Android Security Testing Tools

---

Hack Code: The hacker's Toolbox is an application for penetration tester, Ethical hackers, IT administrator and Cyber security professional to perform different tasks like reconnaissance, scanning performing exploits etc.  Download AVD Clone: Clone an Android Virtual Device for easy distribution through the Android SDK Manager. You can create an AVD preinstalled with the apps and settings you need, and distribute it to others by having them point their Android SDK Manager to your repository.  Tool made by Security Compass. Download APKInspector : The goal of this project is to aide analysts and reverse engineers to visualize compiled Android packages and their corresponding DEX code. APKInspector provides both analysis functions and graphic features for the users to gain deep insight into the malicious apps. Download Burp Suite:  It is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing Download Androguard:   Create your own static analysis tool,; Analysis a bunch of android apps,; Analysis . Open source database of android malware. Download  Android Framework for Exploitation : Smartphone Pentest Framework: Rather this tool allows you to assess the security of the smartphones in your environment in the manner you’ve come to expect with modern penetration testing tools. Download Android Network Toolkit (ANTI)  This app is capable of mapping your network, scanning for vulnerable devices or configuration issues. It is for use by the amateur security enthusiast home user to the professional penetration tester, ANTI provides many other useful features such as: easy connection to open ports, visual sniffing (URLs & Cookies) and - establishing MiTM attacks (using predefined and user-defined filters), Server Side / Client Side Exploits, Password cracker to determine password’s safety level, Replace Image as visual in demos and Denial of Service attacks. All this is packed into a very user-friendly and intuitive Android app (and soon to be released iOS app). Download ->ANONdroid v. 00.00.008 : JonDonym proxy client for Android  ANONdroid is a client application for the AN.ON anonymisation service. This service allows a user to browse the Web anonymously. ANONdroid acts as a proxy for your internet applications and will forward the traffic of your internet applications encrypted to the mix cascades. ANONdroid uses the core libraries of JonDo with a smartphone compatible GUI. Download Am I Hacker Proof Am I Hacker Proof scans your network, computer or website from the outside as a hacker would, looking for vulnerabilities. Once it finds the vulnerabilities, it will email or text you  letting you know how many vulnerabilities you have. In addition, in the paid version you can check to see if your voicemail on your cell phone is hacker proof. This App does not use any resources on your phone. Once you start a scan you will be  notified via email or text your scan started. When your scan is completed you will be notified again that your scan is complete. Am I Hacker Proof includes these services for free: - Choose from three types of scans: A “Quick” scan (up to four hours), a “Complete” scan  (can take up to four days to complete), and a Web site scan (searches for vulnerabilities in certain types of Web sites; currently supports WordPress Web sites). - You can perform a scan on any Web or IP address. - You can scan up to 10 times a month. - Built- in tools – Ping, Traceroute, Whois, ISP/E-mail Service Providers database and real  time cyber security news feeds. - Your reports are saved in a PDF file that you can read on your device or forward to any email address you like. - Your account on your device works on the website www.AmIHackerProof.com so you can have access to more applications. -> Voicemail Hacking. - Built-in tools – Ping, Traceroute, Whois, ISP/E-mail Service Providers database and real time cyber security news feeds. - Search through the scans you performed by address, time, number of vulnerabilities, or status. - You get an email and text message letting you know the number of vulnerabilities found on that IP address or website. Download

