├── .gitignore ├── .gitmodules ├── .travis.yml ├── LICENSE ├── README.rst ├── docs └── qark_diagram.png ├── qark ├── __init__.py ├── apk_builder.py ├── decompiler │ ├── __init__.py │ ├── decompiler.py │ └── external_decompiler.py ├── exploit_apk │ ├── app │ │ ├── build.gradle │ │ ├── proguard-rules.pro │ │ └── src │ │ │ ├── .DS_Store │ │ │ ├── androidTest │ │ │ └── java │ │ │ │ └── com │ │ │ │ └── secbro │ │ │ │ └── qark │ │ │ │ └── ApplicationTest.java │ │ │ └── main │ │ │ ├── AndroidManifest.xml │ │ │ ├── ic_launcher-web.png │ │ │ ├── ic_launcher_2-web.png │ │ │ ├── ic_launcher_droid-web.png │ │ │ ├── java │ │ │ └── com │ │ │ │ └── secbro │ │ │ │ └── qark │ │ │ │ ├── TopLevelActivity.java │ │ │ │ ├── customintent │ │ │ │ ├── ChooseIntentUseCaseActivity.java │ │ │ │ └── CreateCustomIntentActivity.java │ │ │ │ ├── exportedcomponent │ │ │ │ ├── ExportedComponentsFragment.java │ │ │ │ ├── exportedactivity │ │ │ │ │ ├── ExportedActivityListFragment.java │ │ │ │ │ ├── IntentParamsFragment.java │ │ │ │ │ └── IntentSenderActivity.java │ │ │ │ └── exportedreceiver │ │ │ │ │ ├── ExportedReceiverListFragment.java │ │ │ │ │ ├── IntentSenderActivity.java │ │ │ │ │ └── IntentSenderFragment.java │ │ │ │ ├── filebrowser │ │ │ │ ├── FileBrowserActivity.java │ │ │ │ └── FileBrowserFragment.java │ │ │ │ ├── intentsniffer │ │ │ │ ├── BroadcastIntentSnifferActivity.java │ │ │ │ ├── BroadcastIntentSnifferFragment.java │ │ │ │ └── services │ │ │ │ │ ├── BootReceiver.java │ │ │ │ │ └── BroadcastStealerService.java │ │ │ │ ├── tapjacking │ │ │ │ └── TapJackingExploitFragment.java │ │ │ │ └── webviewtests │ │ │ │ ├── WebViewTestsActivity.java │ │ │ │ └── WebViewTestsActivityFragment.java │ │ │ └── res │ │ │ ├── .DS_Store │ │ │ ├── drawable-hdpi │ │ │ ├── drawer_shadow.9.png │ │ │ ├── ic_add_black_24dp.png │ │ │ └── ic_drawer.png │ │ │ ├── drawable-mdpi │ │ │ ├── drawer_shadow.9.png │ │ │ ├── ic_add_black_24dp.png │ │ │ └── ic_drawer.png │ │ │ ├── drawable-xhdpi │ │ │ ├── custom_intent.png │ │ │ ├── drawer_shadow.9.png │ │ │ ├── header2.png │ │ │ ├── ic_add_black_24dp.png │ │ │ ├── ic_drawer.png │ │ │ ├── ic_folder_black_24dp.png │ │ │ ├── ic_launch_black_24dp.png │ │ │ ├── ic_mouse_black_24dp.png │ │ │ ├── ic_public_black_24dp.png │ │ │ ├── ic_visibility_black_24dp.png │ │ │ ├── qark_512.png │ │ │ └── web_view.png │ │ │ ├── drawable-xxhdpi │ │ │ ├── drawer_shadow.9.png │ │ │ ├── header3.png │ │ │ ├── header4.png │ │ │ ├── ic_add_black_24dp.png │ │ │ ├── ic_drawer.png │ │ │ ├── ic_launch_black_24dp.png │ │ │ ├── ic_mouse_black_24dp.png │ │ │ ├── ic_public_black_24dp.png │ │ │ ├── ic_visibility_black_24dp.png │ │ │ └── qark_drawer.png │ │ │ ├── drawable │ │ │ ├── dir_up.png │ │ │ ├── file_icon.png │ │ │ ├── folder_icon.png │ │ │ ├── folder_icon_light.png │ │ │ ├── ic_one.png │ │ │ ├── mipmap-hdpi │ │ │ │ ├── ic_launcher.png │ │ │ │ └── ic_launcher_2.png │ │ │ ├── mipmap-mdpi │ │ │ │ ├── ic_launcher.png │ │ │ │ └── ic_launcher_2.png │ │ │ ├── mipmap-xhdpi │ │ │ │ ├── ic_launcher.png │ │ │ │ └── ic_launcher_2.png │ │ │ ├── mipmap-xxhdpi │ │ │ │ ├── ic_launcher.png │ │ │ │ └── ic_launcher_2.png │ │ │ └── mipmap-xxxhdpi │ │ │ │ ├── ic_launcher.png │ │ │ │ └── ic_launcher_2.png │ │ │ ├── layout │ │ │ ├── activity_choose_intent_use_case.xml │ │ │ ├── activity_create_custom_intent.xml │ │ │ ├── activity_exploit_exported_result.xml │ │ │ ├── activity_file_browser.xml │ │ │ ├── activity_intent_sender.xml │ │ │ ├── activity_top_level.xml │ │ │ ├── activity_web_view_tests.xml │ │ │ ├── fragment_broadcast_stealer.xml │ │ │ ├── fragment_exploit_exported_activity_params.xml │ │ │ ├── fragment_exported_activity_list.xml │ │ │ ├── fragment_exported_components.xml │ │ │ ├── fragment_exported_receiver_list.xml │ │ │ ├── fragment_file_browser.xml │ │ │ ├── fragment_intent_sender.xml │ │ │ ├── fragment_navigation_drawer.xml │ │ │ ├── fragment_tap_jacking_exploit.xml │ │ │ ├── fragment_top_level.xml │ │ │ ├── fragment_web_view_tests.xml │ │ │ ├── nav_header.xml │ │ │ ├── tap_jacking_toast.xml │ │ │ ├── toolbar.xml │ │ │ └── webview.xml │ │ │ ├── menu │ │ │ ├── drawer_view.xml │ │ │ ├── menu_intent_sender.xml │ │ │ ├── menu_main.xml │ │ │ └── menu_web_view_tests.xml │ │ │ ├── mipmap-xxxhdpi │ │ │ └── qark_512.png │ │ │ ├── values-w820dp │ │ │ └── dimens.xml │ │ │ └── values │ │ │ ├── colors.xml │ │ │ ├── dimens.xml │ │ │ ├── extraKeys.xml │ │ │ ├── intentID.xml │ │ │ ├── strings.xml │ │ │ └── styles.xml │ ├── build.gradle │ ├── gradle │ │ └── wrapper │ │ │ ├── gradle-wrapper.jar │ │ │ └── gradle-wrapper.properties │ ├── gradlew │ ├── gradlew.bat │ └── settings.gradle ├── issue.py ├── lib │ ├── apktool │ │ └── apktool.jar │ ├── decompilers │ │ ├── cfr_0_124.jar │ │ ├── fernflower.jar │ │ └── procyon-decompiler-1.0.jar │ └── dex2jar-2.0 │ │ ├── d2j-baksmali.bat │ │ ├── d2j-baksmali.sh │ │ ├── d2j-dex-recompute-checksum.bat │ │ ├── d2j-dex-recompute-checksum.sh │ │ ├── d2j-dex2jar.bat │ │ ├── d2j-dex2jar.sh │ │ ├── d2j-dex2smali.bat │ │ ├── d2j-dex2smali.sh │ │ ├── d2j-jar2dex.bat │ │ ├── d2j-jar2dex.sh │ │ ├── d2j-jar2jasmin.bat │ │ ├── d2j-jar2jasmin.sh │ │ ├── d2j-jasmin2jar.bat │ │ ├── d2j-jasmin2jar.sh │ │ ├── d2j-smali.bat │ │ ├── d2j-smali.sh │ │ ├── d2j-std-apk.bat │ │ ├── d2j-std-apk.sh │ │ ├── d2j_invoke.bat │ │ ├── d2j_invoke.sh │ │ └── lib │ │ ├── antlr-runtime-3.5.jar │ │ ├── asm-debug-all-4.1.jar │ │ ├── d2j-base-cmd-2.0.jar │ │ ├── d2j-jasmin-2.0.jar │ │ ├── d2j-smali-2.0.jar │ │ ├── dex-ir-2.0.jar │ │ ├── dex-reader-2.0.jar │ │ ├── dex-reader-api-2.0.jar │ │ ├── dex-tools-2.0.jar │ │ ├── dex-translator-2.0.jar │ │ ├── dex-writer-2.0.jar │ │ └── dx-1.7.jar ├── plugins │ ├── __init__.py │ ├── broadcast │ │ ├── __init__.py │ │ ├── dynamic_broadcast_receiver.py │ │ └── send_broadcast_receiver_permission.py │ ├── cert │ │ ├── __init__.py │ │ ├── cert_validation_methods_overriden.py │ │ └── hostname_verifier.py │ ├── crypto │ │ ├── __init__.py │ │ ├── ecb_cipher_usage.py │ │ ├── packaged_private_keys.py │ │ ├── rsa_cipher_usage.py │ │ └── setting_secure_random_seed.py │ ├── file │ │ ├── __init__.py │ │ ├── android_logging.py │ │ ├── api_keys.py │ │ ├── external_storage.py │ │ ├── file_permissions.py │ │ ├── http_url_hardcoded.py │ │ ├── insecure_functions.py │ │ └── phone_identifier.py │ ├── generic │ │ ├── __init__.py │ │ ├── check_permissions.py │ │ └── task_affinity.py │ ├── helpers.py │ ├── intent │ │ ├── __init__.py │ │ └── implicit_intent_to_pending_intent.py │ ├── manifest │ │ ├── __init__.py │ │ ├── allow_backup.py │ │ ├── android_path.py │ │ ├── api_keys.py │ │ ├── custom_permissions.py │ │ ├── debuggable.py │ │ ├── exported_tags.py │ │ ├── min_sdk.py │ │ ├── single_task_launch_mode.py │ │ └── task_reparenting.py │ ├── manifest_helpers.py │ └── webview │ │ ├── __init__.py │ │ ├── add_javascript_interface.py │ │ ├── helpers.py │ │ ├── javascript_enabled.py │ │ ├── load_data_with_base_url.py │ │ ├── remote_webview_debugging.py │ │ ├── set_allow_content_access.py │ │ ├── set_allow_file_access.py │ │ ├── set_allow_universal_access_from_file_urls.py │ │ └── set_dom_storage_enabled.py ├── qark.py ├── report.py ├── scanner │ ├── __init__.py │ ├── plugin.py │ └── scanner.py ├── templates │ ├── csv_report.jinja │ ├── html_report.jinja │ ├── json_report.jinja │ └── xml_report.jinja ├── utils.py └── xml_helpers.py ├── report └── .gitignore ├── requirements-test.txt ├── requirements.txt ├── requirements_to_freeze.txt ├── setup.cfg ├── setup.py └── tests ├── __init__.py ├── conftest.py ├── goatdroid.apk ├── test_apk_builder.py ├── test_decompiler ├── __init__.py └── test_decompiler.py ├── test_issue.py ├── test_java_files ├── check_permissions.java ├── dynamic_broadcast_receiver.java ├── external_storage.java ├── http_url_hardcoded.java ├── insecure_functions.java ├── phone_identifier.java ├── send_broadcast_receiver_permission.java ├── task_affinity.java └── test_android_logging.java ├── test_manifest_helpers.py ├── test_plugins ├── __init__.py ├── test_broadcast_plugins │ ├── __init__.py │ ├── test_dynamic_broadcast_receiver.py │ └── test_send_broadcast_receiver_permission.py ├── test_cert_plugins │ ├── __init__.py │ ├── testCertMethodsFile.java │ ├── testHostnameVerifier.java │ └── test_cert_plugins.py ├── test_crypto_plugins │ ├── __init__.py │ ├── java_files │ │ ├── blank.java │ │ ├── ecb1.java │ │ ├── ecb2.java │ │ ├── ecb3.java │ │ ├── invalid.java │ │ ├── no_ecb1.java │ │ ├── secure_random_args1.java │ │ ├── secure_random_args2.java │ │ └── secure_random_no_args1.java │ ├── keys │ │ ├── dsa-key │ │ ├── dsa-key.pub │ │ ├── ecdsa-key │ │ ├── ecdsa-key.pub │ │ ├── ed25519-key │ │ ├── ed25519-key.pub │ │ ├── rsa-key │ │ └── rsa-key.pub │ ├── test_crypto_plugins.py │ └── test_ecb.py ├── test_file_plugins │ ├── __init__.py │ ├── test_file_permissions.java │ └── test_file_plugins.py ├── test_generic_plugins │ ├── __init__.py │ ├── test_check_permissions.py │ └── test_task_affinity.py ├── test_intent │ ├── __init__.py │ ├── test_implicit_intent.java │ └── test_intent_plugins.py ├── test_manifest_plugins │ ├── __init__.py │ ├── broadcastreceivers │ │ └── SendSMSNowReceiver.java │ ├── test_manifest_plugins.py │ └── test_min_sdk_tapjacking │ │ └── androidmanifest.xml └── test_webviews │ ├── __init__.py │ ├── test_webviews.py │ ├── vulnerable_webview.java │ ├── vulnerable_webview_add_javascript_interface.java │ ├── vulnerable_webview_content_access.java │ ├── vulnerable_webview_file_access.java │ ├── vulnerable_webview_set_dom_storage_enabled.java │ └── vulnerable_webview_universal_access_from_urls.java ├── test_report.py ├── test_scanner ├── __init__.py ├── test_plugin.py └── test_scanner.py └── test_xml_files ├── strings.xml ├── test_androidmanifest.xml └── test_goatdroid_manifest.xml /.gitignore: -------------------------------------------------------------------------------- 1 | *.pyc 2 | *.png 3 | *.jpg 4 | logs 5 | android-sdk* 6 | settings.properties 7 | *.swp 8 | build 9 | run 10 | sampleApps/goatdroid 11 | lib/plyj/lextab.py 12 | test/.coverage 13 | .coverage 14 | parsetab.py 15 | sampleApps 16 | lextab.py 17 | qark/test/testData/* 18 | .idea 19 | .DS_Store 20 | *.iml 21 | lib/ 22 | .cache/ 23 | dist/ 24 | qark.egg-info/ 25 | venv/ 26 | qark_debug.log -------------------------------------------------------------------------------- /.gitmodules: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/linkedin/qark/ba1b26562507d631389b111e5033dad4128a8541/.gitmodules -------------------------------------------------------------------------------- /.travis.yml: -------------------------------------------------------------------------------- 1 | language: python 2 | python: 3 | - "2.7" 4 | - "3.6" 5 | install: 6 | - pip install -r requirements-test.txt 7 | script: 8 | - travis_wait python -m pytest 9 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Copyright 2015 LinkedIn Corp. All rights reserved. 2 | 3 | Copyright 2015 LinkedIn Corp. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
 You may obtain a copy of the License at http://www.apache.org/ licenses/LICENSE-2.0 4 | 5 | Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, 
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 6 | 7 | ============================================================================== 8 | Copyrights and Licenses for Third Party Software Distributed with QARK: 9 | ============================================================================== 10 | The QARK software also contains code written by third parties. Such software will 11 | have its own individual LICENSE.TXT file in the directory in which it appears, or 12 | at the top of the files in case the LICENSE.TXT is not present. This file will 13 | describe the copyrights, license, and restrictions which apply to that code. 14 | 15 | The following pieces of software have additional or alternate copyrights, 16 | licenses, and/or restrictions: 17 | 18 | Program Type 19 | ------- ---- 20 | six MIT 21 | pluginbase BSD 22 | requests[security] Apache Software License (Apache 2.0) 23 | jinja2 BSD 24 | enum34 BSD 25 | javalang MIT 26 | click BSD 27 | apktool Apache Software License (Apache 2.0) qark/qark/lib/apktool 28 | dex2jar Apache Software License (Apache 2.0) qark/qark/lib/dex2jar-2.0 29 | procyon Apache Software License (Apache 2.0) qark/qark/lib/decompilers/procyon-decompiler-1.0.jar 30 | cfr MIT qark/qark/lib/decompilers/cfr_0_124.jar 31 | fernflower Apache Software License (Apache 2.0) qark/qark/lib/decompilers/fernflower.jar -------------------------------------------------------------------------------- /docs/qark_diagram.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/linkedin/qark/ba1b26562507d631389b111e5033dad4128a8541/docs/qark_diagram.png -------------------------------------------------------------------------------- /qark/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/linkedin/qark/ba1b26562507d631389b111e5033dad4128a8541/qark/__init__.py -------------------------------------------------------------------------------- /qark/decompiler/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/linkedin/qark/ba1b26562507d631389b111e5033dad4128a8541/qark/decompiler/__init__.py -------------------------------------------------------------------------------- /qark/decompiler/external_decompiler.py: -------------------------------------------------------------------------------- 1 | import abc 2 | import os 3 | 4 | LIB_PATH = os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "lib") 5 | PATH_TO_DECOMPILERS = os.path.join(LIB_PATH, "decompilers") 6 | 7 | 8 | class ExternalDecompiler(object): 9 | __meta__ = abc.ABCMeta 10 | 11 | def __init__(self, name, path_to_decompiler, command=None): 12 | self.name = name.lower() 13 | self.path_to_decompiler = path_to_decompiler 14 | self.command = command 15 | 16 | 17 | class CFR(ExternalDecompiler): 18 | def __init__(self): 19 | ExternalDecompiler.__init__(self, 20 | name="cfr", 21 | path_to_decompiler=os.path.join(PATH_TO_DECOMPILERS, "cfr_0_124.jar"), 22 | command="java -jar {path_to_decompiler} {jar} --outputdir {build_directory}/cfr") 23 | 24 | 25 | class Procyon(ExternalDecompiler): 26 | def __init__(self): 27 | ExternalDecompiler.__init__(self, 28 | name="procyon", 29 | path_to_decompiler=os.path.join(PATH_TO_DECOMPILERS, 30 | "procyon-decompiler-1.0.jar"), 31 | command="java -jar {path_to_decompiler} {jar} -o {build_directory}/procyon") 32 | 33 | 34 | class Fernflower(ExternalDecompiler): 35 | def __init__(self): 36 | ExternalDecompiler.__init__(self, 37 | name="fernflower", 38 | path_to_decompiler=os.path.join(PATH_TO_DECOMPILERS, 39 | "fernflower.jar"), 40 | command="java -jar {path_to_decompiler} -ren=1 {jar} {build_directory}/fernflower") 41 | 42 | 43 | DECOMPILERS = (CFR(), Procyon(), Fernflower()) 44 | -------------------------------------------------------------------------------- /qark/exploit_apk/app/build.gradle: -------------------------------------------------------------------------------- 1 | apply plugin: 'com.android.application' 2 | 3 | android { 4 | compileSdkVersion 21 5 | buildToolsVersion "21.1.2" 6 | defaultConfig { 7 | applicationId 'com.secbro.qark' 8 | minSdkVersion 7 9 | targetSdkVersion 21 10 | versionCode 1 11 | versionName "1.0" 12 | } 13 | compileOptions { 14 | sourceCompatibility = JavaVersion.VERSION_1_7 15 | targetCompatibility = JavaVersion.VERSION_1_7 16 | } 17 | buildTypes { 18 | release { 19 | } 20 | } 21 | productFlavors { 22 | } 23 | } 24 | 25 | dependencies { 26 | compile 'com.android.support:appcompat-v7:22.2.1' 27 | compile 'com.android.support:design:22.2.1' 28 | compile 'com.android.support:recyclerview-v7:22.2.1' 29 | } -------------------------------------------------------------------------------- /qark/exploit_apk/app/proguard-rules.pro: -------------------------------------------------------------------------------- 1 | # Add project specific ProGuard rules here. 2 | # By default, the flags in this file are appended to flags specified 3 | # in /Applications/android-sdk-macosx/tools/proguard/proguard-android.txt 4 | # You can edit the include path and order by changing the proguardFiles 5 | # directive in build.gradle. 6 | # 7 | # For more details, see 8 | # http://developer.android.com/guide/developing/tools/proguard.html 9 | 10 | # Add any project specific keep options here: 11 | 12 | # If your project uses WebView with JS, uncomment the following 13 | # and specify the fully qualified class name to the JavaScript interface 14 | # class: 15 | #-keepclassmembers class fqcn.of.javascript.interface.for.webview { 16 | # public *; 17 | #} 18 | -------------------------------------------------------------------------------- /qark/exploit_apk/app/src/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/linkedin/qark/ba1b26562507d631389b111e5033dad4128a8541/qark/exploit_apk/app/src/.DS_Store -------------------------------------------------------------------------------- /qark/exploit_apk/app/src/androidTest/java/com/secbro/qark/ApplicationTest.java: -------------------------------------------------------------------------------- 1 | package com.secbro.qark; 2 | 3 | import android.app.Application; 4 | import android.test.ApplicationTestCase; 5 | 6 | /** 7 | * Testing Fundamentals 8 | */ 9 | public class ApplicationTest extends ApplicationTestCase { 10 | public ApplicationTest() { 11 | super(Application.class); 12 | } 13 | } -------------------------------------------------------------------------------- /qark/exploit_apk/app/src/main/ic_launcher-web.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/linkedin/qark/ba1b26562507d631389b111e5033dad4128a8541/qark/exploit_apk/app/src/main/ic_launcher-web.png -------------------------------------------------------------------------------- /qark/exploit_apk/app/src/main/ic_launcher_2-web.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/linkedin/qark/ba1b26562507d631389b111e5033dad4128a8541/qark/exploit_apk/app/src/main/ic_launcher_2-web.png -------------------------------------------------------------------------------- /qark/exploit_apk/app/src/main/ic_launcher_droid-web.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/linkedin/qark/ba1b26562507d631389b111e5033dad4128a8541/qark/exploit_apk/app/src/main/ic_launcher_droid-web.png -------------------------------------------------------------------------------- /qark/exploit_apk/app/src/main/java/com/secbro/qark/intentsniffer/BroadcastIntentSnifferActivity.