for specific analysis scenario. The script can be used in another targets. Also, the script can be shared to other security researchers. This enables the exchange of knowledges. + +### More APIs to come + +* Quark Script is now in a beta version. We'll keep releasing practical APIs and analysis scenarios. +* **See API document [here](https://quark-engine.readthedocs.io/en/latest/quark_script.html#introduce-of-quark-script-apis).** + +# CWE Showcases +* [CWE-020](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-20-in-android-application-diva-apk) Improper Input Validation +* [CWE-022](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-22-in-android-application-ovaa-apk-and-insecurebankv2-apk) Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') +* [CWE-023](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-23-in-android-application-ovaa-apk-and-insecurebankv2-apk) Relative Path Traversal +* [CWE-089](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-89-in-android-application-androgoat-apk) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') +* [CWE-094](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-94-in-android-application-ovaa-apk) Improper Control of Generation of Code ('Code Injection') +* [CWE-295](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-295-in-android-application-insecureshop-apk) Improper Certificate Validation +* [CWE-312](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-312-in-android-application-ovaa-apk) Cleartext Storage of Sensitive Information +* [CWE-319](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-319-in-android-application-ovaa-apk) Cleartext Transmission of Sensitive Information +* [CWE-327](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-327-in-android-application-injuredandroid-apk) Use of a Broken or Risky Cryptographic Algorithm +* [CWE-328](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-328-in-android-application-allsafe-apk) Use of Weak Hash +* [CWE-338](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-338-in-android-application-pivva-apk) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) +* [CWE-489](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-489-in-android-application-allsafe-apk-androgoat-apk-pivaa-apk) Active Debug Code +* [CWE-532](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-532-in-android-application-dvba-apk) Insertion of Sensitive Information into Log File +* [CWE-749](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-749-in-android-application-mstg-android-java-apk) Exposed Dangerous Method or Function +* [CWE-780](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-780-in-android-application-mstg-android-java-apk) Use of RSA Algorithm without OAEP +* [CWE-798](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-798-in-android-application-ovaa-apk) Use of Hard-coded Credentials +* [CWE-921](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-921-in-android-application-ovaa-apk) Storage of Sensitive Data in a Mechanism without Access Control +* [CWE-926](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-926-in-android-application-dvba-apk) Improper Export of Android Application Components + +# Quick Start + +In this section, we will show how to detect CWE-798 with Quark Script. + +### Step 1: Environments Requirements + +* Quark requires Python 3.8 or above. + +### Step 2: Install Quark Engine + +* Install Quark Engine by running: + +```bash +$ pip3 install -U quark-engine +``` + +### Step 3: Prepare Quark Script, Detection Rule and the Sample File + +1. Get the CWE-798 Quark Script and the detection rule [here](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-798-in-android-application-ovaa-apk). +2. Get the sampe file (ovaa.apk) [here](https://github.com/dark-warlord14/ovaa/releases/tag/1.0). +3. Put the script, detection rule, and sample file in the same directory. +4. Edit accordingly to the file names: + +```bash +SAMPLE_PATH = "ovaa.apk" +RULE_PATH = "findSecretKeySpec.json" +# Now you are ready to run the script! +``` + +### Step 4: Run the script + +```bash +$ python3 CWE-798.py + +# You should now see the detection result in the terminal. +Found hard-coded AES key 49u5gh249gh24985ghf429gh4ch8f23f +``` + +* **Check the [document](https://quark-engine.readthedocs.io/en/latest/quark_script.html#quark-script) for more examples.