安全分析报告： 蚂蚁优借 v4.1.2

安全分数


安全分数 45/100

风险评级


等级

  1. A
  2. B
  3. C
  4. F

严重性分布 (%)


隐私风险

1

用户/设备跟踪器


调研结果

高危 5
中危 16
信息 2
安全 2
关注 4

高危 不安全的Web视图实现。Web视图忽略SSL证书错误并接受任何SSL证书。此应用程序易受MITM攻击 

不安全的Web视图实现。Web视图忽略SSL证书错误并接受任何SSL证书。此应用程序易受MITM攻击
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#webview-server-certificate-verification

Files:
com/mayiyoujiefsd/ui/activitys/MT10ACT.java, line(s) 244,243
com/mayiyoujiefsd/ui/activitys/MT7ACT.java, line(s) 226,225
com/mayiyoujiefsd/ui/activitys/MT9ACT.java, line(s) 360,359

高危 如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击 

如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-7

Files:
com/just/agentweb/UrlLoaderImpl.java, line(s) 70,75,5

高危 使用弱加密算法 

使用弱加密算法
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
d/s/b/c/b.java, line(s) 34,46
d/s/b/c/r.java, line(s) 41,61,93

高危 该文件是World Writable。任何应用程序都可以写入文件 

该文件是World Writable。任何应用程序都可以写入文件
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#testing-local-storage-for-sensitive-data-mstg-storage-1-and-mstg-storage-2

Files:
d/g/a/c.java, line(s) 31

高危 已启用远程WebView调试 

已启用远程WebView调试
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04c-Tampering-and-Reverse-Engineering.md#debugging-and-tracing

Files:
com/just/agentweb/AgentWebConfig.java, line(s) 60,10

中危 应用程序已启用明文网络流量 

[android:usesCleartextTraffic=true]
应用程序打算使用明文网络流量，例如明文HTTP，FTP协议，DownloadManager和MediaPlayer。针对API级别27或更低的应用程序，默认值为“true”。针对API级别28或更高的应用程序，默认值为“false”。避免使用明文流量的主要原因是缺乏机密性，真实性和防篡改保护；网络攻击者可以窃听传输的数据，并且可以在不被检测到的情况下修改它。

中危 Broadcast Receiver (com.base.commonlibrary.netstate.NetworkStateReceiver) 未被保护。 

存在一个intent-filter。
发现 Broadcast Receiver与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Broadcast Receiver是显式导出的。

中危 Broadcast Receiver (com.mayiyoujiefsd.gzd.FZGBReceiver) 未被保护。 

存在一个intent-filter。
发现 Broadcast Receiver与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Broadcast Receiver是显式导出的。

中危 Activity (com.sina.weibo.sdk.share.ShareResultActivity) 未被保护。 

存在一个intent-filter。
发现 Activity与设备上的其他应用程序共享，因此让它可以被设备上的任何其他应用程序访问。intent-filter的存在表明这个Activity是显式导出的。

中危 Service (com.google.android.gms.auth.api.signin.RevocationBoundService) 受权限保护, 但是应该检查权限的保护级别。 

Permission: com.google.android.gms.auth.api.signin.permission.REVOCATION_NOTIFICATION [android:exported=true]
发现一个 Service被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。

中危 不安全的Web视图实现。可能存在WebView任意代码执行漏洞 

不安全的Web视图实现。可能存在WebView任意代码执行漏洞
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#testing-javascript-execution-in-webviews-mstg-platform-5

Files:
com/mayiyoujiefsd/ui/activitys/MT8ACT.java, line(s) 54,56
d/o/a/i/a/f/a.java, line(s) 206,199

中危 应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据 

应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage

Files:
b/h/f/b.java, line(s) 58
b/h/j/c.java, line(s) 14,20,20
com/just/agentweb/AgentWebUtils.java, line(s) 281,364
com/mayiyoujiefsd/gzd/FZGB0Service.java, line(s) 306
d/n/b/d/a/d.java, line(s) 7
d/r/a/a/e/b.java, line(s) 127,73
d/s/b/c/d.java, line(s) 67
d/s/b/c/n.java, line(s) 176,180,194,591
d/t/a/a.java, line(s) 28,20,28
d/t/a/f.java, line(s) 32