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright 2015 LinkedIn Corp. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. 3 | * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 4 | * 5 | * Unless required by applicable law or agreed to in writing, software 6 | * distributed under the License is distributed on an "AS IS" BASIS, 7 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 8 | */ 9 | 10 | package com.secbro.qark.intentsniffer; 11 | 12 | import android.app.Activity; 13 | import android.content.Context; 14 | import android.content.Intent; 15 | import android.content.SharedPreferences; 16 | import android.os.Bundle; 17 | import android.support.v7.app.AppCompatActivity; 18 | import android.widget.TextView; 19 | 20 | import com.secbro.qark.R; 21 | import com.secbro.qark.intentsniffer.services.BroadcastStealerService; 22 | 23 | public class BroadcastIntentSnifferActivity extends AppCompatActivity { 24 | @Override 25 | protected void onCreate(Bundle savedInstanceState) { 26 | super.onCreate(savedInstanceState); 27 | setContentView(R.layout.fragment_broadcast_stealer); 28 | SharedPreferences prefs = this.getSharedPreferences( 29 | getPackageName(), Context.MODE_PRIVATE); 30 | TextView textview = (TextView) findViewById(R.id.activity_broadcast_stealer_text_view); 31 | textview.setText(prefs.getString("foo", "Listening..." )); 32 | Intent msgIntent = new Intent(this, BroadcastStealerService.class); 33 | msgIntent.setAction("Start"); 34 | startService(msgIntent); 35 | } 36 | } 37 | -------------------------------------------------------------------------------- /qark/exploit_apk/app/src/main/java/com/secbro/qark/intentsniffer/BroadcastIntentSnifferFragment.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright 2015 LinkedIn Corp. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. 3 | * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 4 | * 5 | * Unless required by applicable law or agreed to in writing, software 6 | * distributed under the License is distributed on an "AS IS" BASIS, 7 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 8 | */ 9 | 10 | package com.secbro.qark.intentsniffer; 11 | 12 | import android.content.Context; 13 | import android.content.Intent; 14 | import android.content.SharedPreferences; 15 | import android.os.Bundle; 16 | import android.support.annotation.Nullable; 17 | import android.support.v4.app.Fragment; 18 | import android.view.LayoutInflater; 19 | import android.view.View; 20 | import android.view.ViewGroup; 21 | import android.widget.TextView; 22 | 23 | import com.secbro.qark.R; 24 | import com.secbro.qark.intentsniffer.services.BroadcastStealerService; 25 | 26 | public class BroadcastIntentSnifferFragment extends Fragment { 27 | 28 | 29 | public static BroadcastIntentSnifferFragment newInstance() { 30 | BroadcastIntentSnifferFragment fragment = new BroadcastIntentSnifferFragment(); 31 | return fragment; 32 | } 33 | 34 | @Override 35 | public View onCreateView(LayoutInflater inflater, @Nullable ViewGroup container, @Nullable Bundle savedInstanceState) { 36 | View retVal = inflater.inflate(R.layout.fragment_broadcast_stealer, container, false); 37 | 38 | SharedPreferences prefs = this.getActivity().getSharedPreferences( 39 | getActivity().getPackageName(), Context.MODE_PRIVATE); 40 | TextView textview = (TextView) retVal.findViewById(R.id.activity_broadcast_stealer_text_view); 41 | 42 | textview.setText(prefs.getString("foo", "Listening..." )); 43 | Intent msgIntent = new Intent(this.getActivity(), BroadcastStealerService.class); 44 | msgIntent.setAction("Start"); 45 | this.getActivity().startService(msgIntent); 46 | 47 | return retVal; 48 | } 49 | 50 | @Override 51 | public void onResume() { 52 | SharedPreferences prefs = this.getActivity().getSharedPreferences( 53 | getActivity().getPackageName(), Context.MODE_PRIVATE); 54 | TextView textview = (TextView) this.getActivity().findViewById(R.id.activity_broadcast_stealer_text_view); 55 | 56 | textview.setText(prefs.getString("foo", "Listening..." )); 57 | super.onResume(); 58 | } 59 | 60 | /** 61 | * Mandatory empty constructor for the fragment manager to instantiate the 62 | * fragment (e.g. upon screen orientation changes). 63 | */ 64 | public BroadcastIntentSnifferFragment() { 65 | } 66 | 67 | @Override 68 | public void onCreate(Bundle savedInstanceState) { 69 | super.onCreate(savedInstanceState); 70 | } 71 | } 72 | -------------------------------------------------------------------------------- /qark/exploit_apk/app/src/main/java/com/secbro/qark/intentsniffer/services/BootReceiver.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright 2015 LinkedIn Corp. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. 3 | * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 4 | * 5 | * Unless required by applicable law or agreed to in writing, software 6 | * distributed under the License is distributed on an "AS IS" BASIS, 7 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 8 | */ 9 | 10 | package com.secbro.qark.intentsniffer.services; 11 | 12 | import android.content.BroadcastReceiver; 13 | import android.content.Context; 14 | import android.content.Intent; 15 | 16 | public class BootReceiver extends BroadcastReceiver { 17 | 18 | @Override 19 | public void onReceive(Context context, Intent intent) { 20 | Intent service = new Intent(context, BroadcastStealerService.class); 21 | context.startService(service); 22 | } 23 | } -------------------------------------------------------------------------------- /qark/exploit_apk/app/src/main/java/com/secbro/qark/intentsniffer/services/BroadcastStealerService.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Copyright 2015 LinkedIn Corp. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. 3 | * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 4 | * 5 | * Unless required by applicable law or agreed to in writing, software 6 | * distributed under the License is distributed on an "AS IS" BASIS, 7 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 8 | */ 9 | 10 | package com.secbro.qark.intentsniffer.services; 11 | 12 | import android.app.IntentService; 13 | import android.app.Service; 14 | import android.content.BroadcastReceiver; 15 | import android.content.Intent; 16 | import android.content.Context; 17 | import android.content.IntentFilter; 18 | import android.content.SharedPreferences; 19 | import android.os.Bundle; 20 | import android.os.IBinder; 21 | import android.util.Log; 22 | 23 | import com.secbro.qark.R; 24 | import com.secbro.qark.TopLevelActivity; 25 | 26 | /** 27 | * An {@link IntentService} subclass for handling asynchronous task requests in 28 | * a service on a separate handler thread. 29 | *

30 | * TODO: Customize class - update intent actions, extra parameters and static 31 | * helper methods. 32 | */ 33 | public class BroadcastStealerService extends Service { 34 | 35 | private static final String LOG_TAG = BroadcastStealerService.class.getSimpleName(); 36 | private String[] intentNames = {}; 37 | 38 | 39 | private final BroadcastReceiver receiver = new BroadcastReceiver() { 40 | @Override 41 | public void onReceive(Context context, Intent intent) { 42 | String action = intent.getAction(); 43 | for(int i=0;i 7 | 8 | 14 | 15 | 21 | 22 | 27 | 28 | 29 | 30 |