After analyzing source code manually, automated tools allow the tester to focus on the more complicated
business logic for efficient static analysis.
There are several open source tools for automated security analysis of an epic.
We'll use my BSF for this purpose, Samaa BSF is a powerful security assessment framework.
It's capable of performing static and dynamic analysis.
So why don't we, uh, why don't we get started?
All right, so just open up a terminal screen and switch the user to route.
Change directory to mob S.F. folder.
This files.
OK, so now we need to run the run that S.H. file.
And it's running of this address now, so let's open it.
Click on the button, upload and analyze.
So, like the APK file and open it.
So right now, it's analyzing the epic file.
We can look at the info messages on the screen.
And these are the steps we follow while manually analyzing the source code, so first it unzips KPK
file and it then reads the Android manifest while checking the code signing certificate, the compiling
to Java source code.
So it may take a moment or two.
All right, so it's completed, let's have a look at the results.
So in the first section, there's information about the APK file.
Some of them are file names and sizes, Android version, package, name, main activity, etc. from
the decompiled code section, you can download any file and code format.
So when we decompiled the APK file with the bytecode viewer, there was no assembly code, so we'll
first look at the Android manifest file.
As you can see, it's in the decoded form, so we'll go back.
Click on View Source.
And we can search for basically any keyword in the source code.
So what do we search for password?
And we can see the Java files that contain the password.
Let's open one of them.
Scroll down a bit.
And here's where you can see a method where the password string is defined.
Right, so we'll go back to the scan results.
Let's look at the assembly code.
Search for password again.
Oh, you know, I.
I this this error here is due to mob S.F., but right now, this here is not really important.
So you can view the assembly code by downloading it as a zip file.
And you can download the source code here.
So let's continue with the titles.
So the signers certificate, we can check if the HBK is signed or not, and what the signature algorithm
is, you know, hash algorithms are and more.
As you can see in his description, the application is vulnerable to Janna's vulnerability because of
the signature scheme.
So what do we have a look at the permissions now?
You remember we saw these permissions in the Android manifest file.
And this table will show us the status and the risks of them.
And we'll go to the next one.
So there's no reason for binary analysis API and Brownsville activities.
So let's look at the analysis of the manifest file.
And yet again, as we saw in the manual analysis, there are dangerous options in the manifest file.
Debugger will allow backup options and exported activities that are shared with other apps.
Let's continue.
There's no result for code and file analysis.
So let's go to malware analysis.
If your kid gives you information about how an app was made.
So I can look at an Android app or X File and detect the fingerprints of several different compilers.
All right, good, let's continue.
So there's no information for these sections.
These are trackers in the application, they can collect a range of data from the user, including users,
keystrokes, location, web browsing, personal data.
And here there's a string's list under the reconnaissance section of the result.
So let's look at the hardcoded secrets.
These are the fields where it's possible to find a hard coded values.
Under the component section, you can view the lists containing application components such as activities,
services, receivers, providers, libraries, etc..
And you can also export the scan results that have the PDF format from here.
Let's download the report that way, we can look at the results later when we need to.
Say file, OK?