Viewing Collection: mobsf_reports

76c308fac6a655a3534771777780e004feb1d91be03285776…

dvba.apk

2026-06-13T16:03:54.261192

{
  "high": [
    {
      "title": "Base config is insecurely configured to permit clear text traffic to all domains",
      "description": "Scope:\n*\n\n",
      "section": "network"
    },
    {
      "title": "Base config is configured to trust user installed certificates",
      "description": "Scope:\n*\n\n",
      "section": "network"
    },
    {
      "title": "App can be installed on a vulnerable unpatched Android version 5.0-5.0.2, [minSdk=21]",
      "description": "This application can be installed on an older version of android that has multiple unfixed vulnerabilities. These devices won't receive reasonable security updates from Google. Support an Android version => 10, API 29 to receive reasonable security updates.",
      "section": "manifest"
    },
    {
      "title": "Clear text traffic is Enabled For App[android:usesCleartextTraffic=true]",
      "description": "The app intends to use cleartext network traffic, such as cleartext HTTP, FTP stacks, DownloadManager, and MediaPlayer. The default value for apps that target API level 27 or lower is \"true\". Apps that target API level 28 or higher default to \"false\". The key reason for avoiding cleartext traffic is the lack of confidentiality, authenticity, and protections against tampering; a network attacker can eavesdrop on transmitted data and also modify it without being detected.",
      "section": "manifest"
    },
    {
      "title": "App Link assetlinks.json file not found[android:name=com.app.damnvulnerablebank.CurrencyRates][android:host=http://xe.com]",
      "description": "App Link asset verification URL (http://xe.com/.well-known/assetlinks.json) not found or configured incorrectly. (Status Code: 403). App Links allow users to redirect from a web URL/email to the mobile app. If this file is missing or incorrectly configured for the App Link host/domain, a malicious app can hijack such URLs. This may lead to phishing attacks, leak sensitive data in the URI, such as PII, OAuth tokens, magic link/password reset tokens and more. You must verify the App Link domain by hosting the assetlinks.json file and enabling verification via [android:autoVerify=\"true\"] in the Activity intent-filter.",
      "section": "manifest"
    },
    {
      "title": "App Link assetlinks.json file not found[android:name=com.app.damnvulnerablebank.CurrencyRates][android:host=https://xe.com]",
      "description": "App Link asset verification URL (https://xe.com/.well-known/assetlinks.json) not found or configured incorrectly. (Status Code: 403). App Links allow users to redirect from a web URL/email to the mobile app. If this file is missing or incorrectly configured for the App Link host/domain, a malicious app can hijack such URLs. This may lead to phishing attacks, leak sensitive data in the URI, such as PII, OAuth tokens, magic link/password reset tokens and more. You must verify the App Link domain by hosting the assetlinks.json file and enabling verification via [android:autoVerify=\"true\"] in the Activity intent-filter.",
      "section": "manifest"
    }
  ],
  "warning": [
    {
      "title": "Base config is configured to trust system certificates",
      "description": "Scope:\n*\n\n",
      "section": "network"
    },
    {
      "title": "Application Data can be Backed up [android:allowBackup=true]",
      "description": "This flag allows anyone to backup your application data via adb. It allows users who have enabled USB debugging to copy application data off of the device.",
      "section": "manifest"
    },
    {
      "title": "Activity (com.app.damnvulnerablebank.CurrencyRates) is not Protected. An intent-filter exists.",
      "description": "An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Activity is explicitly exported.",
      "section": "manifest"
    },
    {
      "title": "Activity (com.app.damnvulnerablebank.SendMoney) is not Protected. [android:exported=true]",
      "description": "An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device.",
      "section": "manifest"
    },
    {
      "title": "Activity (com.app.damnvulnerablebank.ViewBalance) is not Protected. [android:exported=true]",
      "description": "An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device.",
      "section": "manifest"
    },
    {
      "title": "Activity (androidx.biometric.DeviceCredentialHandlerActivity) is not Protected. [android:exported=true]",
      "description": "An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device.",
      "section": "manifest"
    },
    {
      "title": "Activity (com.google.firebase.auth.internal.FederatedSignInActivity) is Protected by a permission, but the protection level of the permission should be checked. Permission: com.google.firebase.auth.api.gms.permission.LAUNCH_FEDERATED_SIGN_IN [android:exported=true]",
      "description": "An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission.",
      "section": "manifest"
    },
    {
      "title": "App can read/write to External Storage. Any App can read data written to External Storage.",
      "description": "App can read/write to External Storage. Any App can read data written to External Storage.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage\n\nFiles:\ncom/app/damnvulnerablebank/MainActivity.java, line(s) 175",
      "section": "code"
    },
    {
      "title": "This app may contain hardcoded secrets",
