def scan(filenames):
"""Scan the provided files for vulnerabilities"""
for filename in filenames:
click.echo('\nProcessing file: ' + filename)
# Try to open the provided file as a ZIP, fail otherwise
zip_file = TruegazeUtils.open_file_as_zip(filename)
if zip_file is None:
click.echo(
'ERROR: Unable to open file - please check to make sure it is an APK or IPA file'
)
sys.exit(-1)
# Detect manifest
is_android = False
is_ios = False
android_manifest = TruegazeUtils.get_android_manifest(zip_file)
ios_manifest = TruegazeUtils.get_ios_manifest(zip_file)
# Set flags, error out if no manifest is found
if android_manifest:
click.echo(
'Identified as an Android application via a manifest located at: '
+ android_manifest)
is_android = True
elif ios_manifest:
click.echo(
'Identified as an iOS application via a manifest located at: '
+ ios_manifest)
is_ios = True
else:
click.echo(
'ERROR: Unable to identify the file as an Android or iOS application'
)
sys.exit(-2)
# Pass the filename to the individual modules for scanning
for PLUGIN in ACTIVE_PLUGINS:
click.echo()
click.echo('Scanning using the "' + PLUGIN.name + '" plugin')
instance = PLUGIN(filename, is_android, is_ios)
# Show error if OS is not supported
# TODO: Add tests
if instance.is_os_supported():
instance.scan()
else:
click.echo('-- OS is not supported by this plugin, skipping')
click.echo("Done!")
def test_manifest_with_some_keys3(self):
buffer = io.BytesIO()
plistlib.dump(dict(CFBundleShortVersionString='some app'), buffer)
zip_file = ZipFile(io.BytesIO(), 'a')
zip_file.writestr('Payload/Test.app/Info.plist', buffer.getvalue())
assert TruegazeUtils.get_ios_manifest(zip_file) is None
def test_valid(self):
zip_file = ZipFile(io.BytesIO(), 'a')
zip_file.writestr('Payload/Test.app/Info.plist',
TestUtilsGetiOSManifest.make_ios_manifest())
assert TruegazeUtils.get_ios_manifest(
zip_file) == 'Payload/Test.app/Info.plist'
def test_manifest_with_no_keys(self):
buffer = io.BytesIO()
plistlib.dump({}, buffer)
zip_file = ZipFile(io.BytesIO(), 'a')
zip_file.writestr('Payload/Test.app/Info.plist', buffer.getvalue())
assert TruegazeUtils.get_ios_manifest(zip_file) is None
def test_junk_manifest(self):
zip_file = ZipFile(io.BytesIO(), 'a')
zip_file.writestr('Payload/Test.app/Info.plist', '<junk></junk>')
assert TruegazeUtils.get_ios_manifest(zip_file) is None
def test_wrong_directory3(self):
zip_file = ZipFile(io.BytesIO(), 'a')
zip_file.writestr('Payload/Testapp/Info.plist',
TestUtilsGetiOSManifest.make_ios_manifest())
assert TruegazeUtils.get_ios_manifest(zip_file) is None
def test_not_empty(self):
zip_file = ZipFile(io.BytesIO(), 'a')
zip_file.writestr("test", 'testdata')
assert TruegazeUtils.get_ios_manifest(zip_file) is None
def test_empty(self):
zip_file = ZipFile(io.BytesIO(), 'a')
assert TruegazeUtils.get_ios_manifest(zip_file) is None