中危 文件可能包含硬编码的敏感信息，如用户名、密码、密钥等 

文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10

Files:
d/d/a/l/d.java, line(s) 79
d/d/a/l/j/d.java, line(s) 37
d/d/a/l/j/p.java, line(s) 96
d/d/a/l/j/w.java, line(s) 83
faceverify/j.java, line(s) 38,35

中危 应用程序使用不安全的随机数生成器 

应用程序使用不安全的随机数生成器
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators

Files:
d/k/a/c/f/a/c.java, line(s) 4
d/n/b/d/a/e.java, line(s) 12
d/s/b/c/r.java, line(s) 6
d/s/b/c/s.java, line(s) 8
faceverify/e.java, line(s) 21

中危 SHA-1是已知存在哈希冲突的弱哈希 

SHA-1是已知存在哈希冲突的弱哈希
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
d/n/c/b/a.java, line(s) 47
d/s/b/b/p/b.java, line(s) 27
facadeverify/b.java, line(s) 17

中危 应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库 

应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2

Files:
d/m/a/j/d.java, line(s) 5,116,267,290
d/m/a/j/e.java, line(s) 4,5,15,16,39,40,43,44
d/s/b/b/h1.java, line(s) 5,47,48,26

中危 此应用程序可能会请求root（超级用户）权限 

此应用程序可能会请求root（超级用户）权限
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05j-Testing-Resiliency-Against-Reverse-Engineering.md#testing-root-detection-mstg-resilience-1

Files:
d/s/a/d/a/a/c.java, line(s) 61,195,313,189

中危 MD5是已知存在哈希冲突的弱哈希 

MD5是已知存在哈希冲突的弱哈希
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4

Files:
com/just/agentweb/AgentWebUtils.java, line(s) 571
d/b/a/r/e.java, line(s) 13
d/g/a/s.java, line(s) 164,182
d/h/a/m/g/a.java, line(s) 1300
d/h/a/n/i.java, line(s) 134
d/m/a/r/e.java, line(s) 182
d/r/a/a/e/d.java, line(s) 11
faceverify/d.java, line(s) 302,346
faceverify/v.java, line(s) 43,63,103,133,172,202,246

中危 应用程序创建临时文件。敏感信息永远不应该被写进临时文件 

应用程序创建临时文件。敏感信息永远不应该被写进临时文件


Files:
b/p/b.java, line(s) 99

中危 应用程序包含隐私跟踪程序 

此应用程序有多个1隐私跟踪程序。跟踪器可以跟踪设备或用户，是终端用户的隐私问题。

中危 此应用可能包含硬编码机密信息 

从应用程序中识别出以下机密确保这些不是机密或私人信息
凭证信息=> "com.amap.com.mayiyoujiefsd.mjyp.app.api.v2.apikey" : "0bsdfvdd0"
3082023f308201a8a00302010202044c46914a300d06092a864886f70d01010505003064310b30090603550406130238363110300e060355040813074265696a696e673110300e060355040713074265696a696e673110300e060355040a130754656e63656e74310c300a060355040b13035753443111300f0603550403130873616d75656c6d6f301e170d3130303732313036313835305a170d3430303731333036313835305a3064310b30090603550406130238363110300e060355040813074265696a696e673110300e060355040713074265696a696e673110300e060355040a130754656e63656e74310c300a060355040b13035753443111300f0603550403130873616d75656c6d6f30819f300d06092a864886f70d010101050003818d0030818902818100c209077044bd0d63ea00ede5b839914cabcc912a87f0f8b390877e0f7a2583f0d5933443c40431c35a4433bc4c965800141961adc44c9625b1d321385221fd097e5bdc2f44a1840d643ab59dc070cf6c4b4b4d98bed5cbb8046e0a7078ae134da107cdf2bfc9b440fe5cb2f7549b44b73202cc6f7c2c55b8cfb0d333a021f01f0203010001300d06092a864886f70d010105050003818100b007db9922774ef4ccfee81ba514a8d57c410257e7a2eba64bfa17c9e690da08106d32f637ac41fbc9f205176c71bde238c872c3ee2f8313502bee44c80288ea4ef377a6f2cdfe4d3653c145c4acfedbfbadea23b559d41980cc3cdd35d79a68240693739aabf5c5ed26148756cf88264226de394c8a24ac35b712b120d4d23a
308203773082025fa003020102020448bb959d300d06092a864886f70d01010b0500306b310b300906035504061302636e31123010060355040813094775616e67646f6e673111300f060355040713085368656e7a68656e3110300e060355040a130754656e63656e74310c300a060355040b13034d4947311530130603550403130c4d696e676875204875616e673020170d3136303532313039353730335a180f32303731303232323039353730335a306b310b300906035504061302636e31123010060355040813094775616e67646f6e673111300f060355040713085368656e7a68656e3110300e060355040a130754656e63656e74310c300a060355040b13034d4947311530130603550403130c4d696e676875204875616e6730820122300d06092a864886f70d01010105000382010f003082010a02820101008c58deabefe95f699c6322f9a75620873b490d26520c7267eb8382a91da625a5876b2bd617116eb40b371c4f88c988c1ba73052caaa9964873c94b7755c3429fca47a6677229fb2e72908d3b17df82f1ebe70447b94c1e5b0a763dad8948312180322657325306f01e423e0409ef3a59e5c0e0b9c765a2322699a2dec2d4dbe58ec15f41752516192169d9596169f5bf08eaf8aab9893240ad679e82fc92b97d2ae98b28021dc5a752f0a69437ea603c541e6753cea52dbc8e8043fe21fd5da46066c92e0714905dfad3116f35aca52b13871c57481459aa4ca255a6482ba972bd17af90d0d2c21a57ef65376bbd4ce7078e6047060640669f3867fdc69fbb750203010001a321301f301d0603551d0e0416041450fb9b6362e829797b1b29ca55e6d5e082e93ff3300d06092a864886f70d01010b050003820101004952ffbfba7c00ee9b84f44b05ec62bc2400dc769fb2e83f80395e3fbb54e44d56e16527413d144f42bf8f21fa443bc42a7a732de9d5124df906c6d728e75ca94eefc918080876bd3ce6cb5f7f2d9cc8d8e708033afc1295c7f347fb2d2098be2e4a79220e9552171d5b5f8f59cff4c6478cc41dce24cbe942305757488d37659d3265838ee54ebe44fccbd1bec93d809f950034f5ef292f20179554d22f5856c03b4d44997fcb9b3579e16a49218fce0e2e6bfe1fd4aa0ab39f548344c244c171c203baff1a730883aaf4506b6865a45c3c9aba40c6326d4152b6ce09cc058864bec1d6422e83dad9496b83fb252b4bfb30d3a6badf996099793e11f9af618d
30820253308201bca00302010202044bbb0361300d06092a864886f70d0101050500306d310e300c060355040613054368696e61310f300d06035504080c06e58c97e4baac310f300d06035504070c06e58c97e4baac310f300d060355040a0c06e885bee8aeaf311b3019060355040b0c12e697a0e7babfe4b89ae58aa1e7b3bbe7bb9f310b30090603550403130251513020170d3130303430363039343831375a180f32323834303132303039343831375a306d310e300c060355040613054368696e61310f300d06035504080c06e58c97e4baac310f300d06035504070c06e58c97e4baac310f300d060355040a0c06e885bee8aeaf311b3019060355040b0c12e697a0e7babfe4b89ae58aa1e7b3bbe7bb9f310b300906035504031302515130819f300d06092a864886f70d010101050003818d0030818902818100a15e9756216f694c5915e0b529095254367c4e64faeff07ae13488d946615a58ddc31a415f717d019edc6d30b9603d3e2a7b3de0ab7e0cf52dfee39373bc472fa997027d798d59f81d525a69ecf156e885fd1e2790924386b2230cc90e3b7adc95603ddcf4c40bdc72f22db0f216a99c371d3bf89cba6578c60699e8a0d536950203010001300d06092a864886f70d01010505000381810094a9b80e80691645dd42d6611775a855f71bcd4d77cb60a8e29404035a5e00b21bcc5d4a562482126bd91b6b0e50709377ceb9ef8c2efd12cc8b16afd9a159f350bb270b14204ff065d843832720702e28b41491fbc3a205f5f2f42526d67f17614d8a974de6487b2c866efede3b4e49a0f916baa3c1336fd2ee1b1629652049
b20292cc45269854c712
ab05c5fe1172477aa023e3046a6abbd2
