Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New module: Enumerate targets android apps #1831

Merged

Conversation

domwhewell-sage
Copy link
Contributor

@domwhewell-sage domwhewell-sage commented Oct 8, 2024

This PR will search the google play store for official android applications created by the target organization

  1. It searches the google playstore with the ORG_STUB or will consume android CODE_REPOSITORY events and re-emit them as MOBILE_APP
  2. Requests the details page for each app listed, in the "App Support" section the publisher lists details about themselves, if the Website / Support Email / Privacy Policy fields contain in-scope urls then the App is deemed in scope
  3. The module then raises a new event type MOBILE_APP which will be consumed by other download modules

FYI:

  • I have removed the URL validation for now, as the app_id is passed to the playstore as a query parameter which the validator will not accept 😟
  • I am marking this pull request as ready for review now I will update the steps to get a mobile looting set of modules in Discussion Mobile App Looting / Analysis #1219

@domwhewell-sage domwhewell-sage marked this pull request as ready for review October 11, 2024 17:00
@TheTechromancer TheTechromancer mentioned this pull request Oct 11, 2024
1 task
@TheTechromancer
Copy link
Collaborator

Nice work on this. Mobile apps are a huge attack surface so this is really exciting.

One thing though is that it looks like BeautifulSoup is taking up an enormous amount of CPU. In some cases it is blocking the event loop for 5+ seconds. Whenever possible we should avoid parsing HTML and use the async regex helpers instead, or the yara helpers like in postman_download.

image

Once the performance stuf is fixed this should be good to merge.

@TheTechromancer TheTechromancer merged commit 8ed9153 into blacklanternsecurity:dev Oct 15, 2024
8 checks passed
@domwhewell-sage domwhewell-sage deleted the google_playstore branch October 15, 2024 16:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants