supplier-meesho.webflow 1.0.0

package/MobSF/mobsf/MobSF/views/api/api_dynamic_analysis.py

@@ -0,0 +1,278 @@
+# -*- coding: utf_8 -*-
+"""MobSF REST API V 1."""
+
+from django.views.decorators.csrf import csrf_exempt
+
+from mobsf.MobSF.views.helpers import request_method
+from mobsf.MobSF.views.api.api_middleware import make_api_response
+from mobsf.DynamicAnalyzer.views.android import (
+    dynamic_analyzer,
+    operations,
+    report,
+    tests_common,
+    tests_frida,
+)
+
+
+# Dynamic Analyzer APIs
+@request_method(['GET'])
+@csrf_exempt
+def api_get_apps(request):
+    """GET - Get Apps for dynamic analysis API."""
+    resp = dynamic_analyzer.dynamic_analysis(request, True)
+    if 'error' in resp:
+        return make_api_response(resp, 500)
+    return make_api_response(resp, 200)
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_start_analysis(request):
+    """POST - Start Dynamic Analysis."""
+    if 'hash' not in request.POST:
+        return make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    resp = dynamic_analyzer.dynamic_analyzer(
+        request,
+        request.POST['hash'],
+        True)
+    if 'error' in resp:
+        return make_api_response(resp, 500)
+    return make_api_response(resp, 200)
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_logcat(request):
+    """POST - Get Logcat HTTP Streaming API."""
+    if 'package' not in request.POST:
+        return make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    lcat = dynamic_analyzer.logcat(request, True)
+    if isinstance(lcat, dict):
+        if 'error' in lcat:
+            return make_api_response(
+                lcat, 500)
+    return lcat
+
+
+# Android Operation APIs
+@request_method(['POST'])
+@csrf_exempt
+def api_mobsfy(request):
+    """POST - MobSFy API."""
+    if 'identifier' not in request.POST:
+        return make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    resp = operations.mobsfy(request, True)
+    if resp['status'] == 'ok':
+        return make_api_response(resp, 200)
+    return make_api_response(resp, 500)
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_screenshot(request):
+    """POST - Screenshot API."""
+    if 'hash' not in request.POST:
+        return make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    resp = operations.take_screenshot(request, True)
+    if resp['status'] == 'ok':
+        return make_api_response(resp, 200)
+    return make_api_response(resp, 500)
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_adb_execute(request):
+    """POST - ADB execute API."""
+    if 'cmd' not in request.POST:
+        return make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    resp = operations.execute_adb(request, True)
+    if resp['status'] == 'ok':
+        return make_api_response(resp, 200)
+    return make_api_response(resp, 500)
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_root_ca(request):
+    """POST - MobSF CA actions API."""
+    if 'action' not in request.POST:
+        return make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    resp = operations.mobsf_ca(request, True)
+    if resp['status'] == 'ok':
+        return make_api_response(resp, 200)
+    return make_api_response(resp, 500)
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_global_proxy(request):
+    """POST - MobSF Global Proxy API."""
+    if 'action' not in request.POST:
+        return make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    resp = operations.global_proxy(request, True)
+    if resp['status'] == 'ok':
+        return make_api_response(resp, 200)
+    return make_api_response(resp, 500)
+
+
+# Android Dynamic Tests APIs
+@request_method(['POST'])
+@csrf_exempt
+def api_api_tester(request):
+    """POST - Activity Tester."""
+    params = {'test', 'hash'}
+    if set(request.POST) < params:
+        return make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    resp = tests_common.activity_tester(request, True)
+    if resp['status'] == 'ok':
+        return make_api_response(resp, 200)
+    return make_api_response(resp, 500)
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_tls_tester(request):
+    """POST - TLS/SSL Security Tester."""
+    if 'hash' not in request.POST:
+        return make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    resp = tests_common.tls_tests(request, True)
+    if resp['status'] == 'ok':
+        return make_api_response(resp, 200)
+    return make_api_response(resp, 500)
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_stop_analysis(request):
+    """POST - Stop Dynamic Analysis."""
+    if 'hash' not in request.POST:
+        return make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    tests_common.collect_logs(request, True)
+    resp = tests_common.download_data(request, True)
+    if resp['status'] == 'ok':
+        return make_api_response(resp, 200)
+    return make_api_response(resp, 500)
+
+
+# Android Frida APIs
+@request_method(['POST'])
+@csrf_exempt
+def api_instrument(request):
+    """POST - Frida Instrument."""
+    params = {
+        'hash',
+        'default_hooks',
+        'auxiliary_hooks',
+        'frida_code'}
+    if set(request.POST) < params:
+        return make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    resp = tests_frida.instrument(request, True)
+    if resp['status'] == 'ok':
+        return make_api_response(resp, 200)
+    return make_api_response(resp, 500)
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_api_monitor(request):
+    """POST - Frida API Monitor."""
+    if 'hash' not in request.POST:
+        return make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    resp = tests_frida.live_api(request, True)
+    # live_api can be json or html
+    if resp.get('data'):
+        return make_api_response(resp, 200)
+    return make_api_response(resp, 500)
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_frida_logs(request):
+    """POST - Frida Logs."""
+    if 'hash' not in request.POST:
+        return make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    resp = tests_frida.frida_logs(request, True)
+    # frida logs can be json or html
+    if resp.get('data'):
+        return make_api_response(resp, 200)
+    return make_api_response(resp, 500)
+
+
+@request_method(['GET'])
+@csrf_exempt
+def api_list_frida_scripts(request):
+    """GET - List Frida Scripts."""
+    resp = tests_frida.list_frida_scripts(request, True)
+    if resp['status'] == 'ok':
+        return make_api_response(resp, 200)
+    return make_api_response(resp, 500)
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_get_script(request):
+    """POST - Frida Get Script."""
+    if not request.POST.getlist('scripts[]'):
+        return make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    resp = tests_frida.get_script(request, True)
+    if resp['status'] == 'ok':
+        return make_api_response(resp, 200)
+    return make_api_response(resp, 500)
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_get_dependencies(request):
+    """POST - Frida Get Runtime Dependencies."""
+    if 'hash' not in request.POST:
+        return make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    resp = tests_frida.get_runtime_dependencies(request, True)
+    if resp['status'] == 'ok':
+        return make_api_response(resp, 200)
+    return make_api_response(resp, 500)
+
+
+# Report APIs
+@request_method(['POST'])
+@csrf_exempt
+def api_dynamic_report(request):
+    """POST - Dynamic Analysis report."""
+    if 'hash' not in request.POST:
+        return make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    resp = report.view_report(
+        request,
+        request.POST['hash'],
+        True)
+    if 'error' in resp:
+        return make_api_response(resp, 500)
+    return make_api_response(resp, 200)
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_dynamic_view_file(request):
+    """POST - Dynamic Analysis report."""
+    params = {'hash', 'file', 'type'}
+    if set(request.POST) < params:
+        return make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    resp = report.view_file(request, True)
+    if 'error' in resp:
+        return make_api_response(resp, 500)
+    return make_api_response(resp, 200)

