From 2e8014571f2a4f05dc1e7b585833e5b835fab5c7 Mon Sep 17 00:00:00 2001 From: CoprDistGit Date: Wed, 12 Apr 2023 05:04:39 +0000 Subject: automatic import of python-quark-engine --- .gitignore | 1 + python-quark-engine.spec | 480 +++++++++++++++++++++++++++++++++++++++++++++++ sources | 1 + 3 files changed, 482 insertions(+) create mode 100644 python-quark-engine.spec create mode 100644 sources diff --git a/.gitignore b/.gitignore index e69de29..e62547a 100644 --- a/.gitignore +++ b/.gitignore @@ -0,0 +1 @@ +/quark-engine-23.3.1.tar.gz diff --git a/python-quark-engine.spec b/python-quark-engine.spec new file mode 100644 index 0000000..c2db8a0 --- /dev/null +++ b/python-quark-engine.spec @@ -0,0 +1,480 @@ +%global _empty_manifest_terminate_build 0 +Name: python-quark-engine +Version: 23.3.1 +Release: 1 +Summary: An Obfuscation-Neglect Android Malware Scoring System +License: GNU General Public License v3 (GPLv3) +URL: https://github.com/quark-engine/quark-engine +Source0: https://mirrors.nju.edu.cn/pypi/web/packages/e2/68/ff845f0740e3ab05b10abfd97712420885fc907df1249474a6966cf2e67c/quark-engine-23.3.1.tar.gz +BuildArch: noarch + +Requires: python3-prettytable +Requires: python3-androguard +Requires: python3-tqdm +Requires: python3-colorama +Requires: python3-graphviz +Requires: python3-prompt-toolkit +Requires: python3-plotly +Requires: python3-rzpipe +Requires: python3-click + +%description +

+ + Black Hat Arsenal + + + HITB + + + rootcon + + + defcon +
+ + build status + + + codecov + + + license + + + python version + + + PyPi Download +
+ + Twitter +
+ +

+ +# Quark Script - Dig Vulnerabilities in the BlackBox + +### Innovative & Interactive + +* The goal of Quark Script aims to provide an innovative way for mobile security researchers to analyze or **pentest** the targets. +* Based on Quark, we integrate decent tools as Quark Script APIs and make them exchange valuable intelligence to each other. This enables security researchers to **interact** with staged results and perform **creative** analysis with Quark Script. + +### Dynamic & Static Analysis + +* In Quark script, we integrate not only static analysis tools (e.g. Quark itself) but also dynamic analysis tools (e.g. [objection](https://github.com/sensepost/objection)). + +### Re-Usable & Sharable + +* Once the user creates a Quark script for specific analysis scenario. The script can be used in another targets. Also, the script can be shared to other security researchers. This enables the exchange of knowledges. + +### More APIs to come + +* Quark Script is now in a beta version. We'll keep releasing practical APIs and analysis scenarios. +* **See API document [here](https://quark-engine.readthedocs.io/en/latest/quark_script.html#introduce-of-quark-script-apis).** + +# CWE Showcases +* [CWE-020](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-20-in-android-application-diva-apk) Improper Input Validation +* [CWE-022](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-22-in-android-application-ovaa-apk-and-insecurebankv2-apk) Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') +* [CWE-023](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-23-in-android-application-ovaa-apk-and-insecurebankv2-apk) Relative Path Traversal +* [CWE-089](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-89-in-android-application-androgoat-apk) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') +* [CWE-094](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-94-in-android-application-ovaa-apk) Improper Control of Generation of Code ('Code Injection') +* [CWE-295](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-295-in-android-application-insecureshop-apk) Improper Certificate Validation +* [CWE-312](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-312-in-android-application-ovaa-apk) Cleartext Storage of Sensitive Information +* [CWE-319](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-319-in-android-application-ovaa-apk) Cleartext Transmission of Sensitive Information +* [CWE-327](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-327-in-android-application-injuredandroid-apk) Use of a Broken or Risky Cryptographic Algorithm +* [CWE-328](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-328-in-android-application-allsafe-apk) Use of Weak Hash +* [CWE-338](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-338-in-android-application-pivva-apk) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) +* [CWE-489](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-489-in-android-application-allsafe-apk-androgoat-apk-pivaa-apk) Active Debug Code +* [CWE-532](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-532-in-android-application-dvba-apk) Insertion of Sensitive Information into Log File +* [CWE-749](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-749-in-android-application-mstg-android-java-apk) Exposed Dangerous Method or Function +* [CWE-780](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-780-in-android-application-mstg-android-java-apk) Use of RSA Algorithm without OAEP +* [CWE-798](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-798-in-android-application-ovaa-apk) Use of Hard-coded Credentials +* [CWE-921](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-921-in-android-application-ovaa-apk) Storage of Sensitive Data in a Mechanism without Access Control +* [CWE-926](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-926-in-android-application-dvba-apk) Improper Export of Android Application Components + +# Quick Start + +In this section, we will show how to detect CWE-798 with Quark Script. + +### Step 1: Environments Requirements + +* Quark requires Python 3.8 or above. + +### Step 2: Install Quark Engine + +* Install Quark Engine by running: + +```bash +$ pip3 install -U quark-engine +``` + +### Step 3: Prepare Quark Script, Detection Rule and the Sample File + +1. Get the CWE-798 Quark Script and the detection rule [here](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-798-in-android-application-ovaa-apk). +2. Get the sampe file (ovaa.apk) [here](https://github.com/dark-warlord14/ovaa/releases/tag/1.0). +3. Put the script, detection rule, and sample file in the same directory. +4. Edit accordingly to the file names: + +```bash +SAMPLE_PATH = "ovaa.apk" +RULE_PATH = "findSecretKeySpec.json" +# Now you are ready to run the script! +``` + +### Step 4: Run the script + +```bash +$ python3 CWE-798.py + +# You should now see the detection result in the terminal. +Found hard-coded AES key 49u5gh249gh24985ghf429gh4ch8f23f +``` + +* **Check the [document](https://quark-engine.readthedocs.io/en/latest/quark_script.html#quark-script) for more examples.** + +# Acknowledgments + +### The Honeynet Project + + Honeynet.org logo + +### Google Summer Of Code + +Quark-Engine has been participating in the GSoC under the Honeynet Project! + +* 2021: + * [YuShiang Dang](https://twitter.com/YushianhD): [New Rule Generation Technique & Make Quark Everywhere Among Security Open Source Projects](https://quark-engine.github.io/2021/08/17/GSoC-2021-YuShiangDang/) + * [Sheng-Feng Lu](https://twitter.com/haeter525): [Replace the core library of Quark-Engine](https://quark-engine.github.io/2021/08/17/GSoC-2021-ShengFengLu/) + +Stay tuned for the upcoming GSoC! Join the [Honeynet Slack chat](https://gsoc-slack.honeynet.org/) for more info. + +# Core Values of Quark Engine Team + +* We love **battle fields**. We embrace **uncertainties**. We challenge **impossibles**. We **rethink** everything. We change the way people think. And the most important of all, we benefit ourselves by benefit others **first**. + + +%package -n python3-quark-engine +Summary: An Obfuscation-Neglect Android Malware Scoring System +Provides: python-quark-engine +BuildRequires: python3-devel +BuildRequires: python3-setuptools +BuildRequires: python3-pip +%description -n python3-quark-engine +

+ + Black Hat Arsenal + + + HITB + + + rootcon + + + defcon +
+ + build status + + + codecov + + + license + + + python version + + + PyPi Download +
+ + Twitter +
+ +

+ +# Quark Script - Dig Vulnerabilities in the BlackBox + +### Innovative & Interactive + +* The goal of Quark Script aims to provide an innovative way for mobile security researchers to analyze or **pentest** the targets. +* Based on Quark, we integrate decent tools as Quark Script APIs and make them exchange valuable intelligence to each other. This enables security researchers to **interact** with staged results and perform **creative** analysis with Quark Script. + +### Dynamic & Static Analysis + +* In Quark script, we integrate not only static analysis tools (e.g. Quark itself) but also dynamic analysis tools (e.g. [objection](https://github.com/sensepost/objection)). + +### Re-Usable & Sharable + +* Once the user creates a Quark script for specific analysis scenario. The script can be used in another targets. Also, the script can be shared to other security researchers. This enables the exchange of knowledges. + +### More APIs to come + +* Quark Script is now in a beta version. We'll keep releasing practical APIs and analysis scenarios. +* **See API document [here](https://quark-engine.readthedocs.io/en/latest/quark_script.html#introduce-of-quark-script-apis).