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3DtFIIG5OhLgYu4lA3GAx4DAhLyag2HSd2lsr1L66hH9SdefhaknsujWnumk+yNMYlQFdDnJ1Z8A4kj6zLJYRnNLyUeU0tI9uMlPr6AGbdiaV85BoK0YXJY6pxEw3w55ooznTjMswIRyv93o8fBKWx/7mEnsrayE8VITzHroIuQIDAQAB
30820239308201a2a00302010202044c96f48f300d06092a864886f70d01010505003060310b300906035504061302434e310b300906035504081302474431123010060355040713094775616e677a686f753110300e060355040a130754656e63656e74310b3009060355040b130233473111300f0603550403130857696c736f6e57753020170d3130303932303035343334335a180f32303635303632333035343334335a3060310b300906035504061302434e310b300906035504081302474431123010060355040713094775616e677a686f753110300e060355040a130754656e63656e74310b3009060355040b130233473111300f0603550403130857696c736f6e577530819f300d06092a864886f70d010101050003818d0030818902818100b56e79dbb1185a79e52d792bb3d0bb3da8010d9b87da92ec69f7dc5ad66ab6bfdff2a6a1ed285dd2358f28b72a468be7c10a2ce30c4c27323ed4edcc936080e5bedc2cbbca0b7e879c08a631182793f44bb3ea284179b263410c298e5f6831032c9702ba4a74e2ccfc9ef857f12201451602fc8e774ac59d6398511586c83d1d0203010001300d06092a864886f70d0101050500038181002475615bb65b8d8786b890535802948840387d06b1692ff3ea47ef4c435719ba1865b81e6bfa6293ce31747c3cd6b34595b485cc1563fd90107ba5845c28b95c79138f0dec288940395bc10f92f2b69d8dc410999deb38900974ce9984b678030edfba8816582f56160d87e38641288d8588d2a31e20b89f223d788dd35cc9c8
16dac3c707f44fe4be3c879b41440568
308202eb30820254a00302010202044d36f7a4300d06092a864886f70d01010505003081b9310b300906035504061302383631123010060355040813094775616e67646f6e673111300f060355040713085368656e7a68656e31353033060355040a132c54656e63656e7420546563686e6f6c6f6779285368656e7a68656e2920436f6d70616e79204c696d69746564313a3038060355040b133154656e63656e74204775616e677a686f7520526573656172636820616e6420446576656c6f706d656e742043656e7465723110300e0603550403130754656e63656e74301e170d3131303131393134333933325a170d3431303131313134333933325a3081b9310b300906035504061302383631123010060355040813094775616e67646f6e673111300f060355040713085368656e7a68656e31353033060355040a132c54656e63656e7420546563686e6f6c6f6779285368656e7a68656e2920436f6d70616e79204c696d69746564313a3038060355040b133154656e63656e74204775616e677a686f7520526573656172636820616e6420446576656c6f706d656e742043656e7465723110300e0603550403130754656e63656e7430819f300d06092a864886f70d010101050003818d0030818902818100c05f34b231b083fb1323670bfbe7bdab40c0c0a6efc87ef2072a1ff0d60cc67c8edb0d0847f210bea6cbfaa241be70c86daf56be08b723c859e52428a064555d80db448cdcacc1aea2501eba06f8bad12a4fa49d85cacd7abeb68945a5cb5e061629b52e3254c373550ee4e40cb7c8ae6f7a8151ccd8df582d446f39ae0c5e930203010001300d06092a864886f70d0101050500038181009c8d9d7f2f908c42081b4c764c377109a8b2c70582422125ce545842d5f520aea69550b6bd8bfd94e987b75a3077eb04ad341f481aac266e89d3864456e69fba13df018acdc168b9a19dfd7ad9d9cc6f6ace57c746515f71234df3a053e33ba93ece5cd0fc15f3e389a3f365588a9fcb439e069d3629cd7732a13fff7b891499
fd4ddd72c85fd5fe2913be520df32ed0
f4qgkb85q4pMRMChLeC7uSn2wwTWGXrs
09ce2f7bfb9243debf2c2efe05a1d047
308202ad30820216a00302010202044c26cea2300d06092a864886f70d010105050030819a310b3009060355040613023836311530130603550408130c4265696a696e672043697479311530130603550407130c4265696a696e67204369747931263024060355040a131d515a6f6e65205465616d206f662054656e63656e7420436f6d70616e7931183016060355040b130f54656e63656e7420436f6d70616e79311b301906035504031312416e64726f696420515a6f6e65205465616d301e170d3130303632373034303830325a170d3335303632313034303830325a30819a310b3009060355040613023836311530130603550408130c4265696a696e672043697479311530130603550407130c4265696a696e67204369747931263024060355040a131d515a6f6e65205465616d206f662054656e63656e7420436f6d70616e7931183016060355040b130f54656e63656e7420436f6d70616e79311b301906035504031312416e64726f696420515a6f6e65205465616d30819f300d06092a864886f70d010101050003818d003081890281810082d6aca037a9843fbbe88b6dd19f36e9c24ce174c1b398f3a529e2a7fe02de99c27539602c026edf96ad8d43df32a85458bca1e6fbf11958658a7d6751a1d9b782bf43a8c19bd1c06bdbfd94c0516326ae3cf638ac42bb470580e340c46e6f306a772c1ef98f10a559edf867f3f31fe492808776b7bd953b2cba2d2b2d66a44f0203010001300d06092a864886f70d0101050500038181006003b04a8a8c5be9650f350cda6896e57dd13e6e83e7f891fc70f6a3c2eaf75cfa4fc998365deabbd1b9092159edf4b90df5702a0d101f8840b5d4586eb92a1c3cd19d95fbc1c2ac956309eda8eef3944baf08c4a49d3b9b3ffb06bc13dab94ecb5b8eb74e8789aa0ba21cb567f538bbc59c2a11e6919924a24272eb79251677
MCwwDQYJKoZIhvcNAQEBBQADGwAwGAIRAMRB/Q0hTCD+XtnQhpQJefUCAwEAAQ==
7504f3f0-aca8-4636-b486-e396559d3efb