      "description": "The following secrets were identified from the app. Ensure that these are not secrets or private information.\n\"firebase_database_url\" : \"https://damn-vulnerable-bank.firebaseio.com\"\n\"google_api_key\" : \"AIzaSyBbOHG6DDa6DOcRGEg57mw9nXYXcw6la3c\"\n\"google_crash_reporting_api_key\" : \"AIzaSyBbOHG6DDa6DOcRGEg57mw9nXYXcw6la3c\"\nGmdBWksdEwAZFAlLVEdDX1FKS0JtQU1DHggaBkNXQQFjTkdBTUMJBgMCFQUIFA5MXUFPDxUdBg4PCkNWY05HQU1DFAYaDwgDBlhTTkUSAgwfHQcJBk9rWkkTbRw=",
      "section": "secrets"
    }
  ],
  "info": [
    {
      "title": "The App logs information. Sensitive information should never be logged.",
      "description": "The App logs information. Sensitive information should never be logged.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs\n\nFiles:\na/a/a/a/a.java, line(s) 219,335,562,571,578,591,761,784,791,1954,1975,1996,2023,2245,2438,3141,3155,3167,145,154,179,188,2354,2364,2472,2481\nb/b/k/h.java, line(s) 396,217,225\nb/b/k/k.java, line(s) 1578,1435,1444,1454,1463,1478,1487,1500,1509,419,1143,1243,1246,1345,1792\nb/b/k/r.java, line(s) 147\nb/b/k/t.java, line(s) 43\nb/b/l/a/a.java, line(s) 80\nb/b/o/f.java, line(s) 140,174,186,196,354\nb/b/o/i/d.java, line(s) 543\nb/b/o/i/g.java, line(s) 592\nb/b/p/a0.java, line(s) 93,102,192,228\nb/b/p/a1.java, line(s) 92,156\nb/b/p/d1.java, line(s) 24,34,52,54,57\nb/b/p/k0.java, line(s) 359,165,170,177,264,342\nb/b/p/m0.java, line(s) 107\nb/b/p/n0.java, line(s) 141,49,65,94,345\nb/b/p/r0.java, line(s) 101,252,377,185,234,339,350,391,405\nb/b/p/s0.java, line(s) 33\nb/b/p/w.java, line(s) 95,149,154,182,583\nb/b/p/z0.java, line(s) 348,387\nb/d/a.java, line(s) 285\nb/d/c.java, line(s) 248,85\nb/d/e.java, line(s) 266\nb/g/c/c.java, line(s) 71\nb/g/c/d.java, line(s) 199,104,163\nb/g/c/e.java, line(s) 612,1408,642,1461\nb/i/d/b.java, line(s) 115\nb/i/d/c.java, line(s) 32\nb/i/d/e.java, line(s) 60,77,94\nb/i/f/c.java, line(s) 50,55\nb/i/f/d.java, line(s) 33\nb/i/f/e.java, line(s) 58\nb/i/f/f.java, line(s) 45\nb/i/f/g.java, line(s) 51,209\nb/i/f/k/d.java, line(s) 45,68\nb/i/g/a/a.java, line(s) 42\nb/i/i/b.java, line(s) 18\nb/i/l/a.java, line(s) 22\nb/i/m/a.java, line(s) 239\nb/i/m/b.java, line(s) 39\nb/i/m/f.java, line(s) 159,177,200\nb/i/m/l.java, line(s) 226\nb/i/m/p.java, line(s) 23,34\nb/i/m/u.java, line(s) 40,50,61,70\nb/j/a/b.java, line(s) 42\nb/k/b/e.java, line(s) 317\nb/l/a/e.java, line(s) 149,151,176,299,301\nb/l/a/k.java, line(s) 2823,2824,2835,1939\nb/p/a/a.java, line(s) 142,147,154,158,174,184\nb/t/b0.java, line(s) 36,60\nb/u/a/a/f.java, line(s) 856,1097\nc/a/b/j.java, line(s) 75\nc/a/b/v.java, line(s) 110,114,13,119\nc/a/b/w/h.java, line(s) 42\nc/b/a/j.java, line(s) 27\nc/b/a/n.java, line(s) 28\nc/c/a/a/c/d.java, line(s) 51,158\nc/c/a/a/c/g.java, line(s) 45,58,102,120,132,138,147\nc/c/a/a/c/h.java, line(s) 26\nc/c/a/a/c/k/k/b0.java, line(s) 46,56\nc/c/a/a/c/k/k/d.java, line(s) 660,778\nc/c/a/a/c/k/k/u.java, line(s) 44\nc/c/a/a/c/l/a.java, line(s) 17\nc/c/a/a/c/l/b.java, line(s) 400,709,724,256,276,416,631,635,640,648\nc/c/a/a/c/l/d.java, line(s) 84,87,91,95,99,103,115,119,122,125,143,152\nc/c/a/a/c/l/d0.java, line(s) 114\nc/c/a/a/c/l/e.java, line(s) 19\nc/c/a/a/c/l/e0.java, line(s) 62\nc/c/a/a/c/l/i.java, line(s) 29\nc/c/a/a/c/l/l.java, line(s) 25\nc/c/a/a/c/m/a.java, line(s) 40,54,59\nc/c/a/a/c/t.java, line(s) 62\nc/c/a/a/f/c/a1.java, line(s) 45,60\nc/c/a/a/g/b/a.java, line(s) 81,86\nc/c/a/b/a0/b.java, line(s) 117\nc/c/a/b/b0/a.java, line(s) 27\nc/c/a/b/l/g.java, line(s) 50\nc/c/b/b.java, line(s) 99,175,184,202,207,211,215,219,223,268\nc/c/b/h/c0/a/e.java, line(s) 37\nc/c/b/h/c0/a/j0.java, line(s) 105,56,94\nc/c/b/h/c0/a/k0.java, line(s) 117,99,110,147,151,89\nc/c/b/h/c0/a/x0.java, line(s) 19\nc/c/b/h/d0/i.java, line(s) 18\nc/c/b/h/d0/k.java, line(s) 98,50,61\nc/c/b/h/d0/p.java, line(s) 71\nc/c/b/h/d0/z.java, line(s) 66,89\nc/c/b/h/y.java, line(s) 52\ncom/app/damnvulnerablebank/BankLogin.java, line(s) 44\ncom/app/damnvulnerablebank/MainActivity.java, line(s) 94,198,201",
      "section": "code"
    },
    {
      "title": "App talks to a Firebase database",
      "description": "The app talks to Firebase database at https://damn-vulnerable-bank.firebaseio.com",
      "section": "firebase"
    }
  ],
  "secure": [
    {
      "title": "This App may have root detection capabilities.",
      "description": "This App may have root detection capabilities.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x05j-Testing-Resiliency-Against-Reverse-Engineering.md#testing-root-detection-mstg-resilience-1\n\nFiles:\na/a/a/a/a.java, line(s) 529,508,511,511,511,511,511,511",
      "section": "code"
    },
    {
      "title": "Firebase Remote Config disabled",
      "description": "Firebase Remote Config is disabled for https://firebaseremoteconfig.googleapis.com/v1/projects/932398433474/namespaces/firebase:fetch?key=AIzaSyBbOHG6DDa6DOcRGEg57mw9nXYXcw6la3c. This is indicated by the response: {'state': 'NO_TEMPLATE'}",
      "section": "firebase"
    },
    {
      "title": "This application has no privacy trackers",
      "description": "This application does not include any user or device trackers. Unable to find trackers during static analysis.",
      "section": "trackers"
    }
  ],
  "hotspot": [],
  "total_trackers": 432,
  "trackers": 0,
  "security_score": 44,
  "app_name": "DamnVulnerableBank",
  "file_name": "dvba.apk",
  "hash": "5b40b49cd80dbe20ba611d32045b57c6",
  "version_name": "1.0"
}