** + +# Acknowledgments + +### The Honeynet Project + +<a href="https://www.honeynet.org"> <img style="border: 0.2px solid black" width=115 height=150 src="https://i.imgur.com/znu7cMJ.png" alt="Honeynet.org logo"> </a> + +### Google Summer Of Code + +Quark-Engine has been participating in the GSoC under the Honeynet Project! + +* 2021: + * [YuShiang Dang](https://twitter.com/YushianhD): [New Rule Generation Technique & Make Quark Everywhere Among Security Open Source Projects](https://quark-engine.github.io/2021/08/17/GSoC-2021-YuShiangDang/) + * [Sheng-Feng Lu](https://twitter.com/haeter525): [Replace the core library of Quark-Engine](https://quark-engine.github.io/2021/08/17/GSoC-2021-ShengFengLu/) + +Stay tuned for the upcoming GSoC! Join the [Honeynet Slack chat](https://gsoc-slack.honeynet.org/) for more info. + +# Core Values of Quark Engine Team + +* We love **battle fields**. We embrace **uncertainties**. We challenge **impossibles**. We **rethink** everything. We change the way people think. And the most important of all, we benefit ourselves by benefit others **first**. + + +%package help +Summary: Development documents and examples for quark-engine +Provides: python3-quark-engine-doc +%description help +<p align="center"> + <a href="https://www.blackhat.com/asia-21/arsenal/schedule/index.html#quark-engine-storyteller-of-android-malware-22458"> + <img alt="Black Hat Arsenal" src="https://img.shields.io/badge/Black%20Hat%20Arsenal-Asia%202021-blue"> + </a> + <a href="https://conference.hitb.org/hitb-lockdown002/sessions/quark-engine-an-obfuscation-neglect-android-malware-scoring-system/"> + <img alt="HITB" src="https://img.shields.io/badge/HITB-Lockdown%20002-red"> + </a> + <a href="https://www.youtube.com/watch?v=SOH4eqrv9_g&ab_channel=ROOTCONHackingConference"> + <img alt="rootcon" src="https://img.shields.io/badge/ROOTCON-2020-orange"> + </a> + <a href="https://www.youtube.com/watch?v=XK-yqHPnsvc&ab_channel=DEFCONConference"> + <img alt="defcon" src="https://img.shields.io/badge/DEFCON%2028-BTV-blue"> + </a><br> + <a href="https://github.com/quark-engine/quark-engine/actions/workflows/pytest.yml"> + <img alt="build status" src="https://github.com/quark-engine/quark-engine/actions/workflows/pytest.yml/badge.svg"> + </a> + <a href="https://codecov.io/gh/quark-engine/quark-engine"> + <img alt="codecov" src="https://codecov.io/gh/quark-engine/quark-engine/branch/master/graph/badge.svg"> + </a> + <a href="https://github.com/18z/quark-rules/blob/master/LICENSE"> + <img alt="license" src="https://img.shields.io/badge/License-GPLv3-blue.svg"> + </a> + <a href="https://www.python.org/downloads/release/python-360/"> + <img alt="python version" src="https://img.shields.io/badge/python-3.8-blue.svg"> + </a> + <a href="https://pypi.org/project/quark-engine/"> + <img alt="PyPi Download" src="https://pepy.tech/badge/quark-engine"> + </a><br> + <a href="https://twitter.com/quarkengine"> + <img alt="Twitter" src="https://img.shields.io/twitter/follow/quarkengine?style=social"> + </a><br> + <img src="https://i.imgur.com/8GwkWei.png"/> +</p> + +# Quark Script - Dig Vulnerabilities in the BlackBox + +### Innovative & Interactive + +* The goal of Quark Script aims to provide an innovative way for mobile security researchers to analyze or **pentest** the targets. +* Based on Quark, we integrate decent tools as Quark Script APIs and make them exchange valuable intelligence to each other. This enables security researchers to **interact** with staged results and perform **creative** analysis with Quark Script. + +### Dynamic & Static Analysis + +* In Quark script, we integrate not only static analysis tools (e.g. Quark itself) but also dynamic analysis tools (e.g. [objection](https://github.com/sensepost/objection)). + +### Re-Usable & Sharable + +* Once the user creates a Quark script for specific analysis scenario. The script can be used in another targets. Also, the script can be shared to other security researchers. This enables the exchange of knowledges. + +### More APIs to come + +* Quark Script is now in a beta version. We'll keep releasing practical APIs and analysis scenarios. +* **See API document [here](https://quark-engine.readthedocs.io/en/latest/quark_script.html#introduce-of-quark-script-apis).** + +# CWE Showcases +* [CWE-020](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-20-in-android-application-diva-apk) Improper Input Validation +* [CWE-022](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-22-in-android-application-ovaa-apk-and-insecurebankv2-apk) Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') +* [CWE-023](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-23-in-android-application-ovaa-apk-and-insecurebankv2-apk) Relative Path Traversal +* [CWE-089](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-89-in-android-application-androgoat-apk) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') +* [CWE-094](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-94-in-android-application-ovaa-apk) Improper Control of Generation of Code ('Code Injection') +* [CWE-295](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-295-in-android-application-insecureshop-apk) Improper Certificate Validation +* [CWE-312](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-312-in-android-application-ovaa-apk) Cleartext Storage of Sensitive Information +* [CWE-319](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-319-in-android-application-ovaa-apk) Cleartext Transmission of Sensitive Information +* [CWE-327](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-327-in-android-application-injuredandroid-apk) Use of a Broken or Risky Cryptographic Algorithm +* [CWE-328](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-328-in-android-application-allsafe-apk) Use of Weak Hash +* [CWE-338](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-338-in-android-application-pivva-apk) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) +* [CWE-489](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-489-in-android-application-allsafe-apk-androgoat-apk-pivaa-apk) Active Debug Code +* [CWE-532](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-532-in-android-application-dvba-apk) Insertion of Sensitive Information into Log File +* [CWE-749](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-749-in-android-application-mstg-android-java-apk) Exposed Dangerous Method or Function +* [CWE-780](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-780-in-android-application-mstg-android-java-apk) Use of RSA Algorithm without OAEP +* [CWE-798](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-798-in-android-application-ovaa-apk) Use of Hard-coded Credentials +* [CWE-921](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-921-in-android-application-ovaa-apk) Storage of Sensitive Data in a Mechanism without Access Control +* [CWE-926](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-926-in-android-application-dvba-apk) Improper Export of Android Application Components + +# Quick Start + +In this section, we will show how to detect CWE-798 with Quark Script. + +### Step 1: Environments Requirements + +* Quark requires Python 3.8 or above. + +### Step 2: Install Quark Engine + +* Install Quark Engine by running: + +```bash +$ pip3 install -U quark-engine +``` + +### Step 3: Prepare Quark Script, Detection Rule and the Sample File + +1. Get the CWE-798 Quark Script and the detection rule [here](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-798-in-android-application-ovaa-apk). +2. Get the sampe file (ovaa.apk) [here](https://github.com/dark-warlord14/ovaa/releases/tag/1.0). +3. Put the script, detection rule, and sample file in the same directory. +4. Edit accordingly to the file names: + +```bash +SAMPLE_PATH = "ovaa.apk" +RULE_PATH = "findSecretKeySpec.json" +# Now you are ready to run the script! +``` + +### Step 4: Run the script + +```bash +$ python3 CWE-798.py + +# You should now see the detection result in the terminal. +Found hard-coded AES key 49u5gh249gh24985ghf429gh4ch8f23f +``` + +* **Check the [document](https://quark-engine.readthedocs.io/en/latest/quark_script.html#quark-script) for more examples.** + +# Acknowledgments + +### The Honeynet Project + +<a href="https://www.honeynet.org"> <img style="border: 0.2px solid black" width=115 height=150 src="https://i.imgur.com/znu7cMJ.png" alt="Honeynet.org logo"> </a> + +### Google Summer Of Code + +Quark-Engine has been participating in the GSoC under the Honeynet Project! + +* 2021: + * [YuShiang Dang](https://twitter.com/YushianhD): [New Rule Generation Technique & Make Quark Everywhere Among Security Open Source Projects](https://quark-engine.github.io/2021/08/17/GSoC-2021-YuShiangDang/) + * [Sheng-Feng Lu](https://twitter.com/haeter525): [Replace the core library of Quark-Engine](https://quark-engine.github.io/2021/08/17/GSoC-2021-ShengFengLu/) + +Stay tuned for the upcoming GSoC! Join the [Honeynet Slack chat](https://gsoc-slack.honeynet.org/) for more info. + +# Core Values of Quark Engine Team + +* We love **battle fields**. We embrace **uncertainties**. We challenge **impossibles**. We **rethink** everything. We change the way people think. And the most important of all, we benefit ourselves by benefit others **first**. + + +%prep +%autosetup -n quark-engine-23.3.1 + +%build +%py3_build + +%install +%py3_install +install -d -m755 %{buildroot}/%{_pkgdocdir} +if [ -d doc ]; then cp -arf doc %{buildroot}/%{_pkgdocdir}; fi +if [ -d docs ]; then cp -arf docs %{buildroot}/%{_pkgdocdir}; fi +if [ -d example ]; then cp -arf example %{buildroot}/%{_pkgdocdir}; fi +if [ -d examples ]; then cp -arf examples %{buildroot}/%{_pkgdocdir}; fi +pushd %{buildroot} +if [ -d usr/lib ]; then + find usr/lib -type f -printf "/%h/%f\n" >> filelist.lst +fi +if [ -d usr/lib64 ]; then + find usr/lib64 -type f -printf "/%h/%f\n" >> filelist.lst +fi +if [ -d usr/bin ]; then + find usr/bin -type f -printf "/%h/%f\n" >> filelist.lst +fi +if [ -d usr/sbin ]; then + find usr/sbin -type f -printf "/%h/%f\n" >> filelist.lst +fi +touch doclist.lst +if [ -d usr/share/man ]; then + find usr/share/man -type f -printf "/%h/%f.gz\n" >> doclist.lst +fi +popd +mv %{buildroot}/filelist.lst . +mv %{buildroot}/doclist.lst . + +%files -n python3-quark-engine -f filelist.lst +%dir %{python3_sitelib}/* + +%files help -f doclist.lst +%{_docdir}/* + +%changelog +* Wed Apr 12 2023 Python_Bot <Python_Bot@openeuler.org> - 23.3.1-1 +- Package Spec generated @@ -0,0 +1 @@ +40e536231fa01608f790f30bf3b05073 quark-engine-23.3.1.tar.gz |