信息 应用程序记录日志信息,不得记录敏感信息 

应用程序记录日志信息,不得记录敏感信息
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs

Files:
b/b/k/e.java, line(s) 1791,956,962,1425,1818,2026
b/b/k/g.java, line(s) 100
b/b/k/h.java, line(s) 49,59,74,84,101,113,125,134,147,161,173
b/b/k/j.java, line(s) 63,78
b/b/l/a/a.java, line(s) 101
b/b/p/g.java, line(s) 158,204,261
b/b/p/j/i.java, line(s) 398
b/b/p/j/j.java, line(s) 277
b/b/q/b0.java, line(s) 99,137,360,119,172,227,241,294,297,364,367,420
b/b/q/c0.java, line(s) 32
b/b/q/i0.java, line(s) 323,328
b/b/q/k0.java, line(s) 112
b/b/q/l0.java, line(s) 83
b/b/q/n0.java, line(s) 24,35,53,55,57
b/b/q/o.java, line(s) 104,118,132,141,277,451
b/b/q/r.java, line(s) 146
b/b/q/w.java, line(s) 110,144
b/b/q/x.java, line(s) 162,48,60,106,359
b/f/a/a/c.java, line(s) 137
b/f/a/b/a.java, line(s) 46
b/f/a/b/d.java, line(s) 82
b/f/a/b/f.java, line(s) 162,315,367
b/f/a/b/g.java, line(s) 202,204
b/f/a/b/h.java, line(s) 32,57
b/f/a/b/i.java, line(s) 115,120
b/f/a/b/k.java, line(s) 84
b/f/a/b/l.java, line(s) 116
b/f/a/b/m.java, line(s) 188,192,196
b/f/a/b/n.java, line(s) 416
b/f/a/b/q.java, line(s) 401,410,611,658,850,888,215,232,134,256,601,602,647
b/f/a/b/r.java, line(s) 140,142
b/f/a/b/s.java, line(s) 176,178,517
b/f/a/b/t.java, line(s) 354
b/f/b/d.java, line(s) 404
b/f/b/j/d.java, line(s) 302
b/f/c/a.java, line(s) 219,119,196,268
b/f/c/b.java, line(s) 608,1625,985,1086,623,629,1020,1666,1669
b/f/c/f.java, line(s) 100,206
b/h/e/c.java, line(s) 90,235
b/h/e/f.java, line(s) 27
b/h/e/j.java, line(s) 62,76,80
b/h/e/m.java, line(s) 62
b/h/f/d/a.java, line(s) 42
b/h/f/d/b.java, line(s) 74
b/h/f/d/f.java, line(s) 85,93
b/h/g/c.java, line(s) 509,514
b/h/g/e.java, line(s) 70
b/h/g/f.java, line(s) 40,71
b/h/g/g.java, line(s) 56,222
b/h/g/j.java, line(s) 82,85
b/h/g/k.java, line(s) 92
b/h/g/l/a.java, line(s) 97,106,164,174
b/h/g/l/e.java, line(s) 40,63
b/h/j/c.java, line(s) 22
b/h/j/h.java, line(s) 20
b/h/l/b.java, line(s) 38,49,51,62,64,84,87
b/h/m/b.java, line(s) 24
b/h/n/b.java, line(s) 62
b/h/n/b0.java, line(s) 274,286,293,302
b/h/n/c0/c.java, line(s) 145
b/h/n/f.java, line(s) 21,30
b/h/n/h.java, line(s) 14
b/h/n/t.java, line(s) 606
b/h/n/u.java, line(s) 22,33
b/h/n/w.java, line(s) 20,35,56,83,104,125,146
b/h/o/c.java, line(s) 27,36
b/h/o/h.java, line(s) 34,43
b/h/o/i.java, line(s) 290,281
b/j/b/c.java, line(s) 150
b/k/a/a.java, line(s) 480,741,1059,444,452,511,518,602,722,726
b/l/a/a.java, line(s) 107,177,186,198
b/l/a/b.java, line(s) 109
b/l/a/d.java, line(s) 239,247,267,375,383
b/l/a/j.java, line(s) 2172,2173,2181,2189,459,467,526,733,776,862,1368,1452,1455,1531,1547,1577,1596,1616,1718,1725,1741,1753,1894,1904,1910,2011,2048,2126,2197,2200,2209,2219,2387,2398,2456
