安全分析报告：
安全分数
安全分数 42/100
风险评级
等级
- A
- B
- C
- F
严重性分布 (%)
隐私风险
2
用户/设备跟踪器
调研结果
高危
6
中危
12
信息
1
安全
2
关注
2
高危 基本配置不安全地配置为允许到所有域的明文流量。
Scope: *
高危 该文件是World Writable。任何应用程序都可以写入文件
该文件是World Writable。任何应用程序都可以写入文件 https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#testing-local-storage-for-sensitive-data-mstg-storage-1-and-mstg-storage-2 Files: com/appsflyer/AppsFlyerLibCore.java, line(s) 2022 com/appsflyer/internal/EventDataCollector.java, line(s) 52 com/appsflyer/internal/referrer/GoogleReferrer.java, line(s) 20 f/g/a/d/h/f/k2.java, line(s) 65
高危 WebView域控制不严格漏洞
WebView域控制不严格漏洞 Files: com/just/agentweb/AbsAgentWebSettings.java, line(s) 46,21 f/a/a/h/b.java, line(s) 41,39
高危 如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击
如果一个应用程序使用WebView.loadDataWithBaseURL方法来加载一个网页到WebView，那么这个应用程序可能会遭受跨站脚本攻击 https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-7 Files: com/just/agentweb/UrlLoaderImpl.java, line(s) 76,80,5
高危 不安全的Web视图实现。Web视图忽略SSL证书错误并接受任何SSL证书。此应用程序易受MITM攻击
不安全的Web视图实现。Web视图忽略SSL证书错误并接受任何SSL证书。此应用程序易受MITM攻击 https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#webview-server-certificate-verification Files: com/ai100/cash/activity/A100WebViewAct.java, line(s) 191,228
高危 已启用远程WebView调试
已启用远程WebView调试 https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04c-Tampering-and-Reverse-Engineering.md#debugging-and-tracing Files: com/just/agentweb/AgentWebConfig.java, line(s) 61,10
中危 应用程序数据可以被备份
[android:allowBackup=true] 这个标志允许任何人通过adb备份你的应用程序数据。它允许已经启用了USB调试的用户从设备上复制应用程序数据。
中危 Broadcast Receiver (com.google.firebase.iid.FirebaseInstanceIdReceiver) 受权限保护, 但是应该检查权限的保护级别。
Permission: com.google.android.c2dm.permission.SEND [android:exported=true] 发现一个 Broadcast Receiver被共享给了设备上的其他应用程序，因此让它可以被设备上的任何其他应用程序访问。它受到一个在分析的应用程序中没有定义的权限的保护。因此，应该在定义它的地方检查权限的保护级别。如果它被设置为普通或危险，一个恶意应用程序可以请求并获得这个权限，并与该组件交互。如果它被设置为签名，只有使用相同证书签名的应用程序才能获得这个权限。
中危 应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据
应用程序可以读取/写入外部存储器，任何应用程序都可以读取写入外部存储器的数据 https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage Files: com/ai100/cash/activity/A100WebViewAct.java, line(s) 134 com/just/agentweb/AgentWebUtils.java, line(s) 302,379 com/yalantis/ucrop/PictureMultiCuttingActivity.java, line(s) 93,157 com/yanzhenjie/permission/FileProvider.java, line(s) 321,178 f/a/b/g/g.java, line(s) 348,405,439 f/a/b/g/i.java, line(s) 32 f/a/b/g/p.java, line(s) 235 f/a/b/g/y/c/a.java, line(s) 82,95,105 f/a/b/g/y/f/c.java, line(s) 12 f/a/b/g/y/f/d.java, line(s) 890 f/a/b/g/y/f/e.java, line(s) 33,66,83,91 f/b/a/a/c.java, line(s) 91 f/b/a/a/d.java, line(s) 95 f/l/a/g/e.java, line(s) 101 f/m/a/h/t.java, line(s) 11,14 f/m/a/h/u.java, line(s) 11,14
中危 应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库