** + +# CWE Showcases +* [CWE-020](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-20-in-android-application-diva-apk) Improper Input Validation +* [CWE-022](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-22-in-android-application-ovaa-apk-and-insecurebankv2-apk) Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') +* [CWE-023](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-23-in-android-application-ovaa-apk-and-insecurebankv2-apk) Relative Path Traversal +* [CWE-089](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-89-in-android-application-androgoat-apk) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') +* [CWE-094](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-94-in-android-application-ovaa-apk) Improper Control of Generation of Code ('Code Injection') +* [CWE-295](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-295-in-android-application-insecureshop-apk) Improper Certificate Validation +* [CWE-312](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-312-in-android-application-ovaa-apk) Cleartext Storage of Sensitive Information +* [CWE-319](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-319-in-android-application-ovaa-apk) Cleartext Transmission of Sensitive Information +* [CWE-327](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-327-in-android-application-injuredandroid-apk) Use of a Broken or Risky Cryptographic Algorithm +* [CWE-328](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-328-in-android-application-allsafe-apk) Use of Weak Hash +* [CWE-338](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-338-in-android-application-pivva-apk) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) +* [CWE-489](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-489-in-android-application-allsafe-apk-androgoat-apk-pivaa-apk) Active Debug Code +* [CWE-532](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-532-in-android-application-dvba-apk) Insertion of Sensitive Information into Log File +* [CWE-749](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-749-in-android-application-mstg-android-java-apk) Exposed Dangerous Method or Function +* [CWE-780](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-780-in-android-application-mstg-android-java-apk) Use of RSA Algorithm without OAEP +* [CWE-798](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-798-in-android-application-ovaa-apk) Use of Hard-coded Credentials +* [CWE-921](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-921-in-android-application-ovaa-apk) Storage of Sensitive Data in a Mechanism without Access Control +* [CWE-926](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-926-in-android-application-dvba-apk) Improper Export of Android Application Components + +# Quick Start + +In this section, we will show how to detect CWE-798 with Quark Script. + +### Step 1: Environments Requirements + +* Quark requires Python 3.8 or above. + +### Step 2: Install Quark Engine + +* Install Quark Engine by running: + +```bash +$ pip3 install -U quark-engine +``` + +### Step 3: Prepare Quark Script, Detection Rule and the Sample File + +1. Get the CWE-798 Quark Script and the detection rule [here](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-798-in-android-application-ovaa-apk). +2. Get the sampe file (ovaa.apk) [here](https://github.com/dark-warlord14/ovaa/releases/tag/1.0). +3. Put the script, detection rule, and sample file in the same directory. +4. Edit accordingly to the file names: + +```bash +SAMPLE_PATH = "ovaa.apk" +RULE_PATH = "findSecretKeySpec.json" +# Now you are ready to run the script! +``` + +### Step 4: Run the script + +```bash +$ python3 CWE-798.py + +# You should now see the detection result in the terminal. +Found hard-coded AES key 49u5gh249gh24985ghf429gh4ch8f23f +``` + +* **Check the [document](https://quark-engine.readthedocs.io/en/latest/quark_script.html#quark-script) for more examples.** + +# Acknowledgments + +### The Honeynet Project + + Honeynet.org logo + +### Google Summer Of Code + +Quark-Engine has been participating in the GSoC under the Honeynet Project! + +* 2021: + * [YuShiang Dang](https://twitter.com/YushianhD): [New Rule Generation Technique & Make Quark Everywhere Among Security Open Source Projects](https://quark-engine.github.io/2021/08/17/GSoC-2021-YuShiangDang/) + * [Sheng-Feng Lu](https://twitter.com/haeter525): [Replace the core library of Quark-Engine](https://quark-engine.github.io/2021/08/17/GSoC-2021-ShengFengLu/) + +Stay tuned for the upcoming GSoC! Join the [Honeynet Slack chat](https://gsoc-slack.honeynet.org/) for more info. + +# Core Values of Quark Engine Team + +* We love **battle fields**. We embrace **uncertainties**. We challenge **impossibles**. We **rethink** everything. We change the way people think. And the most important of all, we benefit ourselves by benefit others **first**. + + +%package help +Summary: Development documents and examples for quark-engine +Provides: python3-quark-engine-doc +%description help +

+ + Black Hat Arsenal + + + HITB + + + rootcon + + + defcon +
+ + build status + + + codecov + + + license + + + python version + + + PyPi Download +
+ + Twitter +
+ +

+ +# Quark Script - Dig Vulnerabilities in the BlackBox + +### Innovative & Interactive + +* The goal of Quark Script aims to provide an innovative way for mobile security researchers to analyze or **pentest** the targets. +* Based on Quark, we integrate decent tools as Quark Script APIs and make them exchange valuable intelligence to each other. This enables security researchers to **interact** with staged results and perform **creative** analysis with Quark Script. + +### Dynamic & Static Analysis + +* In Quark script, we integrate not only static analysis tools (e.g. Quark itself) but also dynamic analysis tools (e.g. [objection](https://github.com/sensepost/objection)). + +### Re-Usable & Sharable + +* Once the user creates a Quark script for specific analysis scenario. The script can be used in another targets. Also, the script can be shared to other security researchers. This enables the exchange of knowledges. + +### More APIs to come + +* Quark Script is now in a beta version. We'll keep releasing practical APIs and analysis scenarios. +* **See API document [here](https://quark-engine.readthedocs.io/en/latest/quark_script.html#introduce-of-quark-script-apis).** + +# CWE Showcases +* [CWE-020](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-20-in-android-application-diva-apk) Improper Input Validation +* [CWE-022](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-22-in-android-application-ovaa-apk-and-insecurebankv2-apk) Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') +* [CWE-023](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-23-in-android-application-ovaa-apk-and-insecurebankv2-apk) Relative Path Traversal +* [CWE-089](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-89-in-android-application-androgoat-apk) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') +* [CWE-094](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-94-in-android-application-ovaa-apk) Improper Control of Generation of Code ('Code Injection') +* [CWE-295](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-295-in-android-application-insecureshop-apk) Improper Certificate Validation +* [CWE-312](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-312-in-android-application-ovaa-apk) Cleartext Storage of Sensitive Information +* [CWE-319](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-319-in-android-application-ovaa-apk) Cleartext Transmission of Sensitive Information +* [CWE-327](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-327-in-android-application-injuredandroid-apk) Use of a Broken or Risky Cryptographic Algorithm +* [CWE-328](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-328-in-android-application-allsafe-apk) Use of Weak Hash +* [CWE-338](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-338-in-android-application-pivva-apk) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) +* [CWE-489](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-489-in-android-application-allsafe-apk-androgoat-apk-pivaa-apk) Active Debug Code +* [CWE-532](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-532-in-android-application-dvba-apk) Insertion of Sensitive Information into Log File +* [CWE-749](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-749-in-android-application-mstg-android-java-apk) Exposed Dangerous Method or Function +* [CWE-780](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-780-in-android-application-mstg-android-java-apk) Use of RSA Algorithm without OAEP +* [CWE-798](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-798-in-android-application-ovaa-apk) Use of Hard-coded Credentials +* [CWE-921](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-921-in-android-application-ovaa-apk) Storage of Sensitive Data in a Mechanism without Access Control +* [CWE-926](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-926-in-android-application-dvba-apk) Improper Export of Android Application Components + +# Quick Start + +In this section, we will show how to detect CWE-798 with Quark Script. + +### Step 1: Environments Requirements + +* Quark requires Python 3.8 or above. + +### Step 2: Install Quark Engine + +* Install Quark Engine by running: + +```bash +$ pip3 install -U quark-engine +``` + +### Step 3: Prepare Quark Script, Detection Rule and the Sample File + +1. Get the CWE-798 Quark Script and the detection rule [here](https://quark-engine.readthedocs.io/en/latest/quark_script.html#detect-cwe-798-in-android-application-ovaa-apk). +2. Get the sampe file (ovaa.apk) [here](https://github.com/dark-warlord14/ovaa/releases/tag/1.0). +3. Put the script, detection rule, and sample file in the same directory. +4. Edit accordingly to the file names: + +```bash +SAMPLE_PATH = "ovaa.apk" +RULE_PATH = "findSecretKeySpec.json" +# Now you are ready to run the script! +``` + +### Step 4: Run the script + +```bash +$ python3 CWE-798.py + +# You should now see the detection result in the terminal. +Found hard-coded AES key 49u5gh249gh24985ghf429gh4ch8f23f +``` + +* **Check the [document](https://quark-engine.readthedocs.io/en/latest/quark_script.html#quark-script) for more examples.** + +# Acknowledgments + +### The Honeynet Project + + Honeynet.org logo + +### Google Summer Of Code + +Quark-Engine has been participating in the GSoC under the Honeynet Project! + +* 2021: + * [YuShiang Dang](https://twitter.com/YushianhD): [New Rule Generation Technique & Make Quark Everywhere Among Security Open Source Projects](https://quark-engine.github.io/2021/08/17/GSoC-2021-YuShiangDang/) + * [Sheng-Feng Lu](https://twitter.com/haeter525): [Replace the core library of Quark-Engine](https://quark-engine.github.io/2021/08/17/GSoC-2021-ShengFengLu/) + +Stay tuned for the upcoming GSoC! Join the [Honeynet Slack chat](https://gsoc-slack.honeynet.org/) for more info. + +# Core Values of Quark Engine Team + +* We love **battle fields**. We embrace **uncertainties**. We challenge **impossibles**. We **rethink** everything. We change the way people think. And the most important of all, we benefit ourselves by benefit others **first**. + + +%prep +%autosetup -n quark-engine-23.3.1 + +%build +%py3_build + +%install +%py3_install +install -d -m755 %{buildroot}/%{_pkgdocdir} +if [ -d doc ]; then cp -arf doc %{buildroot}/%{_pkgdocdir}; fi +if [ -d docs ]; then cp -arf docs %{buildroot}/%{_pkgdocdir}; fi +if [ -d example ]; then cp -arf example %{buildroot}/%{_pkgdocdir}; fi +if [ -d examples ]; then cp -arf examples %{buildroot}/%{_pkgdocdir}; fi +pushd %{buildroot} +if [ -d usr/lib ]; then + find usr/lib -type f -printf "/%h/%f\n" >> filelist.lst +fi +if [ -d usr/lib64 ]; then + find usr/lib64 -type f -printf "/%h/%f\n" >> filelist.lst +fi +if [ -d usr/bin ]; then + find usr/bin -type f -printf "/%h/%f\n" >> filelist.lst +fi +if [ -d usr/sbin ]; then + find usr/sbin -type f -printf "/%h/%f\n" >> filelist.lst +fi +touch doclist.lst +if [ -d usr/share/man ]; then + find usr/share/man -type f -printf "/%h/%f.gz\n" >> doclist.lst +fi +popd +mv %{buildroot}/filelist.lst . +mv %{buildroot}/doclist.lst . + +%files -n python3-quark-engine -f filelist.lst +%dir %{python3_sitelib}/* + +%files help -f doclist.lst +%{_docdir}/* + +%changelog +* Wed Apr 12 2023 Python_Bot - 23.3.1-1 +- Package Spec generated diff --git a/sources b/sources new file mode 100644 index 0000000..f1d3733 --- /dev/null +++ b/sources @@ -0,0 +1 @@ +40e536231fa01608f790f30bf3b05073 quark-engine-23.3.1.tar.gz -- cgit v1.2.3