b/l/a/l.java, line(s) 45,56
b/l/a/m.java, line(s) 97
b/o/a/b.java, line(s) 50,65,73,97,195,214,320,326,348,57
b/p/a.java, line(s) 325,364,415,417,200,207,209,215,347,349,358,361,404,113,144,203,211,218,229,238,250,310,328
b/p/b.java, line(s) 57,67,69,100,116,183,185,195,207,211,213,218,223,265,287,93,179,187,203,275,291,306
b/t/f0.java, line(s) 35,44,46
b/t/h.java, line(s) 54,66,81
b/t/p0.java, line(s) 39,117
b/u/a/a/i.java, line(s) 262,265
com/contrarywind/view/WheelView.java, line(s) 349
com/cyl/musicapi/dsbridge/DWebView.java, line(s) 63
com/just/agentweb/AgentWebUtils.java, line(s) 146,119,120,126,139
com/just/agentweb/AgentWebView.java, line(s) 60,88,98,280,42,268,272
com/just/agentweb/DefaultChromeClient.java, line(s) 260,266
com/just/agentweb/JsCallJava.java, line(s) 133,66,42,81
com/just/agentweb/JsCallback.java, line(s) 69
com/just/agentweb/LogUtils.java, line(s) 10,26,39,16,34
com/liaoinstan/springview/widget/SpringHelper.java, line(s) 32
com/mayiyoujiefsd/gzd/FZGBReceiver.java, line(s) 38,41,47,49,52,58
com/mayiyoujiefsd/ui/activitys/MT10ACT.java, line(s) 258,272
com/mayiyoujiefsd/ui/activitys/MT7ACT.java, line(s) 233,255,242,257
com/mayiyoujiefsd/ui/activitys/MT8ACT.java, line(s) 28
com/mayiyoujiefsd/ui/activitys/MT9ACT.java, line(s) 143,149,367,371,388
com/mayiyoujiefsd/ui/activitys/W0ACT.java, line(s) 1256,1296
com/wildma/pictureselector/PictureSelectActivity.java, line(s) 115,118
d/b/a/r/d.java, line(s) 18,29,46
d/d/a/c.java, line(s) 278,287,236,277,284,239
d/d/a/j/a.java, line(s) 291
d/d/a/k/d.java, line(s) 94,122,93,121
d/d/a/k/e.java, line(s) 64,80,97,63,79,96
d/d/a/l/i/b.java, line(s) 56,55
d/d/a/l/i/j.java, line(s) 82,108,81,107,111,117,124,121,125
d/d/a/l/i/l.java, line(s) 57,56
d/d/a/l/i/p/c.java, line(s) 107,106
d/d/a/l/i/p/e.java, line(s) 56,55
d/d/a/l/j/a0/e.java, line(s) 37,43,71,81,38,72,44,84
d/d/a/l/j/a0/i.java, line(s) 122,106
d/d/a/l/j/b0/a.java, line(s) 124,121
d/d/a/l/j/b0/b.java, line(s) 39,38
d/d/a/l/j/h.java, line(s) 518,339,353,517,462
d/d/a/l/j/i.java, line(s) 58,59
d/d/a/l/j/k.java, line(s) 16,162
d/d/a/l/j/y.java, line(s) 85,86
d/d/a/l/j/z/j.java, line(s) 159,199,160,200
d/d/a/l/j/z/k.java, line(s) 104,116,188,223,103,115,146,153,169,187,197,212,222,147,154,175,198,213
d/d/a/l/k/c.java, line(s) 16,15
d/d/a/l/k/d.java, line(s) 46,45
d/d/a/l/k/f.java, line(s) 103,102
d/d/a/l/k/s.java, line(s) 91,94
d/d/a/l/k/t.java, line(s) 37,36
d/d/a/l/l/a.java, line(s) 80,81
d/d/a/l/l/d/d.java, line(s) 14,15
d/d/a/l/l/d/k.java, line(s) 104,317,103,183,316,394,419,184,249,395
d/d/a/l/l/d/l.java, line(s) 41,47,42,48
d/d/a/l/l/d/p.java, line(s) 78,79
d/d/a/l/l/d/x.java, line(s) 107,112,124,133,140,108,113,125,134,141,142,143,147
d/d/a/l/l/d/z.java, line(s) 167,164
