2

Imagine the following scenario:

  • I want to check how secure is an Android application
  • I have access to it's source code
  • I suspect that some sensitive information is being passed via Http instead of Https in some features
  • I could intercept the traffic and see if it uses http or https (Using a tool like Burp Suite), but the application is really big it would take a long time.

So, is there some way (like a script) that I could sweep through the source code and list places where a http is being used? So I could analyze individually?

2
  • 2
    For the source code that you have access to, use grep and search for http:. Bear in mind that it is very likely that the app is made up of more code than what you have, in the form of dependencies. Some of those may be open source, others might not be. Jan 10, 2018 at 11:43
  • Which Android app? Depending on how it does Http (sometimes multiple ways), there are plenty of tricks to both static and runtime exploration, as well as automating said automation.
    – atdre
    Jan 10, 2018 at 19:59

1 Answer 1

1

I found an interesting module for the tool Drozer that meets the needs that I previously had and helped me in my task. So I decided to post an answer here if anyone is interested too.

The modules description:

Finds URLs with the HTTP or HTTPS schemes by searching the strings inside APK files. You can, for instance, use this for finding API servers, C&C servers within malicious APKs and checking for presence of advertising networks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .