base on Android security insights in full spectrum. # <div align="center">APKDeepLens</div> <div align="center"> <a href="https://github.com/d78ui98/APKDeepLens/tree/master#features">Features</a> • <a href="https://github.com/d78ui98/APKDeepLens/tree/master#installation">Installation</a> • <a href="https://github.com/d78ui98/APKDeepLens/blob/master/CHANGELOG.md">Changlog</a> </div> <p> APKDeepLens is a Python based tool designed to scan Android applications (APK files) for security vulnerabilities. It specifically targets the OWASP Top 10 mobile vulnerabilities, providing an easy and efficient way for developers, penetration testers, and security researchers to assess the security posture of Android apps.  ## Features APKDeepLens is a Python-based tool that performs various operations on APK files. Its main features include: - **APK Analysis** -> Scans Android application package (APK) files for security vulnerabilities. - **OWASP Coverage** -> Covers OWASP Top 10 vulnerabilities to ensure a comprehensive security assessment. - **Advanced Detection** -> Utilizes custom python code for APK file analysis and vulnerability detection. - **Sensitive Information Extraction** -> Identifies potential security risks by extracting sensitive information from APK files, such as insecure authentication/authorization keys and insecure request protocols. - **In-depth Analysis** -> Detects insecure data storage practices, including data related to the SD card, and highlights the use of insecure request protocols in the code. - **Intent Filter Exploits** -> Pinpoint vulnerabilities by analyzing intent filters extracted from AndroidManifest.xml. - **Local File Vulnerability Detection** -> Safeguard your app by identifying potential mishandlings related to local file operations - **Report Generation** -> Generates detailed and easy-to-understand reports for each scanned APK, providing actionable insights for developers. - **CI/CD Integration** -> Designed for easy integration into CI/CD pipelines, enabling automated security testing in development workflows. - **User-Friendly Interface** -> Color-coded terminal outputs make it easy to distinguish between different types of findings. ## Installation To use APKDeepLens, make sure you have Python 3.10 (recommended) or higher installed, along with Java or OpenJDK. Once those are set up, you can install APKDeepLens by running the following command: ### For Linux ``` git clone https://github.com/d78ui98/APKDeepLens.git cd /APKDeepLens python3 -m venv venv source venv/bin/activate pip install -r requirements.txt python APKDeepLens.py --help ``` ### For Windows ``` git clone https://github.com/d78ui98/APKDeepLens.git cd \APKDeepLens python3 -m venv venv .\venv\Scripts\activate pip install -r .\requirements.txt python APKDeepLens.py --help ``` ## Usage To simply scan an APK, use the below command. Mention the apk file with `-apk` argument. Once the scan is complete, a detailed report will be displayed in the console. ``` python3 APKDeepLens.py -apk file.apk ``` If you've already extracted the source code and want to provide its path for a faster scan you can use the below command. Mention the source code of the android application with `-source` parameter. ``` python3 APKDeepLens.py -apk file.apk -source <source-code-path> ``` To generate detailed PDF and HTML reports after the scan you can pass `-report` argument as mentioned below. ``` python3 APKDeepLens.py -apk file.apk -report ``` ## Contributing We welcome contributions to the APKDeepLens project. If you have a feature request, bug report, or proposal, please open a new issue [here](https://github.com/d78ui98/APKDeepLens/issues). For those interested in contributing code, please follow the standard GitHub process. We'll review your contributions as quickly as possible :) ## Featured at - Blackhat MEA 2023 - https://blackhatmea.com/session/apkaleidoscope-android-security-insights-full-spectrum-0 - Blackhat ASIA 2024 - https://www.blackhat.com/asia-24/arsenal/schedule/index.html#apkdeeplens---android-security-insights-in-full-spectrum-37182 ", Assign "at most 3 tags" to the expected json: {"id":"8517","tags":[]} "only from the tags list I provide: [{"id":77,"name":"3d"},{"id":89,"name":"agent"},{"id":17,"name":"ai"},{"id":54,"name":"algorithm"},{"id":24,"name":"api"},{"id":44,"name":"authentication"},{"id":3,"name":"aws"},{"id":27,"name":"backend"},{"id":60,"name":"benchmark"},{"id":72,"name":"best-practices"},{"id":39,"name":"bitcoin"},{"id":37,"name":"blockchain"},{"id":1,"name":"blog"},{"id":45,"name":"bundler"},{"id":58,"name":"cache"},{"id":21,"name":"chat"},{"id":49,"name":"cicd"},{"id":4,"name":"cli"},{"id":64,"name":"cloud-native"},{"id":48,"name":"cms"},{"id":61,"name":"compiler"},{"id":68,"name":"containerization"},{"id":92,"name":"crm"},{"id":34,"name":"data"},{"id":47,"name":"database"},{"id":8,"name":"declarative-gui "},{"id":9,"name":"deploy-tool"},{"id":53,"name":"desktop-app"},{"id":6,"name":"dev-exp-lib"},{"id":59,"name":"dev-tool"},{"id":13,"name":"ecommerce"},{"id":26,"name":"editor"},{"id":66,"name":"emulator"},{"id":62,"name":"filesystem"},{"id":80,"name":"finance"},{"id":15,"name":"firmware"},{"id":73,"name":"for-fun"},{"id":2,"name":"framework"},{"id":11,"name":"frontend"},{"id":22,"name":"game"},{"id":81,"name":"game-engine "},{"id":23,"name":"graphql"},{"id":84,"name":"gui"},{"id":91,"name":"http"},{"id":5,"name":"http-client"},{"id":51,"name":"iac"},{"id":30,"name":"ide"},{"id":78,"name":"iot"},{"id":40,"name":"json"},{"id":83,"name":"julian"},{"id":38,"name":"k8s"},{"id":31,"name":"language"},{"id":10,"name":"learning-resource"},{"id":33,"name":"lib"},{"id":41,"name":"linter"},{"id":28,"name":"lms"},{"id":16,"name":"logging"},{"id":76,"name":"low-code"},{"id":90,"name":"message-queue"},{"id":42,"name":"mobile-app"},{"id":18,"name":"monitoring"},{"id":36,"name":"networking"},{"id":7,"name":"node-version"},{"id":55,"name":"nosql"},{"id":57,"name":"observability"},{"id":46,"name":"orm"},{"id":52,"name":"os"},{"id":14,"name":"parser"},{"id":74,"name":"react"},{"id":82,"name":"real-time"},{"id":56,"name":"robot"},{"id":65,"name":"runtime"},{"id":32,"name":"sdk"},{"id":71,"name":"search"},{"id":63,"name":"secrets"},{"id":25,"name":"security"},{"id":85,"name":"server"},{"id":86,"name":"serverless"},{"id":70,"name":"storage"},{"id":75,"name":"system-design"},{"id":79,"name":"terminal"},{"id":29,"name":"testing"},{"id":12,"name":"ui"},{"id":50,"name":"ux"},{"id":88,"name":"video"},{"id":20,"name":"web-app"},{"id":35,"name":"web-server"},{"id":43,"name":"webassembly"},{"id":69,"name":"workflow"},{"id":87,"name":"yaml"}]" returns me the "expected json"