应用程序使用SQLite数据库并执行原始SQL查询。原始SQL查询中不受信任的用户输入可能会导致SQL注入。敏感信息也应加密并写入数据库 https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2 Files: f/g/a/b/m/y/k/a0.java, line(s) 5,6,81 f/g/a/b/m/y/k/e0.java, line(s) 3,15 f/g/a/b/m/y/k/f0.java, line(s) 4,5,70 f/g/a/d/i/b/e.java, line(s) 5,6,68 f/g/a/d/i/b/i.java, line(s) 4,5,21 f/g/a/d/i/b/na.java, line(s) 3,51 f/g/a/d/i/b/t9.java, line(s) 8,9,1605 f/g/a/d/i/b/y3.java, line(s) 6,7,8,9,86
中危 应用程序使用不安全的随机数生成器
应用程序使用不安全的随机数生成器 https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators Files: com/ai100/cash/firebasepush/A100FirebaseMessagingService.java, line(s) 22 com/appsflyer/internal/e.java, line(s) 15 f/g/a/d/h/f/g.java, line(s) 24 f/g/a/d/i/b/ea.java, line(s) 45 j/b3/a.java, line(s) 4 j/b3/b.java, line(s) 5 j/b3/c.java, line(s) 4 j/b3/d.java, line(s) 4 j/b3/e.java, line(s) 6 j/b3/j/a.java, line(s) 4 j/o2/b0.java, line(s) 6 j/o2/w.java, line(s) 10 k/b0.java, line(s) 13 k/l0/r/e.java, line(s) 17 k/l0/r/i.java, line(s) 6
中危 文件可能包含硬编码的敏感信息，如用户名、密码、密钥等
文件可能包含硬编码的敏感信息，如用户名、密码、密钥等 https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10 Files: com/appsflyer/AppsFlyerProperties.java, line(s) 14 com/appsflyer/CreateOneLinkHttpTask.java, line(s) 18,19 com/appsflyer/internal/Exlytics.java, line(s) 9 com/appsflyer/internal/attribution/RequestErrorMessage.java, line(s) 5 f/e/a/r/i.java, line(s) 63 f/e/a/r/o/d.java, line(s) 36 f/e/a/r/o/p.java, line(s) 97 f/e/a/r/o/x.java, line(s) 74
中危 应用程序创建临时文件。敏感信息永远不应该被写进临时文件
应用程序创建临时文件。敏感信息永远不应该被写进临时文件 Files: f/g/d/x/t/c.java, line(s) 88 j/v2/r.java, line(s) 249,261,262
中危 SHA-1是已知存在哈希冲突的弱哈希
SHA-1是已知存在哈希冲突的弱哈希 https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4 Files: com/appsflyer/internal/ac.java, line(s) 21 f/g/d/v/h0.java, line(s) 119 f/g/d/v/t.java, line(s) 117 f/g/d/x/t/b.java, line(s) 150
中危 MD5是已知存在哈希冲突的弱哈希
MD5是已知存在哈希冲突的弱哈希 https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4 Files: c/a/d/d.java, line(s) 74 com/appsflyer/internal/ac.java, line(s) 36 com/just/agentweb/AgentWebUtils.java, line(s) 587 f/g/a/d/i/b/ea.java, line(s) 129
中危 IP地址泄露
IP地址泄露 Files: f/a/c/a.java, line(s) 24
中危 应用程序包含隐私跟踪程序
此应用程序有多个2隐私跟踪程序。跟踪器可以跟踪设备或用户，是终端用户的隐私问题。
中危 此应用可能包含硬编码机密信息
从应用程序中识别出以下机密确保这些不是机密或私人信息 "google_api_key" : "AIzaSyD9X82PNcn-zGsZYwDyTX32hwi4QtXKM-o" "google_crash_reporting_api_key" : "AIzaSyD9X82PNcn-zGsZYwDyTX32hwi4QtXKM-o" FFE391E0EA186D0734ED601E4E70E3224B7309D48E2075BAC46D8C667EAE7212 312b4b7ec2c469304539c206109b5b9c a22057f5674c2a55e290c449d9d92f39 7065726D697373696F6E40676D61696C2E636F6D 3BAF59A2E5331C30675FAB35FF5FFF0D116142D3D4664F1C3CB804068B40614F E3F9E1E0CF99D0E56A055BA65E241B3399F7CEA524326B0CDD6EC1327ED0FDC1 258EAFA5-E914-47DA-95CA-C5AB0DC85B11
信息 应用程序记录日志信息,不得记录敏感信息
应用程序记录日志信息,不得记录敏感信息 https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs Files: c/a/a/e/e.java, line(s) 29,43 com/appsflyer/AFLogger.java, line(s) 100 com/just/agentweb/AgentWebUtils.java, line(s) 159 com/just/agentweb/JsCallJava.java, line(s) 69 com/just/agentweb/LogUtils.java, line(s) 10,25,39 com/yalantis/ucrop/view/TransformImageView.java, line(s) 182 f/a/b/g/p.java, line(s) 567,828 f/a/b/g/x/a.java, line(s) 69 f/a/b/g/y/e/b.java, line(s) 106,111,117 f/b/a/a/a.java, line(s) 47 f/c/a/a/f/b.java, line(s) 182 f/c/a/a/h/a.java, line(s) 73,144 f/c/a/a/h/c.java, line(s) 41 f/e/a/d.java, line(s) 133,132,164,274,281 f/e/a/p/a.java, line(s) 587 f/e/a/q/e.java, line(s) 98,308 f/e/a/q/g.java, line(s) 387,402,415 f/e/a/r/n/b.java, line(s) 32 f/e/a/r/n/j.java, line(s) 64,66,72,79,173 f/e/a/r/n/l.java, line(s) 34 f/e/a/r/n/o/c.java, line(s) 111 f/e/a/r/n/o/e.java, line(s) 70 f/e/a/r/o/a0/j.java, line(s) 175,189 f/e/a/r/o/a0/k.java, line(s) 99,109,170,186,193,239,246,260,269 f/e/a/r/o/b0/e.java, line(s) 55,74,81,91,106,112 f/e/a/r/o/b0/l.java, line(s) 78 f/e/a/r/o/c0/a.java, line(s) 106,103 f/e/a/r/o/c0/b.java, line(s) 42,41 f/e/a/r/o/d0/a.java, line(s) 91 f/e/a/r/o/h.java, line(s) 155,352,536 f/e/a/r/o/i.java, line(s) 64 f/e/a/r/o/k.java, line(s) 36 f/e/a/r/o/z.java, line(s) 40 f/e/a/r/p/c.java, line(s) 18 f/e/a/r/p/d.java, line(s) 49 f/e/a/r/p/f.java, line(s) 123 f/e/a/r/p/s.java, line(s) 100 f/e/a/r/p/t.java, line(s) 38 f/e/a/r/q/c/a0.java, line(s) 249,99,102,155,162,167,246 f/e/a/r/q/c/d0.java, line(s) 136 f/e/a/r/q/c/e.java, line(s) 52,67 f/e/a/r/q/c/m.java, line(s) 212,222,232,300,307,321,329,357,375,377,382,391,394,399 f/e/a/r/q/c/o.java, line(s) 182,198,223,301,332,366 f/e/a/r/q/c/p.java, line(s) 44,50 f/e/a/r/q/c/t.java, line(s) 42 f/e/a/r/q/g/a.java, line(s) 109,114,119,128 f/e/a/r/q/g/c.java, line(s) 27 f/e/a/r/q/g/i.java, line(s) 58 f/e/a/s/e.java, line(s) 38,61,92 f/e/a/s/f.java, line(s) 17 f/e/a/s/k.java, line(s) 102 f/e/a/s/l.java, line(s) 154 f/e/a/s/n.java, line(s) 38 f/e/a/t/e.java, line(s) 23,28,31,37,42 f/e/a/v/j.java, line(s) 71 f/e/a/v/l/f.java, line(s) 184,294 f/e/a/v/l/r.java, line(s) 175,285 f/e/a/w/a.java, line(s) 54 f/e/a/x/b.java, line(s) 36 f/e/a/x/n/a.java, line(s) 57 f/g/a/b/m/w/a.java, line(s) 39 f/g/a/d/e/e0.java, line(s) 67,71 f/g/a/d/e/g0.java, line(s) 42 f/g/a/d/e/j.java, line(s) 82,287,240 f/g/a/d/e/n0.java, line(s) 33 f/g/a/d/e/p/q.java, line(s) 27 f/g/a/d/e/p/y/a0.java, line(s) 84 f/g/a/d/e/p/y/a3.java, line(s) 160 f/g/a/d/e/p/y/f2.java, line(s) 101 f/g/a/d/e/p/y/g.java, line(s) 112,276 f/g/a/d/e/p/y/j3.java, line(s) 154,353 f/g/a/d/e/p/y/k0.java, line(s) 79,299,316 f/g/a/d/e/p/y/p1.java, line(s) 43 f/g/a/d/e/p/y/p2.java, line(s) 28,33 f/g/a/d/e/p/y/q3.java, line(s) 83 f/g/a/d/e/p/y/w0.java, line(s) 367,515,517 f/g/a/d/e/t/d.java, line(s) 46,77 f/g/a/d/e/t/e.java, line(s) 458,555,574,284,366 f/g/a/d/e/t/e1.java, line(s) 123 f/g/a/d/e/t/g.java, line(s) 105,108,111,114,117,120,131,134,137,140 f/g/a/d/e/t/i.java, line(s) 23 f/g/a/d/e/t/l.java, line(s) 106 f/g/a/d/e/t/n.java, line(s) 79,94,142,149,32,80 f/g/a/d/e/t/p1.java, line(s) 39 f/g/a/d/e/u/a.java, line(s) 52,86,99,81,91 f/g/a/d/e/y/d.java, line(s) 54,72 