0c86727e4c3e060aa98f4b92e1a1857d7f25c72d3a34d48e0…

YouTube.apk

2026-06-13T16:16:04.345882+00:00

6a2d8244f5aefd2a764127a5

5cefc51fce9bd760b92ab2340477f4dda84b4ae0c5d04a8c9…

diva-beta.apk

2026-06-29T12:30:50.612565+00:00

{
  "high": [
    {
      "title": "Application vulnerable to Janus Vulnerability",
      "description": "Application is signed with v1 signature scheme, making it vulnerable to Janus vulnerability on Android 5.0-8.0, if signed only with v1 signature scheme. Applications running on Android 5.0-7.0 signed with v1, and v2/v3 scheme is also vulnerable.",
      "section": "certificate"
    },
    {
      "title": "Application signed with debug certificate",
      "description": "Application signed with a debug certificate. Production application must not be shipped with a debug certificate.",
      "section": "certificate"
    },
    {
      "title": "App can be installed on a vulnerable unpatched Android version 4.0.3-4.0.4, [minSdk=15]",
      "description": "This application can be installed on an older version of android that has multiple unfixed vulnerabilities. These devices won't receive reasonable security updates from Google. Support an Android version => 10, API 29 to receive reasonable security updates.",
      "section": "manifest"
    },
    {
      "title": "Debug Enabled For App [android:debuggable=true]",
      "description": "Debugging was enabled on the app which makes it easier for reverse engineers to hook a debugger to it. This allows dumping a stack trace and accessing debugging helper classes.",
      "section": "manifest"
    },
    {
      "title": "Debug configuration enabled. Production builds must not be debuggable.",
      "description": "Debug configuration enabled. Production builds must not be debuggable.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x04c-Tampering-and-Reverse-Engineering.md#debugging-and-tracing\n\nFiles:\njakhar/aseem/diva/BuildConfig.java, line(s) 4,7",
      "section": "code"
    }
  ],
  "warning": [
    {
      "title": "Application Data can be Backed up [android:allowBackup=true]",
      "description": "This flag allows anyone to backup your application data via adb. It allows users who have enabled USB debugging to copy application data off of the device.",
      "section": "manifest"
    },
    {
      "title": "Activity (jakhar.aseem.diva.APICredsActivity) is not Protected. An intent-filter exists.",
      "description": "An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Activity is explicitly exported.",
      "section": "manifest"
    },
    {
      "title": "Activity (jakhar.aseem.diva.APICreds2Activity) is not Protected. An intent-filter exists.",
      "description": "An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Activity is explicitly exported.",
      "section": "manifest"
    },
    {
      "title": "Content Provider (jakhar.aseem.diva.NotesProvider) is not Protected. [android:exported=true]",
      "description": "A Content Provider is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device.",
      "section": "manifest"
    },
    {
      "title": "App uses SQLite Database and execute raw SQL query. Untrusted user input in raw SQL queries can cause SQL Injection. Also sensitive information should be encrypted and written to the database.",
      "description": "App uses SQLite Database and execute raw SQL query. Untrusted user input in raw SQL queries can cause SQL Injection. Also sensitive information should be encrypted and written to the database.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2\n\nFiles:\njakhar/aseem/diva/InsecureDataStorage2Activity.java, line(s) 3,21,32\njakhar/aseem/diva/NotesProvider.java, line(s) 10,11,12,46,47,48,49,50,51,52,53\njakhar/aseem/diva/SQLInjectionActivity.java, line(s) 4,36",
      "section": "code"
    },
    {
      "title": "App creates temp file. Sensitive information should never be written into a temp file.",
      "description": "App creates temp file. Sensitive information should never be written into a temp file.\n\n\nFiles:\njakhar/aseem/diva/InsecureDataStorage3Activity.java, line(s) 26",
      "section": "code"
    },
    {
      "title": "App can read/write to External Storage. Any App can read data written to External Storage.",
      "description": "App can read/write to External Storage. Any App can read data written to External Storage.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage\n\nFiles:\njakhar/aseem/diva/InsecureDataStorage4Activity.java, line(s) 25",
      "section": "code"
    }
  ],
  "info": [
    {
      "title": "The App logs information. Sensitive information should never be logged.",
      "description": "The App logs information. Sensitive information should never be logged.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs\n\nFiles:\njakhar/aseem/diva/AccessControl1Activity.java, line(s) 26\njakhar/aseem/diva/AccessControl2Activity.java, line(s) 30\njakhar/aseem/diva/InsecureDataStorage2Activity.java, line(s) 23,35\njakhar/aseem/diva/InsecureDataStorage3Activity.java, line(s) 35\njakhar/aseem/diva/InsecureDataStorage4Activity.java, line(s) 36\njakhar/aseem/diva/LogActivity.java, line(s) 24\njakhar/aseem/diva/SQLInjectionActivity.java, line(s) 28,48",
      "section": "code"
    }
  ],
  "secure": [
    {
      "title": "This application has no privacy trackers",
      "description": "This application does not include any user or device trackers. Unable to find trackers during static analysis.",
      "section": "trackers"
    }
  ],
  "hotspot": [
    {
      "title": "Found 2 critical permission(s)",
      "description": "Ensure that these permissions are required by the application.\n\nandroid.permission.WRITE_EXTERNAL_STORAGE (dangerous): read/modify/delete external storage contents - Allows an application to write to external storage.\n\nandroid.permission.READ_EXTERNAL_STORAGE (dangerous): read external storage contents - Allows an application to read from external storage.",
      "section": "permissions"
    }
  ],
  "total_trackers": 432,
  "trackers": 0,
  "security_score": 36,
  "app_name": "Diva",
  "file_name": "diva-beta.apk",
  "hash": "82ab8b2193b3cfb1c737e3a786be363a",
  "version_name": "1.0"
}

31878e33c526f9747c9b7ff38954bfcb2acc2a947ce710358…

sieve.apk

2026-06-29T12:30:50.555511+00:00

{
  "high": [
    {
      "title": "Application vulnerable to Janus Vulnerability",
      "description": "Application is signed with v1 signature scheme, making it vulnerable to Janus vulnerability on Android 5.0-8.0, if signed only with v1 signature scheme. Applications running on Android 5.0-7.0 signed with v1, and v2/v3 scheme is also vulnerable.",
      "section": "certificate"
    },
    {
      "title": "Application signed with debug certificate",
      "description": "Application signed with a debug certificate. Production application must not be shipped with a debug certificate.",
      "section": "certificate"
    },
    {
      "title": "App can be installed on a vulnerable unpatched Android version 2.2-2.2.3, [minSdk=8]",
      "description": "This application can be installed on an older version of android that has multiple unfixed vulnerabilities. These devices won't receive reasonable security updates from Google. Support an Android version => 10, API 29 to receive reasonable security updates.",
      "section": "manifest"
    },
    {
      "title": "Debug Enabled For App [android:debuggable=true]",
      "description": "Debugging was enabled on the app which makes it easier for reverse engineers to hook a debugger to it. This allows dumping a stack trace and accessing debugging helper classes.",
      "section": "manifest"
    },
    {
      "title": "Activity (.FileSelectActivity) is vulnerable to StrandHogg 2.0",
      "description": "Activity is found to be vulnerable to StrandHogg 2.0 task hijacking vulnerability. When vulnerable, it is possible for other applications to place a malicious activity on top of the activity stack of the vulnerable application. This makes the application an easy target for phishing attacks. The vulnerability can be remediated by setting the launch mode attribute to \"singleInstance\" and by setting an empty taskAffinity (taskAffinity=\"\"). You can also update the target SDK version (17) of the app to 29 or higher to fix this issue at platform level.",
      "section": "manifest"
    },
    {
      "title": "Activity (.MainLoginActivity) is vulnerable to Android Task Hijacking/StrandHogg.",
      "description": "An Activity should not be having the launch mode attribute set to \"singleTask\". It is then possible for other applications to place a malicious activity on top of the activity stack resulting in Task Hijacking/StrandHogg 1.0 vulnerability. This makes the application an easy target for phishing attacks. The vulnerability can be remediated by setting the launch mode attribute to \"singleInstance\" or by setting an empty taskAffinity (taskAffinity=\"\") attribute. You can also update the target SDK version (17) of the app to 28 or higher to fix this issue at platform level.",
      "section": "manifest"
    },
    {
      "title": "Activity (.PWList) is vulnerable to StrandHogg 2.0",
      "description": "Activity is found to be vulnerable to StrandHogg 2.0 task hijacking vulnerability. When vulnerable, it is possible for other applications to place a malicious activity on top of the activity stack of the vulnerable application. This makes the application an easy target for phishing attacks. The vulnerability can be remediated by setting the launch mode attribute to \"singleInstance\" and by setting an empty taskAffinity (taskAffinity=\"\"). You can also update the target SDK version (17) of the app to 29 or higher to fix this issue at platform level.",
      "section": "manifest"
    },
    {
      "title": "Debug configuration enabled. Production builds must not be debuggable.",
      "description": "Debug configuration enabled. Production builds must not be debuggable.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x04c-Tampering-and-Reverse-Engineering.md#debugging-and-tracing\n\nFiles:\ncom/mwr/example/sieve/BuildConfig.java, line(s) 4,5",
      "section": "code"
    }
  ],
  "warning": [
    {
      "title": "Application Data can be Backed up [android:allowBackup=true]",
      "description": "This flag allows anyone to backup your application data via adb. It allows users who have enabled USB debugging to copy application data off of the device.",
      "section": "manifest"
    },
    {
      "title": "Activity (.FileSelectActivity) is not Protected. [android:exported=true]",
      "description": "An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device.",
      "section": "manifest"
    },
    {
      "title": "Launch Mode of activity (.MainLoginActivity) is not standard.",
      "description": "An Activity should not be having the launch mode attribute set to \"singleTask/singleInstance\" as it becomes root Activity and it is possible for other applications to read the contents of the calling Intent. So it is required to use the \"standard\" launch mode attribute when sensitive information is included in an Intent.",
      "section": "manifest"
    },
    {
      "title": "Activity (.PWList) is not Protected. [android:exported=true]",
      "description": "An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device.",
      "section": "manifest"
    },
    {
      "title": "Service (.AuthService) is not Protected. [android:exported=true]",
      "description": "A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device.",
      "section": "manifest"
    },
    {
      "title": "Service (.CryptoService) is not Protected. [android:exported=true]",
      "description": "A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device.",
      "section": "manifest"
    },
    {
      "title": "Content Provider (.DBContentProvider) is not Protected. [android:exported=true]",
      "description": "A Content Provider is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device.",
      "section": "manifest"
    },
    {
      "title": "Content Provider (.FileBackupProvider) is not Protected. [android:exported=true]",
      "description": "A Content Provider is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device.",
      "section": "manifest"
    },
    {
      "title": "Files may contain hardcoded sensitive information like usernames, passwords, keys etc.",
      "description": "Files may contain hardcoded sensitive information like usernames, passwords, keys etc.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10\n\nFiles:\ncom/mwr/example/sieve/AuthService.java, line(s) 31\ncom/mwr/example/sieve/CryptoService.java, line(s) 17,20\ncom/mwr/example/sieve/MainLoginActivity.java, line(s) 26\ncom/mwr/example/sieve/PWList.java, line(s) 32\ncom/mwr/example/sieve/PWTable.java, line(s) 9,11\ncom/mwr/example/sieve/SettingsActivity.java, line(s) 40\ncom/mwr/example/sieve/ShortLoginActivity.java, line(s) 18\ncom/mwr/example/sieve/WelcomeActivity.java, line(s) 14",
      "section": "code"
    },
    {
      "title": "IP Address disclosure",
      "description": "IP Address disclosure\n\n\nFiles:\ncom/mwr/example/sieve/SettingsActivity.java, line(s) 66",
      "section": "code"
    },
    {
      "title": "App can read/write to External Storage. Any App can read data written to External Storage.",
      "description": "App can read/write to External Storage. Any App can read data written to External Storage.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage\n\nFiles:\ncom/mwr/example/sieve/SettingsActivity.java, line(s) 191",
      "section": "code"
    },
    {
      "title": "App uses SQLite Database and execute raw SQL query. Untrusted user input in raw SQL queries can cause SQL Injection. Also sensitive information should be encrypted and written to the database.",
      "description": "App uses SQLite Database and execute raw SQL query. Untrusted user input in raw SQL queries can cause SQL Injection. Also sensitive information should be encrypted and written to the database.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2\n\nFiles:\ncom/mwr/example/sieve/PWDBHelper.java, line(s) 4,5,18,19",
      "section": "code"
    }
  ],
  "info": [
    {
      "title": "The App logs information. Sensitive information should never be logged.",
      "description": "The App logs information. Sensitive information should never be logged.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs\n\nFiles:\ncom/mwr/example/sieve/AddEntryActivity.java, line(s) 59\ncom/mwr/example/sieve/AuthService.java, line(s) 154,169,178\ncom/mwr/example/sieve/AuthServiceConnector.java, line(s) 73,78,151\ncom/mwr/example/sieve/CryptoService.java, line(s) 57,68,99,114\ncom/mwr/example/sieve/CryptoServiceConnector.java, line(s) 61,67\ncom/mwr/example/sieve/DBParser.java, line(s) 108\ncom/mwr/example/sieve/FileBackupProvider.java, line(s) 57,51\ncom/mwr/example/sieve/MainLoginActivity.java, line(s) 81\ncom/mwr/example/sieve/NetBackupHandler.java, line(s) 61,112,128,134,165,190,82\ncom/mwr/example/sieve/PWList.java, line(s) 197,221,242\ncom/mwr/example/sieve/SettingsActivity.java, line(s) 314,381,382,428\ncom/mwr/example/sieve/ShortLoginActivity.java, line(s) 73,104,109,114,128",
      "section": "code"
    },
    {
      "title": "This App copies data to clipboard. Sensitive data should not be copied to clipboard as other applications can access it.",
      "description": "This App copies data to clipboard. Sensitive data should not be copied to clipboard as other applications can access it.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x04b-Mobile-App-Security-Testing.md#clipboard\n\nFiles:\ncom/mwr/example/sieve/PWList.java, line(s) 6,174",
      "section": "code"
    }
  ],
  "secure": [
    {
      "title": "This application has no privacy trackers",
      "description": "This application does not include any user or device trackers. Unable to find trackers during static analysis.",
      "section": "trackers"
    }
  ],
  "hotspot": [
    {
      "title": "Found 2 critical permission(s)",
      "description": "Ensure that these permissions are required by the application.\n\nandroid.permission.READ_EXTERNAL_STORAGE (dangerous): read external storage contents - Allows an application to read from external storage.\n\nandroid.permission.WRITE_EXTERNAL_STORAGE (dangerous): read/modify/delete external storage contents - Allows an application to write to external storage.",
      "section": "permissions"
    }
  ],
  "total_trackers": 432,
  "trackers": 0,
  "security_score": 34,
  "app_name": "Sieve",
  "file_name": "sieve.apk",
  "hash": "b011baaa8aac34fbdf68691e63a96a08",
  "version_name": "1.0"
}

239e205bc14080472b7555a0081f8909d94fdb0051150fc74…

org.telegram.messenger_v12.7.3-67501_Android-5.0.…

2026-06-29T12:42:55.127411+00:00

a5805c347e792d1f1b490851135fe82414d82037ec3d69f93…

pakpost.apk

2026-06-29T12:30:57.625035+00:00

{
  "high": [
    {
      "title": "Application signed with debug certificate",
      "description": "Application signed with a debug certificate. Production application must not be shipped with a debug certificate.",
      "section": "certificate"
    },
    {
      "title": "Clear text traffic is Enabled For App[android:usesCleartextTraffic=true]",
      "description": "The app intends to use cleartext network traffic, such as cleartext HTTP, FTP stacks, DownloadManager, and MediaPlayer. The default value for apps that target API level 27 or lower is \"true\". Apps that target API level 28 or higher default to \"false\". The key reason for avoiding cleartext traffic is the lack of confidentiality, authenticity, and protections against tampering; a network attacker can eavesdrop on transmitted data and also modify it without being detected.",
      "section": "manifest"
    },
    {
      "title": "Debug Enabled For App [android:debuggable=true]",
      "description": "Debugging was enabled on the app which makes it easier for reverse engineers to hook a debugger to it. This allows dumping a stack trace and accessing debugging helper classes.",
      "section": "manifest"
    },
    {
      "title": "Insecure Implementation of SSL. Trusting all the certificates or accepting self signed certificates is a critical Security Hole. This application is vulnerable to MITM attacks",
      "description": "Insecure Implementation of SSL. Trusting all the certificates or accepting self signed certificates is a critical Security Hole. This application is vulnerable to MITM attacks\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#android-network-apis\n\nFiles:\ncom/a360technologies/adeelnasir/emtts/Views/tarrifs.java, line(s) 96,29,30,31,32,33",
      "section": "code"
    },
    {
      "title": "Debug configuration enabled. Production builds must not be debuggable.",
      "description": "Debug configuration enabled. Production builds must not be debuggable.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x04c-Tampering-and-Reverse-Engineering.md#debugging-and-tracing\n\nFiles:\ncom/a360technologies/adeelnasir/emtts/BuildConfig.java, line(s) 4,7",
      "section": "code"
    }
  ],
  "warning": [
    {
      "title": "App can be installed on a vulnerable Android version 9, minSdk=28]",
      "description": "This application can be installed on an older version of android that has multiple vulnerabilities. Support an Android version => 10, API 29 to receive reasonable security updates.",
      "section": "manifest"
    },
    {
      "title": "Activity (com.a360technologies.adeelnasir.emtts.Views.LogIn) is not Protected. [android:exported=true]",
      "description": "An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device.",
      "section": "manifest"
    },
    {
      "title": "Broadcast Receiver (com.a360technologies.adeelnasir.emtts.Views.fcm.FireBaseBroadcastReceiver) is Protected by a permission, but the protection level of the permission should be checked. Permission: com.google.android.c2dm.permission.SEND [android:exported=true]",
      "description": "A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission.",
      "section": "manifest"
    },
    {
      "title": "Broadcast Receiver (com.google.firebase.iid.FirebaseInstanceIdReceiver) is Protected by a permission, but the protection level of the permission should be checked. Permission: com.google.android.c2dm.permission.SEND [android:exported=true]",
      "description": "A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission.",
      "section": "manifest"
    },
    {
      "title": "Broadcast Receiver (androidx.profileinstaller.ProfileInstallReceiver) is Protected by a permission, but the protection level of the permission should be checked. Permission: android.permission.DUMP [android:exported=true]",
      "description": "A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission.",
      "section": "manifest"
    },
    {
      "title": "The App uses an insecure Random Number Generator.",
      "description": "The App uses an insecure Random Number Generator.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators\n\nFiles:\norg/kobjects/crypt/Crypt.java, line(s) 12",
      "section": "code"
    },
    {
      "title": "Files may contain hardcoded sensitive information like usernames, passwords, keys etc.",
      "description": "Files may contain hardcoded sensitive information like usernames, passwords, keys etc.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10\n\nFiles:\ncom/a360technologies/adeelnasir/emtts/models/LoginRequest.java, line(s) 65\ncom/a360technologies/adeelnasir/emtts/models/RegisterRequest.java, line(s) 93",
      "section": "code"
    },
    {
      "title": "This app may contain hardcoded secrets",
      "description": "The following secrets were identified from the app. Ensure that these are not secrets or private information.\n\"google_crash_reporting_api_key\" : \"AIzaSyDBTwnLrYvgQHhpqDIp98qC-_CRoVxqP_A\"\n\"google_api_key\" : \"AIzaSyDBTwnLrYvgQHhpqDIp98qC-_CRoVxqP_A\"\n\"google_maps_key\" : \"AIzaSyATvBbyDYC0uc4i2VKcYMOez9KtvpR23WQ\"\n258EAFA5-E914-47DA-95CA-C5AB0DC85B11\n23456789abcdefghjkmnpqrstvwxyz",
      "section": "secrets"
    }
  ],
  "info": [
    {
      "title": "The App logs information. Sensitive information should never be logged.",
      "description": "The App logs information. Sensitive information should never be logged.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs\n\nFiles:\ncom/a360technologies/adeelnasir/emtts/Controller/ContactListAdapter.java, line(s) 43,44,45\ncom/a360technologies/adeelnasir/emtts/Controller/LocationServiceHelper.java, line(s) 119,132,136,46,53,61\ncom/a360technologies/adeelnasir/emtts/Controller/PickupListAdapter.java, line(s) 90\ncom/a360technologies/adeelnasir/emtts/Controller/PostalServiceHelper.java, line(s) 127,138,32,47,54,62\ncom/a360technologies/adeelnasir/emtts/Controller/TrackingHelper.java, line(s) 115,142,160,182,187,55,62,70\ncom/a360technologies/adeelnasir/emtts/Controller/TrackingServiceHelper.java, line(s) 108,125,128,131,118,55,62,70,106,107\ncom/a360technologies/adeelnasir/emtts/Views/AuthRepository.java, line(s) 60,74,109,126,140,192,193,207,208\ncom/a360technologies/adeelnasir/emtts/Views/HomeActivity.java, line(s) 178,189,97,103,111,187\ncom/a360technologies/adeelnasir/emtts/Views/HomeFragment.java, line(s) 99\ncom/a360technologies/adeelnasir/emtts/Views/LoginActivity.java, line(s) 319,325\ncom/a360technologies/adeelnasir/emtts/Views/MainActivity.java, line(s) 94,324,335,243,249,257,333,90\ncom/a360technologies/adeelnasir/emtts/Views/MapsActivity.java, line(s) 84,94,85\ncom/a360technologies/adeelnasir/emtts/Views/RegisterActivity.java, line(s) 349,352\ncom/a360technologies/adeelnasir/emtts/Views/RegisterComplaint2.java, line(s) 220,285,170,176,184,234,240,248\ncom/a360technologies/adeelnasir/emtts/Views/RegisterComplaint3.java, line(s) 178,128,134,142\ncom/a360technologies/adeelnasir/emtts/Views/RegisterComplaint4.java, line(s) 136,215,267,270,165,171,179,229,235,243\ncom/a360technologies/adeelnasir/emtts/Views/ReportActivity.java, line(s) 165,63\ncom/a360technologies/adeelnasir/emtts/Views/contact.java, line(s) 124,161,217,104,111,119,160\ncom/a360technologies/adeelnasir/emtts/Views/fcm/FireBaseBroadcastReceiver.java, line(s) 39\ncom/a360technologies/adeelnasir/emtts/Views/fcm/MyFirebaseMessagingService.java, line(s) 39\ncom/a360technologies/adeelnasir/emtts/Views/pickup.java, line(s) 145,180,226,125,132,140,179\ncom/a360technologies/adeelnasir/emtts/Views/tarrifs.java, line(s) 275,110,112,311,338,450,263,273,283,298,306,325,333,351,360,375,448\ncom/directions/route/GoogleParser.java, line(s) 173,179,185\ncom/directions/route/RouteException.java, line(s) 26\ncom/directions/route/XMLParser.java, line(s) 20,29\nio/github/inflationx/calligraphy3/ReflectionUtils.java, line(s) 34,36\nio/github/inflationx/calligraphy3/TypefaceUtils.java, line(s) 30\nio/github/inflationx/viewpump/internal/ReflectionUtils.java, line(s) 52,54\norg/kobjects/crypt/Crypt.java, line(s) 239\norg/kobjects/mime/Decoder.java, line(s) 136\norg/kobjects/pim/PimParser.java, line(s) 47,51,62\norg/kxml2/io/KXmlParser.java, line(s) 563\norg/slf4j/helpers/Util.java, line(s) 81,82,87\norg/xmlpull/v1/XmlPullParserException.java, line(s) 45",
      "section": "code"
    }
  ],
  "secure": [
    {
      "title": "This App uses SSL certificate pinning to detect or  prevent MITM attacks in secure communication channel.",
      "description": "This App uses SSL certificate pinning to detect or  prevent MITM attacks in secure communication channel.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-4\n\nFiles:\ncom/a360technologies/adeelnasir/emtts/Views/RetrofitClient.java, line(s) 39,39",
      "section": "code"
    },
    {
      "title": "Firebase Remote Config disabled",
      "description": "Firebase Remote Config is disabled for https://firebaseremoteconfig.googleapis.com/v1/projects/374862829096/namespaces/firebase:fetch?key=AIzaSyDBTwnLrYvgQHhpqDIp98qC-_CRoVxqP_A. This is indicated by the response: {'state': 'NO_TEMPLATE'}",
      "section": "firebase"
    },
    {
      "title": "This application has no privacy trackers",
      "description": "This application does not include any user or device trackers. Unable to find trackers during static analysis.",
      "section": "trackers"
    }
  ],
  "hotspot": [
    {
      "title": "Found 3 critical permission(s)",
      "description": "Ensure that these permissions are required by the application.\n\nandroid.permission.ACCESS_COARSE_LOCATION (dangerous): coarse (network-based) location - Access coarse location sources, such as the mobile network database, to determine an approximate phone location, where available. Malicious applications can use this to determine approximately where you are.\n\nandroid.permission.ACCESS_FINE_LOCATION (dangerous): fine (GPS) location - Access fine location sources, such as the Global Positioning System on the phone, where available. Malicious applications can use this to determine where you are and may consume additional battery power.\n\nandroid.permission.POST_NOTIFICATIONS (dangerous): allows an app to post notifications. - Allows an app to post notifications",
      "section": "permissions"
    }
  ],
  "total_trackers": 432,
  "trackers": 0,
  "security_score": 47,
  "app_name": "Pakistan Post",
  "file_name": "pakpost.apk",
  "hash": "d763ab66de9f6ce4945d33f1e2435aa6",
  "version_name": "1.0.37"
}