Andro Rat:  AndroRat is a remote administration Android tool. you can bind this spyware tool with the other android application and ask the victim to download this app.  It can read all messages, contacts, records and acall without knowing of the user. Download Droid Pentest: Its help you to find all android apps for penetration testing and hacking so you can make complete penetration test platform . This Tool developed by Nikhalesh Singh. Download Android SDK: A software development kit that enables developers to create applications for the Android platform. The Android SDK includes sample projects with source code. Download DroidBox: Its developed to offer dynamic analysis of Android applications. The following information is shown in the results, generated when analysis is ended: •    Hashes for the analyzed package •    Incoming/outgoing network data •    File read and write operations •    Started services and loaded classes through DexClassLoader •    Information leaks via the network, file and SMS •    Circumvented permissions •    Cryptography operations performed using Android API •    Listing broadcast receivers •    Sent SMS and phone calls Additionally, two images are generated visualizing the behavior of the package. One showing the temporal order of the operations and the other one being a treemap that can be used to check similarity between analyzed packages. Download Dex2jar: dex2jar is a lightweight package that provide you with four components in order to work with .dex and java .class files. dex-reader is designed to read the Dalvik Executable (.dex/.odex) format. It has a light weight API similar with ASM. Download Jd-gui: JD-GUI is a standalone graphical utility that displays Java source codes of “.class” files. You can browse the reconstructed source code with the JD-GUI for instant access to methods and fields. Download Wifi Protector - Protect Your Android From Wi-Fi Sniffing Attacks  The only app that is able to countermeasure "Man In The Middle" attacks on    Android  platform - Wifi Protector. No other app provides this type of high network security. Protects your phone from tools like FaceNiff, Cain & Abel, ANTI, Ettercap, DroidSheep,  NetCut,and all others that try to hijack your session via "Man In The Middle" through ARP spoofing / ARP poisoning. YouTube Video Download -> Free Avast Antivirus For Android Security   Full-featured Antivirus and Anti-Theft security for your Android phone.    By using Avast Mobile Security in your Android phone, your cell phone will be                         protected  by virus, threat, hacker, even it’s able to minimize your loss if your Android       cell phone is stolen. The antivirus component supports real-time protection and                    automatic updates. Updates can be configured to only be downloaded over certain   types  of connections and the interface can be protected with a password. Protect personal data with automatic virus scans and infected-URL alerts. Stop hackers by adding a firewall (rooted phones). Control anti-theft features with remote SMS commands for: history wipe, phone lock, siren activation, GPS tracking, audio monitoring, and many other useful tools.   Call and SMS filtering can help device owners block annoying advertising calls or spam   text messages. Users can define groups of phone numbers and configure the blocking intervals for them.The firewall component is only available for rooted devices because it requires special system-level access to enforce its rules. Device owners can use it to block individual applications from accessing the Internet over certain types of connections.   Video: Download Wi-Fi Key Recovery  ->You need root to use this application.  ->You need to have connected to the network in the past.  -> This app cannot "hack" into an unknown/new network. Have you ever forgotten the password of your home WiFi network, or the one you setup for your parents a few months back? This application will help you recover the password of a wireless network you have connected to with your device in the past. You can then either tap on an entry to copy it, or export the list to SD, or share it using the standard Android sharing facilities.   It does not crack the network, or use the MAC/SSID address to deduce the password. It    simply reads it from the device itself.  Download

Tools for testing HeartBleed Vulnerability

Tools List:-

Online Checker:  https://filippo.io/Heartbleed/ 
A checker (site and tool) for CVE-2014-0160: https://github.com/FiloSottile/Heartbleed 
ssltest.py: Quick and dirty demonstration of CVE-2014-0160 by Jared Staffordhttp://pastebin.com/WmxzjkXJ
SSL Server Test:https://www.ssllabs.com/ssltest/index.html
Metasploit Module: https://github.com/rapid7/metasploit-framework/pull/3206/files
Nmap NSE script: Detects whether a server is vulnerable to the OpenSSL Heartbleed: https://svn.nmap.org/nmap/scripts/ssl-heartbleed.nse
Nmap: http://nmap.org/nsedoc/scripts/ssl-heartbleed.htmlNmap Command: 

nmap -sV --script=ssl-heartbleed <target>

Heartbleeder: Tests your servers for OpenSSL: https://github.com/titanous/heartbleeder?files=1
Heartbleed Attack POC and Mass Scanner: https://bitbucket.org/fb1h2s/cve-2014-0160
Heartbleed Honeypot Script: http://packetstormsecurity.com/files/126068/hb_honeypot.pl.txt
Mcfee Release online tool to check Heartbleedhttp://tif.mcafee.com/heartbleedtest 
 Other linkshttps://pentest-tools.com/vulnerability-scanning/openssl-heartbleed-scanner/

https://github.com/noxxi/p5-scripts/blob/master/check-ssl-heartbleed.pl

https://lastpass.com/heartbleed/
http://heartbleed.criticalwatch.com/
http://possible.lv/tools/hb/
https://ssl-tools.net/heartbleed-test

Security Tools & Blogs

http://www.hackersonlineclub.com/android-tools

Web Application Testing Basic Checklist for Security

Web Application Testing Basic Checklist for Pentesters

Web Applications are the chief way in which the companies represent themselves in the Online World. The E-commerce often uses them for online transactions and common people like to provide them with private and personal information. We almost never ask ourselves how safe the web surfing really is?

Web Applications is defined as: "A web-based application is any application that uses a web browser as a client. The term may also mean a computer software application that is coded in a browser-supported programming language (such as JavaScript, combined with a browser-rendered markup language like HTML) and reliant on a common web browser to render the application executable." - source: Wikipedia.
Nowadays, these are the ways in which a company lures its customers to various deals, if it is an E-commerce website, the developers make sure that it looks good rather than securing the more vital features of their web applications. The Social networking websites are also considered as web applications and the users provide them with vital information without much thinking.
Every day we come across the news that some website was hacked, but what do we really do about it? The security of the web applications is always questioned. As Pentesters, we must alwazs remember that There's nothing as absolute security and it is our duty to make others feel safe by testing inter alia web applications.

OWASP

Open-Web Application Security Project (OWASP) is a non-profit charitable organization focused on improving the security. It lays down the following Top 10 Vulnerabilities found in Web Applications in their 2013 list:

• A1- Injection,
• A2- Authentication and Session Management,
• A3- Cross-Site Scripting(XSS),
• A4-Insecure Direct Object References,
• A5-Security Misconfiguration,
• A6-Sensitive Data Exposure,
• A7-Missing Function Level Control,
• A8-Cross Site Request Forgery(CSRF),
• A9-Using components with known Vulnerabilities,
• A10-Unvalidated redirects and forwards.

I will not be discussing all these vulnerabilities but only the basic ones which SecurityResearchers generally use for testing a Website. nLet's Begin.

INJECTION

Injection Attacks, can be SQL injection, XPath, SOAP,LDAP injection etc.
SQL injections have been with us for the long time and they still exist as one of the prevalent vulnerabilities that exist in various web applications, recently one of the SQL injections was found in a Nokia website.
An SQL injection attack would mean inserting an SQL query through the Input fields from the client to the application or server which would result in some form of manipulation. A successful SQL injection attack can do various things such as reading data from the Database, manipulating data i.e. performing operations such as insert, delete, update data in the database and execute administrative commands. SQL injection attacks can be of the following three types:

• Inband - Data is extracted from the same channel through which the SQL query is passed into the code.
• Out-of-band - Data is extracted from a different source.
• Inferential - There is no actual transfer of data, but the tester is able to reconstruct the information by sending crafted requests and seeing the manner in which the database handles them.

Can be broadly be Time Based Injection, Blind SQL injection and Union Based.

Testing for SQL injection
Each Input parameter should be checked for the Injection flaws. It is not easy to find and confirm the existence of SQL injection flaws.

• Each Parameter should be checked by inserting a single quote and checking the error responses received through it including the 404 Not Found.
• Confirming the presence of SQL injection can be done using the concatenation operator(||). However, if this character is filtered there still might be SQLi since you do not do this character.

For example: A bookstore web application made by implementing SQL searches for the books by an author in the following way: http://www.example.com/pls/bookstore/books.search?author=William. If the above link is returning you the books by the author William Shakespeare. But http://www.example.com/pls/bookstore/books.search?author=Willi'am is giving you a 404 Error message then the application is having an SQL injection flaw. This can be confirmed using the concatenation operator in the following way: http://www.example.com/pls/bookstore/books.search?author=Willi'||'am. If this again is returning you the books by William Shakespeare then you've confirmed an SQL injection flaw.

Authentication and Session Management

Authentication and Session Management flaws are given as A2 in the OWASP list of Top 10 2013 vulnerabilities but they do not get their deserved importance. They exist in various forms which I will discuss. I, myself, have discovered these flaws in various websites including Google.
Authentication in Greek means Real or Genuine. In web application, Authentication is done by the various web applications through the LOGIN process, which identifies the user as being genuine. The user has to identify himself by providing the authentication mechanism with the valid credentials in the form of a valid username and password.

Testing for Authentication

Credentials Transport over an unencrypted channel user's credentials are not always transferred in an unencrypted form over the channel, so any attacker can eavesdrop the important credentials.
Sometimes, even the HTTPS sites send their credentials which are to be stored in the form of cookies in the client side are transported in an unencrypted form.

Partial-Encryption
The sites which have not implemented full site HTTPS often transmit their important cookies such as a user's Session id etc can be transmitted through the HTTP pages of the HTTPS site.

user Enumeration
This is the type of testing in which we test the authentication mechanism of the web application to see if we could get any valid usernames. It would also employ brute force to test if one could also find a password for the valid username got through this testing method. The tester will check if the authentication mechanism gives any kind of hints when we try to authenticate ourselves with the wrong username or passwords. The error messages received from the server side when testing the authentication mechanism such as the LOGIN pages reveal a lot. For eg: Figure 1. Here in this example, The error message displayed by the server is "PASSWORD IS INCORRECT" which in the other way means that the supplied username is correct.

Source:PenTest