package/MobSF/mobsf/MobSF/views/api/api_middleware.py

@@ -0,0 +1,47 @@
+# -*- coding: utf_8 -*-
+"""REST API Middleware."""
+from django.http import JsonResponse
+from django.utils.deprecation import MiddlewareMixin
+
+from mobsf.MobSF.utils import api_key
+
+OK = 200
+
+
+def make_api_response(data, status=OK):
+    """Make API Response."""
+    resp = JsonResponse(
+        data=data,  # lgtm [py/stack-trace-exposure]
+        status=status)
+    resp['Access-Control-Allow-Origin'] = '*'
+    resp['Access-Control-Allow-Methods'] = 'POST'
+    resp['Access-Control-Allow-Headers'] = 'Authorization, X-Mobsf-Api-Key'
+    resp['Content-Type'] = 'application/json; charset=utf-8'
+    return resp
+
+
+def api_auth(meta):
+    """Check if API Key Matches."""
+    if 'HTTP_X_MOBSF_API_KEY' in meta:
+        return bool(api_key() == meta['HTTP_X_MOBSF_API_KEY'])
+    elif 'HTTP_AUTHORIZATION' in meta:
+        return bool(api_key() == meta['HTTP_AUTHORIZATION'])
+    return False
+
+
+class RestApiAuthMiddleware(MiddlewareMixin):
+    """
+    Middleware.
+
+    Middleware for REST API.
+    """
+
+    def process_request(self, request):
+        """Middleware to handle API Auth."""
+        if not request.path.startswith('/api/'):
+            return
+        if request.method == 'OPTIONS':
+            return make_api_response({}, 200)
+        if not api_auth(request.META):
+            return make_api_response(
+                {'error': 'You are unauthorized to make this request.'}, 401)

package/MobSF/mobsf/MobSF/views/api/api_static_analysis.py

@@ -0,0 +1,186 @@
+# -*- coding: utf_8 -*-
+"""MobSF REST API V 1."""
+
+from django.http import HttpResponse
+from django.views.decorators.csrf import csrf_exempt
+
+from mobsf.MobSF.views.helpers import request_method
+from mobsf.MobSF.views.home import RecentScans, Upload, delete_scan
+from mobsf.MobSF.views.api.api_middleware import make_api_response
+from mobsf.StaticAnalyzer.views.android import view_source
+from mobsf.StaticAnalyzer.views.android.static_analyzer import static_analyzer
+from mobsf.StaticAnalyzer.views.ios import view_source as ios_view_source
+from mobsf.StaticAnalyzer.views.ios.static_analyzer import static_analyzer_ios
+from mobsf.StaticAnalyzer.views.shared_func import (
+    compare_apps,
+    pdf,
+)
+from mobsf.StaticAnalyzer.views.windows import windows
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_upload(request):
+    """POST - Upload API."""
+    upload = Upload(request)
+    resp, code = upload.upload_api()
+    return make_api_response(resp, code)
+
+
+@request_method(['GET'])
+@csrf_exempt
+def api_recent_scans(request):
+    """GET - get recent scans."""
+    scans = RecentScans(request)
+    resp = scans.recent_scans()
+    if 'error' in resp:
+        return make_api_response(resp, 500)
+    else:
+        return make_api_response(resp, 200)
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_scan(request):
+    """POST - Scan API."""
+    params = {'scan_type', 'hash', 'file_name'}
+    if set(request.POST) >= params:
+        scan_type = request.POST['scan_type']
+        # APK, Android ZIP and iOS ZIP
+        if scan_type in {'xapk', 'apk', 'zip'}:
+            resp = static_analyzer(request, True)
+            if 'type' in resp:
+                # For now it's only ios_zip
+                request.POST._mutable = True
+                request.POST['scan_type'] = 'ios'
+                resp = static_analyzer_ios(request, True)
+            if 'error' in resp:
+                response = make_api_response(resp, 500)
+            else:
+                response = make_api_response(resp, 200)
+        # IPA
+        elif scan_type == 'ipa':
+            resp = static_analyzer_ios(request, True)
+            if 'error' in resp:
+                response = make_api_response(resp, 500)
+            else:
+                response = make_api_response(resp, 200)
+        # APPX
+        elif scan_type == 'appx':
+            resp = windows.staticanalyzer_windows(request, True)
+            if 'error' in resp:
+                response = make_api_response(resp, 500)
+            else:
+                response = make_api_response(resp, 200)
+    else:
+        response = make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    return response
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_delete_scan(request):
+    """POST - Delete a Scan."""
+    if 'hash' in request.POST:
+        resp = delete_scan(request, True)
+        if 'error' in resp:
+            response = make_api_response(resp, 500)
+        else:
+            response = make_api_response(resp, 200)
+    else:
+        response = make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    return response
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_pdf_report(request):
+    """Generate and Download PDF."""
+    params = {'hash'}
+    if set(request.POST) == params:
+        resp = pdf(request, api=True)
+        if 'error' in resp:
+            if resp.get('error') == 'Invalid scan hash':
+                response = make_api_response(resp, 400)
+            else:
+                response = make_api_response(resp, 500)
+        elif 'pdf_dat' in resp:
+            response = HttpResponse(
+                resp['pdf_dat'], content_type='application/pdf')
+            response['Access-Control-Allow-Origin'] = '*'
+        elif resp.get('report') == 'Report not Found':
+            response = make_api_response(resp, 404)
+        else:
+            response = make_api_response(
+                {'error': 'PDF Generation Error'}, 500)
+    else:
+        response = make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    return response
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_json_report(request):
+    """Generate JSON Report."""
+    params = {'hash'}
+    if set(request.POST) == params:
+        resp = pdf(request, api=True, jsonres=True)
+        if 'error' in resp:
+            if resp.get('error') == 'Invalid scan hash':
+                response = make_api_response(resp, 400)
+            else:
+                response = make_api_response(resp, 500)
+        elif 'report_dat' in resp:
+            response = make_api_response(resp['report_dat'], 200)
+        elif resp.get('report') == 'Report not Found':
+            response = make_api_response(resp, 404)
+        else:
+            response = make_api_response(
+                {'error': 'JSON Generation Error'}, 500)
+    else:
+        response = make_api_response(
+            {'error': 'Missing Parameters'}, 422)
+    return response
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_view_source(request):
+    """View Source for android & ios source file."""
+    params = {'file', 'type', 'hash'}
+    if set(request.POST) >= params:
+        if request.POST['type'] in {'eclipse', 'studio',
+                                    'apk', 'java', 'smali'}:
+            resp = view_source.run(request, api=True)
+        else:
+            resp = ios_view_source.run(request, api=True)
+        if 'error' in resp:
+            response = make_api_response(resp, 500)
+        else:
+            response = make_api_response(resp, 200)
+    else:
+        response = make_api_response({'error': 'Missing Parameters'}, 422)
+    return response
+
+
+@request_method(['POST'])
+@csrf_exempt
+def api_compare(request):
+    """Compare 2 apps."""
+    params = {'hash1', 'hash2'}
+    if set(request.POST) >= params:
+        resp = compare_apps(
+            request,
+            request.POST['hash1'],
+            request.POST['hash2'],
+            True)
+        if 'error' in resp:
+            response = make_api_response(resp, 500)
+        else:
+            response = make_api_response(resp, 200)
+    else:
+        response = make_api_response({'error': 'Missing Parameters'}, 422)
+    return response

package/MobSF/mobsf/MobSF/views/apk_downloader.py

@@ -0,0 +1,163 @@
+# -*- coding: utf_8 -*-
+"""Android APK Downloader."""
+import logging
+from tempfile import gettempdir
+from pathlib import Path
+from zipfile import ZipFile
+
+import requests
+
+from bs4 import BeautifulSoup
+
+from django.conf import settings
+
+from mobsf.MobSF.views.scanning import (
+    add_to_recent_scan,
+    handle_uploaded_file,
+)
+from mobsf.MobSF.utils import (
+    is_path_traversal,
+    is_zip_magic,
+    strict_package_check,
+    upstream_proxy,
+)
+
+
+logger = logging.getLogger(__name__)
+
+
+def fetch_html(url):
+    """Get Result HTML."""
+    headers = {
+        'User-Agent': ('Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) '
+                       'AppleWebKit/537.36 (KHTML, like Gecko) '
+                       'Chrome/39.0.2171.95 Safari/537.36'),
+        'Accept-Encoding': 'deflate, gzip'}
+    try:
+        proxies, verify = upstream_proxy('https')
+        res = requests.get(url,
+                           headers=headers,
+                           proxies=proxies,
+                           verify=verify,
+                           stream=True)
+        if res.status_code == 200:
+            return BeautifulSoup(res.text, features='lxml')
+    except Exception:
+        pass
+    return None
+
+
+def download_file(url, outfile):
+    try:
+        logger.info('Downloading APK...')
+        with requests.get(url, stream=True) as r:
+            r.raise_for_status()
+            with open(outfile, 'wb') as f:
+                for chunk in r.iter_content(chunk_size=8192):
+                    f.write(chunk)
+        return outfile
+    except Exception:
+        pass
+    return None
+
+
+def get_scan_type(location):
+    """Get APK type."""
+    with ZipFile(location, 'r') as zf:
+        for fil in zf.namelist():
+            if fil.endswith('.apk'):
+                return 'apks'
+    return 'apk'
+
+
+def add_apk(dwd_file, filename):
+    """Add APK to MobSF."""
+    with dwd_file.open('rb') as flip:
+        if not is_zip_magic(flip):
+            logger.warning('Downloaded file is not an APK/Split APK')
+            return None
+        md5 = handle_uploaded_file(flip, '.apk')
+        apk = Path(settings.UPLD_DIR) / md5 / f'{md5}.apk'
+        scan_type = get_scan_type(apk)
+        data = {
+            'analyzer': 'static_analyzer',
+            'status': 'success',
+            'hash': md5,
+            'scan_type': scan_type,
+            'file_name': filename,
+        }
+        add_to_recent_scan(data)
+        return data
+    return None
+
+
+def find_apk_link(url, domain):
+    """Find APK download link."""
+    try:
+        logger.info('Looking for download link form %s', domain)
+        bsp = fetch_html(url)
+        if not bsp:
+            return None
+        link = bsp.find('a', href=True, string='click here')
+        if link:
+            logger.info('Download link found from %s', domain)
+            return link['href']
+        logger.warning('Download link not found in %s', domain)
+    except Exception:
+        logger.warning('Failed to obtain download link from %s', domain)
+    return None
+
+
+def try_provider(package, provider, domain):
+    """Try using a provider."""
+    downloaded_file = None
+    data = None
+    apk_name = f'{package}.apk'
+    temp_file = Path(gettempdir()) / apk_name
+    link = find_apk_link(provider, domain)
+    if link:
+        downloaded_file = download_file(link, temp_file)
+    if downloaded_file:
+        data = add_apk(downloaded_file, apk_name)
+    if data:
+        return data
+    return None
+
+
+def apk_download(package):
+    """Download APK."""
+    downloaded_file = None
+    data = None
+    try:
+        if not strict_package_check(package) or is_path_traversal(package):
+            return None
+        logger.info('Attempting to download: %s', package)
+        # APKTADA
+        data = try_provider(
+            package,
+            f'{settings.APKTADA}{package}',
+            'apktada.com')
+        if data:
+            return data
+        # APKPURE
+        data = try_provider(
+            package,
+            settings.APKPURE.format(package),
+            'apkpure.com')
+        if data:
+            return data
+        # APKPLZ
+        data = try_provider(
+            package,
+            f'{settings.APKPLZ}{package}',
+            'apkplz.net')
+        if data:
+            return data
+        logger.warning('Unable to find download link for %s', package)
+        return None
+    except Exception:
+        logger.exception('Failed to download the apk')
+        return None
+    finally:
+        if downloaded_file:
+            downloaded_file.unlink()