d/d/a/l/l/h/a.java, line(s) 63,83,88,93,64,84,89,94
d/d/a/l/l/h/d.java, line(s) 21,22
d/d/a/l/l/h/j.java, line(s) 39,42
d/d/a/m/e.java, line(s) 36,35,62,78,63,79
d/d/a/m/f.java, line(s) 12,11
d/d/a/m/k.java, line(s) 155,156,167
d/d/a/m/m.java, line(s) 92,93
d/d/a/m/n.java, line(s) 137,144,138,145
d/d/a/n/e.java, line(s) 53,60,71,76,52,59,64,70,75,65
d/d/a/p/g.java, line(s) 110,17,432,456
d/d/a/p/i/i.java, line(s) 55,137,138,56
d/d/a/q/b.java, line(s) 19
d/d/a/r/l/a.java, line(s) 63,64
d/g/a/i.java, line(s) 308
d/g/a/s.java, line(s) 154,149
d/h/a/m/g/a.java, line(s) 1234,1235,1236,1237
d/i/g/a.java, line(s) 45,54
d/i/g/b.java, line(s) 49,21
d/i/g/c.java, line(s) 38,54,57,59,65,74
d/i/g/m.java, line(s) 219,254,51,75,215,223,226,246,263,275,280,295,300
d/k/a/a/d/c.java, line(s) 138
d/k/a/c/a/a/e/c/g.java, line(s) 30
d/k/a/c/c/a0.java, line(s) 24
d/k/a/c/c/c.java, line(s) 113,159,166
d/k/a/c/c/f.java, line(s) 78,65,97,109,119,133,136,138,142
d/k/a/c/c/g.java, line(s) 35,67
d/k/a/c/c/j/l/d1.java, line(s) 23,38
d/k/a/c/c/j/l/e0.java, line(s) 120,446
d/k/a/c/c/j/l/f.java, line(s) 258,374
d/k/a/c/c/j/l/h0.java, line(s) 49
d/k/a/c/c/j/l/i0.java, line(s) 38
d/k/a/c/c/j/l/w0.java, line(s) 51
d/k/a/c/c/k/a.java, line(s) 18
d/k/a/c/c/k/c.java, line(s) 339,286,290,294,300,365
d/k/a/c/c/k/c0.java, line(s) 95,98,101,104,107,110,121,124,127,130,161,166
d/k/a/c/c/k/c1.java, line(s) 105
d/k/a/c/c/k/d1.java, line(s) 33
d/k/a/c/c/k/e1.java, line(s) 36
d/k/a/c/c/k/f0.java, line(s) 26
d/k/a/c/c/k/g1.java, line(s) 45,63
d/k/a/c/c/k/m1.java, line(s) 53,59
d/k/a/c/c/k/p1.java, line(s) 55
d/k/a/c/c/k/z0.java, line(s) 31
d/k/a/c/c/l/a.java, line(s) 43,48,35
d/k/a/c/c/m/a.java, line(s) 76,87
d/k/a/c/c/n/f.java, line(s) 17,16
d/k/a/c/c/p.java, line(s) 29
d/k/a/c/c/w.java, line(s) 44
d/k/a/c/g/b/a.java, line(s) 71,75
d/k/a/d/d0/a.java, line(s) 559
d/k/a/d/f0/d.java, line(s) 142,174
d/k/a/d/g0/b.java, line(s) 83
d/k/a/d/i0/h.java, line(s) 524
d/k/a/d/m/h.java, line(s) 52
d/n/a/a.java, line(s) 105,54,39
d/n/b/d/d/a.java, line(s) 37
d/o/a/i/b/d/c/a.java, line(s) 40
d/q/a/a/a.java, line(s) 11,18,22,24,26
d/r/a/a/e/c.java, line(s) 12,19
d/s/a/c/d/a.java, line(s) 51
d/s/a/c/d/d.java, line(s) 48
d/s/a/c/g/a.java, line(s) 107,112,117,138,121,144,154,157,92,150
d/s/a/c/g/b.java, line(s) 36
d/s/a/e/g.java, line(s) 25,33,21,39,29
d/s/b/a/a/a.java, line(s) 42,44
d/s/b/a/a/b.java, line(s) 50,52
d/s/b/a/a/c.java, line(s) 74,78
d/s/b/a/a/e.java, line(s) 87,103,106,115,126
d/s/b/c/b.java, line(s) 38,50
d/s/b/c/u.java, line(s) 48
d/u/a/b.java, line(s) 7,11
g/a.java, line(s) 12
g/b.java, line(s) 12
l/a/a/f.java, line(s) 25,30
m/n/d/e.java, line(s) 24
m/q/c.java, line(s) 234
n/a/a/a/a/e/a.java, line(s) 7,11,15