f/g/a/d/e/z/c0.java, line(s) 18 f/g/a/d/e/z/e0.java, line(s) 106,112,123,129,45,143,152,202 f/g/a/d/e/z/i.java, line(s) 34 f/g/a/d/f/n.java, line(s) 25 f/g/a/d/h/e/k.java, line(s) 63 f/g/a/d/h/f/d2.java, line(s) 31 f/g/a/d/h/f/e2.java, line(s) 28 f/g/a/d/h/f/g.java, line(s) 311 f/g/a/d/h/f/g2.java, line(s) 31 f/g/a/d/h/f/g6.java, line(s) 39,51,65,78,36,50,64 f/g/a/d/h/f/j5.java, line(s) 63 f/g/a/d/h/f/k1.java, line(s) 88 f/g/a/d/h/f/t1.java, line(s) 60 f/g/a/d/h/f/w1.java, line(s) 25 f/g/a/d/h/f/x1.java, line(s) 44,62 f/g/a/d/h/f/y1.java, line(s) 129 f/g/a/d/i/b/c4.java, line(s) 230 f/g/a/d/k/a.java, line(s) 50,62,48 f/g/a/d/l/b/a.java, line(s) 95 f/g/a/d/m/c.java, line(s) 101,175,160 f/g/d/b0/a0.java, line(s) 156,104,107,197 f/g/d/b0/b.java, line(s) 189,196 f/g/d/b0/d.java, line(s) 107 f/g/d/b0/p.java, line(s) 109,60,122 f/g/d/b0/q.java, line(s) 144,157,267 f/g/d/b0/v.java, line(s) 50 f/g/d/b0/z.java, line(s) 250,260,57,60 f/g/d/v/a0.java, line(s) 165,196,205,227,244,260,287,300,517,582,596 f/g/d/v/b1.java, line(s) 67,72,102,39,41,43,54,79,89,112 f/g/d/v/h.java, line(s) 29 f/g/d/v/h0.java, line(s) 85 f/g/d/v/m0.java, line(s) 28,37 f/g/d/v/s0.java, line(s) 89,111,232,252,272,355 f/g/d/v/t.java, line(s) 140 f/g/d/v/t0.java, line(s) 82,85,124,131,134,105,156,168,178 f/g/d/v/u0.java, line(s) 62 f/g/d/v/v0.java, line(s) 90,156,61,93 f/g/d/v/w.java, line(s) 23 f/g/d/v/y0.java, line(s) 26 f/g/d/x/d.java, line(s) 33,49,72 f/g/d/x/u/c.java, line(s) 87,201,206 f/l/a/f/b.java, line(s) 81,88,94,124 f/l/a/g/a.java, line(s) 51,82 f/l/a/g/f.java, line(s) 140,148,155,162,176,186,196,228,244,246,251,260,263,268 j/v2/d.java, line(s) 11,16,21,26,31,36,41,46,51,56,61,66,71,76,81,86,91,96,101,106,111 k/l0/d.java, line(s) 852 k/l0/n/i/c.java, line(s) 48,94,97 m/a/a/g.java, line(s) 79,84
安全 此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击
此应用程序使用SSL Pinning 来检测或防止安全通信通道中的MITM攻击 https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-4 Files: f/a/c/g/d.java, line(s) 153,92 k/l0/n/c.java, line(s) 87,85,84 k/l0/n/d.java, line(s) 137,135,143,134,134,136 k/l0/n/g.java, line(s) 86,84,83,83 k/l0/n/h.java, line(s) 203,201,200,200
安全 此应用程序可能具有Root检测功能
此应用程序可能具有Root检测功能 https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05j-Testing-Resiliency-Against-Reverse-Engineering.md#testing-root-detection-mstg-resilience-1 Files: f/a/b/g/g.java, line(s) 328 f/a/b/g/y/f/d.java, line(s) 854,855 f/g/a/d/h/f/x1.java, line(s) 21
关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (app-measurement.com) 通信。
{'ip': '180.163.150.38', 'country_short': 'CN', 'country_long': '中国', 'region': '上海', 'city': '上海', 'latitude': '31.224333', 'longitude': '121.468948'}
关注 应用程序可能与位于OFAC制裁国家 (中国) 的服务器 (pagead2.googlesyndication.com) 通信。
{'ip': '180.163.150.38', 'country_short': 'CN', 'country_long': '中国', 'region': '上海', 'city': '上海', 'latitude': '31.224333', 'longitude': '121.468948'}