信息 此应用程序将数据复制到剪贴板。敏感数据不应复制到剪贴板，因为其他应用程序可以访问它 

此应用程序将数据复制到剪贴板。敏感数据不应复制到剪贴板，因为其他应用程序可以访问它
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x04b-Mobile-App-Security-Testing.md#clipboard

Files:
com/mayiyoujiefsd/ui/activitys/N0ACT.java, line(s) 4,164

安全 此应用程序可能具有Root检测功能 

此应用程序可能具有Root检测功能
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05j-Testing-Resiliency-Against-Reverse-Engineering.md#testing-root-detection-mstg-resilience-1

Files:
d/s/a/d/a/a/c.java, line(s) 361,27,27,27,27,27

安全 此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击 

此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击
https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-4

Files:
d/n/b/d/a/a.java, line(s) 67,76,67,76
d/n/b/d/a/b.java, line(s) 108,117,108,117

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (nice800.com) 通信。 

{'ip': '43.132.110.135', 'country_short': 'HK', 'country_long': '中国', 'region': '香港', 'city': '香港', 'latitude': '22.285521', 'longitude': '114.157692'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (service.weibo.com) 通信。 

{'ip': '49.7.37.75', 'country_short': 'CN', 'country_long': '中国', 'region': '北京', 'city': '北京', 'latitude': '39.907501', 'longitude': '116.397102'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (ijljlkjzxcv-1324028813.cos.ap-guangzhou.myqcloud.com) 通信。 

{'ip': '27.155.119.180', 'country_short': 'CN', 'country_long': '中国', 'region': '福建', 'city': '福州', 'latitude': '26.061390', 'longitude': '119.306107'}

关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (jzlwjfanjzxcv.s3.ap-east-1.amazonaws.com) 通信。 

{'ip': '3.5.237.170', 'country_short': 'HK', 'country_long': '中国', 'region': '香港', 'city': '香港', 'latitude': '22.285521', 'longitude': '114.157692'}

安全评分: ( 蚂蚁优借 4.1.2)