bef5b58e408be434418ab6400d4f7ab0377a467dbc2ddc04c…

app-live-release.apk

2026-07-09T08:05:54.996767+00:00

{
  "high": [
    {
      "title": "Domain config is insecurely configured to permit clear text traffic to these domains in scope",
      "description": "Scope:\ngreendelhi.nic.in\ngreendelhi.aeologic.in\ndpccairdata.com\n182.75.174.13\n\n",
      "section": "network"
    },
    {
      "title": "App can be installed on a vulnerable unpatched Android version 7.0, [minSdk=24]",
      "description": "This application can be installed on an older version of android that has multiple unfixed vulnerabilities. These devices won't receive reasonable security updates from Google. Support an Android version => 10, API 29 to receive reasonable security updates.",
      "section": "manifest"
    },
    {
      "title": "Insecure Implementation of SSL. Trusting all the certificates or accepting self signed certificates is a critical Security Hole. This application is vulnerable to MITM attacks",
      "description": "Insecure Implementation of SSL. Trusting all the certificates or accepting self signed certificates is a critical Security Hole. This application is vulnerable to MITM attacks\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#android-network-apis\n\nFiles:\ncom/aeologic/cctv/Activity/HttpsTrustManager.java, line(s) 45,8,9,10,11,12,13\ncom/aeologic/cctv/Utility/AppController.java, line(s) 109,24,25,26,27,28,29,30",
      "section": "code"
    }
  ],
  "warning": [
    {
      "title": "Application Data can be Backed up [android:allowBackup=true]",
      "description": "This flag allows anyone to backup your application data via adb. It allows users who have enabled USB debugging to copy application data off of the device.",
      "section": "manifest"
    },
    {
      "title": "Broadcast Receiver (com.aeologic.cctv.Receiver.ConnectionChangeReceiver) is not Protected. [android:exported=true]",
      "description": "A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device.",
      "section": "manifest"
    },
    {
      "title": "Service (com.aeologic.cctv.Service.NetworkJobService) is Protected by a permission, but the protection level of the permission should be checked. Permission: android.permission.BIND_JOB_SERVICE [android:exported=true]",
      "description": "A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. It is protected by a permission which is not defined in the analysed application. As a result, the protection level of the permission should be checked where it is defined. If it is set to normal or dangerous, a malicious application can request and obtain the permission and interact with the component. If it is set to signature, only applications signed with the same certificate can obtain the permission.",
      "section": "manifest"
    },
    {
      "title": "Service (com.aeologic.cctv.Service.GPSLocationService) is not Protected. [android:exported=true]",
      "description": "A Service is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device.",
      "section": "manifest"
    },
    {
      "title": "Files may contain hardcoded sensitive information like usernames, passwords, keys etc.",
      "description": "Files may contain hardcoded sensitive information like usernames, passwords, keys etc.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10\n\nFiles:\ncom/bumptech/glide/load/Option.java, line(s) 76\ncom/bumptech/glide/load/engine/DataCacheKey.java, line(s) 36\ncom/bumptech/glide/load/engine/EngineResource.java, line(s) 98\ncom/bumptech/glide/load/engine/ResourceCacheKey.java, line(s) 83\ncom/bumptech/glide/manager/RequestManagerRetriever.java, line(s) 35",
      "section": "code"
    },
    {
      "title": "App can read/write to External Storage. Any App can read data written to External Storage.",
      "description": "App can read/write to External Storage. Any App can read data written to External Storage.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage\n\nFiles:\ncom/aeologic/cctv/Activity/FitnessDetails.java, line(s) 185\ncom/aeologic/cctv/Activity/ResolveActivity.java, line(s) 334,813,864,929,1067\ncom/aeologic/cctv/Activity/SendComplaintActivity.java, line(s) 1493\ncom/aeologic/cctv/Async/DownloadPDFAsyncTask.java, line(s) 69\ncom/aeologic/cctv/OfficersActivities/ManagerSendComplaintActivity.java, line(s) 450,833,886,1150,1201,1267,1331,1567\ncom/aeologic/cctv/Utility/FileUtils.java, line(s) 18\ncom/aeologic/cctv/Utility/Util.java, line(s) 344,251",
      "section": "code"
    },
    {
      "title": "App uses SQLite Database and execute raw SQL query. Untrusted user input in raw SQL queries can cause SQL Injection. Also sensitive information should be encrypted and written to the database.",
      "description": "App uses SQLite Database and execute raw SQL query. Untrusted user input in raw SQL queries can cause SQL Injection. Also sensitive information should be encrypted and written to the database.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2\n\nFiles:\ncom/aeologic/cctv/Database/Database.java, line(s) 6,7,150,197,221,246,265,277,306,341,350,399,436",
      "section": "code"
    },
    {
      "title": "MD5 is a weak hash known to have hash collisions.",
      "description": "MD5 is a weak hash known to have hash collisions.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4\n\nFiles:\ncom/aeologic/cctv/Utility/Util.java, line(s) 125",
      "section": "code"
    },
    {
      "title": "IP Address disclosure",
      "description": "IP Address disclosure\n\n\nFiles:\ncom/afollestad/materialdialogs/BuildConfig.java, line(s) 10",
      "section": "code"
    },
    {
      "title": "This app may contain hardcoded secrets",
      "description": "The following secrets were identified from the app. Ensure that these are not secrets or private information.\n\"API_ADDRESS\" : \"https://maps.googleapis.com/maps/api/geocode/json?key=\"\n\"audiorec_key\" : \"audiorec\"\n\"bitrate_key\" : \"bitrate\"\n\"filename_key\" : \"filename\"\n\"fileprefix_key\" : \"fileprefix\"\n\"fps_key\" : \"fps\"\n\"mapApiKey\" : \"AIzaSyAelBz_zoabKURi5rdrDUybmn0vWQLNAGg\"\n\"password\" : \"Password\"\n\"preference_anonymous_statistics_key\" : \"usage_statistics\"\n\"preference_app_chooser_key\" : \"app_chosen\"\n\"preference_crash_reporting_key\" : \"crash_reporting\"\n\"preference_enable_target_app_key\" : \"enable_app_target\"\n\"preference_floating_control_key\" : \"floating_controls\"\n\"preference_floating_control_size_key\" : \"floatingControlSize\"\n\"preference_save_gif_key\" : \"save_gif\"\n\"preference_shake_gesture_key\" : \"shake_gesture\"\n\"preference_show_touch_key\" : \"touch_pointer\"\n\"preference_theme_key\" : \"theme\"\n\"res_key\" : \"resolution\"\n\"savelocation_key\" : \"savelocation\"\n\"API_ADDRESS\" : \"https://maps.googleapis.com/maps/api/geocode/json?key=\"\n\"audiorec_key\" : \"audiorec\"\n\"bitrate_key\" : \"bitrate\"\n\"filename_key\" : \"filename\"\n\"fileprefix_key\" : \"fileprefix\"\n\"fps_key\" : \"fps\"\n\"mapApiKey\" : \"AIzaSyAelBz_zoabKURi5rdrDUybmn0vWQLNAGg\"\n\"password\" : \"पासवर्ड\"\n\"preference_anonymous_statistics_key\" : \"usage_statistics\"\n\"preference_app_chooser_key\" : \"app_chosen\"\n\"preference_crash_reporting_key\" : \"crash_reporting\"\n\"preference_enable_target_app_key\" : \"enable_app_target\"\n\"preference_floating_control_key\" : \"floating_controls\"\n\"preference_floating_control_size_key\" : \"floatingControlSize\"\n\"preference_save_gif_key\" : \"save_gif\"\n\"preference_shake_gesture_key\" : \"shake_gesture\"\n\"preference_show_touch_key\" : \"touch_pointer\"\n\"preference_theme_key\" : \"theme\"\n\"res_key\" : \"resolution\"\n\"savelocation_key\" : \"savelocation\"\noV1plLkE6nUm5a8dDYuCvtK3XQ1BOo4RLQ1WCg\nJLnvTRjSrVAQKqHHJ9hgGWSptJpzzsxD5EmfGC5gPFvCQil\nY5Pd4d6b2WuiIIkNde9SiHMMqrTJpAl5OxEIbUenJ9t6D3XW0Rt6O06CT7SGmQrjtq2rrZRfoni7bP900K89IziwzLARJktqs\nEcm6riDqz1nWmFugnlB4MP72gFpYL4J9gArlRGV0ClmUey8GwqxdEJ8vFonTYDPulXWv1v8NU4SU0w30AdhsPQYBkOVHB7GH7Blepqk6QxhfdHYM8wY9d1qN087tKYPfZusk8XOhPL\nFvsVMaSmQQhHyM4ES1hQiQgPO7CRvp0v2B6q8ojQw\nWLl4mWJHdkkyoHqTYub6qVP7aeXRPOkm2kphhKL2wB9bC4\neyJhenAiOiJlQ3VIazRwampjZGszMWUwZjZ1ZnlINDJwNWgxczM5RCIsImd0eSI6ImNsaWVudC1jcmVkZW50aWFscyIsImlhdCI6MTYyMjgyODM2NywiZXhwIjozNzcwMzEyMDE0LCJhdWQiOiJodHRwczovL2F1cmEtcGFuaWMvIiwiaXNzIjoiaHR0cHM6Ly9hdXJhLnNlcnZpY2VzIiwic3ViIjoiZUN1SGs0cGpqY2RrMzFlMGY2dWZ5SDQycDVoMXMzOURAY2xpZW50cyJ9\n7qiLQ6QSKv7curVDwvSpplffUPji9dNqztdQjTNkaZHXxgWZP93sJfwKzg",
      "section": "secrets"
    }
  ],
  "info": [
    {
      "title": "The App logs information. Sensitive information should never be logged.",
      "description": "The App logs information. Sensitive information should never be logged.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs\n\nFiles:\ncom/aeologic/cctv/Activity/ComplaintListActivity.java, line(s) 134,550,130,267,282,345,520,576,405\ncom/aeologic/cctv/Activity/DoneDetailActivity.java, line(s) 186,196,238,270,382,686,699,719,725,734,752\ncom/aeologic/cctv/Activity/FeedbackActivity.java, line(s) 141,88\ncom/aeologic/cctv/Activity/FeedbackDetailActivity.java, line(s) 64,76\ncom/aeologic/cctv/Activity/FeedbackListActivity.java, line(s) 195,290,149\ncom/aeologic/cctv/Activity/FitnessDetails.java, line(s) 142,146,149,152,64\ncom/aeologic/cctv/Activity/HomeActivity.java, line(s) 417,212,221,244,251,369,465,476,479,487,520,647\ncom/aeologic/cctv/Activity/InProgressDetailActivity.java, line(s) 80,199,203\ncom/aeologic/cctv/Activity/OffenceAnalyticsActivity.java, line(s) 395,472,616,118,365,512,238\ncom/aeologic/cctv/Activity/OtpActivity.java, line(s) 164,179\ncom/aeologic/cctv/Activity/PassCodeActivity.java, line(s) 399,365,431\ncom/aeologic/cctv/Activity/ProfileActivity.java, line(s) 107,171\ncom/aeologic/cctv/Activity/ReOpenActivity.java, line(s) 252,94,95,151,191,192,248,282\ncom/aeologic/cctv/Activity/RegistrationActivity.java, line(s) 150,208,252\ncom/aeologic/cctv/Activity/ReportFeedBackActivity.java, line(s) 65,66,91\ncom/aeologic/cctv/Activity/ResolveActivity.java, line(s) 337,866,931,221,260,345,678,682,698,706,815,943,970,976,985,990,1011,1054\ncom/aeologic/cctv/Activity/SendComplaintActivity.java, line(s) 297,299,335,718,1108,1114,1515,1866,331,333,336,354,359,376,418,425,437,509,545,580,673,674,681,685,687,728,1080,1084,1106,1110,1134,1177,1198,1214,1222,1436,1475,1504,1505,1510,1517,1526,1531,1544,1699,1774,1781,1784,1796,1801,1802,1814,1820,1828,1892,1975,1744\ncom/aeologic/cctv/Activity/SplashScreen.java, line(s) 67,190,195,216,219,109,133\ncom/aeologic/cctv/Adapter/FeedbackListAdapter.java, line(s) 73,85,88\ncom/aeologic/cctv/Adapter/InProgressAdapter.java, line(s) 50,32,38,45,46\ncom/aeologic/cctv/Adapter/OffenceAnalyticsAdapter.java, line(s) 84,40\ncom/aeologic/cctv/Adapter/OffenceListAdapter.java, line(s) 52,58,83\ncom/aeologic/cctv/Async/ChangePasswordAsyncTask.java, line(s) 58,67,114\ncom/aeologic/cctv/Async/DoneDetailsAsync.java, line(s) 232,238,243,266,286,45,52,290\ncom/aeologic/cctv/Async/DownloadImagesAsync.java, line(s) 42,81,84,49,51,54,55\ncom/aeologic/cctv/Async/DownloadPDFAsyncTask.java, line(s) 78,93,116,132,151,170,183,192\ncom/aeologic/cctv/Async/GetOtpAsyncTask.java, line(s) 84,221,222,300,77,197,266\ncom/aeologic/cctv/Async/GetRCDetailsAsync.java, line(s) 57,49\ncom/aeologic/cctv/Async/GetZoneAsyncTask.java, line(s) 60,52\ncom/aeologic/cctv/Async/ImageLoadTask.java, line(s) 40\ncom/aeologic/cctv/Async/ImageLoadTask1.java, line(s) 43\ncom/aeologic/cctv/Async/ImageLoadTask2.java, line(s) 42\ncom/aeologic/cctv/Async/LoginAsyncTask.java, line(s) 50,124,78,161,53,64,154\ncom/aeologic/cctv/Async/LogoutAsyncTask.java, line(s) 50,44\ncom/aeologic/cctv/Async/LogoutAsyncTask1.java, line(s) 50,44\ncom/aeologic/cctv/Async/RejectReportAsyncTask.java, line(s) 66,109,55\ncom/aeologic/cctv/Async/ResolveReportAsyncTask.java, line(s) 62,66,70,77,122,54\ncom/aeologic/cctv/Async/SendDetailsAsyncTask.java, line(s) 89,94,99,123,128,178,196,199,80\ncom/aeologic/cctv/Async/TestAsync.java, line(s) 55,64,38,43\ncom/aeologic/cctv/Async/UpdatePersonalInfo.java, line(s) 67,56,85,106\ncom/aeologic/cctv/Connection/ConnectionDetector.java, line(s) 19\ncom/aeologic/cctv/Database/Database.java, line(s) 57,59,60,62,63,65,94,95,163,349\ncom/aeologic/cctv/Fragment/DoneFragment.java, line(s) 164,228,240,106\ncom/aeologic/cctv/Fragment/InProgressFragment.java, line(s) 44\ncom/aeologic/cctv/GooglePlaceAPI/DownloadLatLongAsync.java, line(s) 41,60,61,71,74\ncom/aeologic/cctv/GooglePlaceAPI/GetAddressAsyncTask.java, line(s) 66\ncom/aeologic/cctv/OfficersActivities/ManagerComplaintListActivity.java, line(s) 148,183,618,623,708,731,733,735,741,799,823,144,284,299,412,526,527,569,696,786,472\ncom/aeologic/cctv/OfficersActivities/ManagerDoneDetailActivity.java, line(s) 192,672,188,199,274,306,484,635,732,815,828,848,854,864,882,1006\ncom/aeologic/cctv/OfficersActivities/ManagerDoneDetailsAsync.java, line(s) 228,234,239,262,282,46,53,286\ncom/aeologic/cctv/OfficersActivities/ManagerForgotPasswordActivity.java, line(s) 87\ncom/aeologic/cctv/OfficersActivities/ManagerForwardComplaintActivity.java, line(s) 111,302,539,547,562,627,631,635,718,89,378,421,422,464,507,508,548,667,668,705\ncom/aeologic/cctv/OfficersActivities/ManagerFullImageActivity.java, line(s) 31\ncom/aeologic/cctv/OfficersActivities/ManagerHomeActivity.java, line(s) 148,160,252,453,464,467,508,588,630\ncom/aeologic/cctv/OfficersActivities/ManagerOffenceListAdapter.java, line(s) 41,47\ncom/aeologic/cctv/OfficersActivities/ManagerProfileActivity.java, line(s) 73,136\ncom/aeologic/cctv/OfficersActivities/ManagerSendComplaintActivity.java, line(s) 267,353,452,836,889,1203,1269,1705,263,265,268,279,284,415,460,495,535,539,541,559,885,902,906,956,998,1019,1035,1043,1152,1281,1313,1342,1343,1347,1353,1362,1367,1388,1488,1539,1614,1621,1624,1636,1641,1642,1653,1659,1667,1584\ncom/aeologic/cctv/OfficersActivities/ManagerSendDetailsAsyncTask.java, line(s) 85,90,95,117,167,185,188,76\ncom/aeologic/cctv/OfficersActivities/UpdateMangerInfo.java, line(s) 66,84,105\ncom/aeologic/cctv/OfficersActivities/WebNewActivity.java, line(s) 26\ncom/aeologic/cctv/Receiver/ConnectionChangeReceiver.java, line(s) 23,19\ncom/aeologic/cctv/Service/DownloadService.java, line(s) 88,91,117,40,60,63,67,68\ncom/aeologic/cctv/Service/GPSLocationService.java, line(s) 76,79,85,88,104\ncom/aeologic/cctv/Service/NetworkJobService.java, line(s) 19\ncom/aeologic/cctv/Service/SMSService.java, line(s) 20,28\ncom/aeologic/cctv/Service/UploadOfflineSurvey.java, line(s) 59,149,40,55,82,112\ncom/aeologic/cctv/Utility/AppController.java, line(s) 44\ncom/aeologic/cctv/Utility/FileUtils.java, line(s) 20\ncom/aeologic/cctv/Utility/MultipartUtility.java, line(s) 29,65\ncom/aeologic/cctv/Utility/TouchImageView.java, line(s) 213\ncom/aeologic/cctv/Utility/Util.java, line(s) 303,346,68,207,228,263\ncom/aeologic/cctv/Utility/VolleyMultipartRequest.java, line(s) 39,49\ncom/afollestad/materialcamera/internal/BaseCameraFragment.java, line(s) 95\ncom/afollestad/materialcamera/internal/Camera2Fragment.java, line(s) 392,456,473,535,552,609,626,686,703,760,777,1131,398\ncom/afollestad/materialcamera/internal/CameraFragment.java, line(s) 251,262,529\ncom/afollestad/materialcamera/internal/CameraPreview.java, line(s) 35,57\ncom/afollestad/materialcamera/internal/VideoStreamView.java, line(s) 156,276,290\ncom/afollestad/materialcamera/util/Degrees.java, line(s) 110\ncom/afollestad/materialcamera/util/ImageUtil.java, line(s) 94\ncom/afollestad/materialdialogs/MaterialDialog.java, line(s) 603\ncom/bumptech/glide/Glide.java, line(s) 217,226,144,143,216,223,256,257\ncom/bumptech/glide/disklrucache/DiskLruCache.java, line(s) 102\ncom/bumptech/glide/gifdecoder/GifHeaderParser.java, line(s) 237,276,236,275\ncom/bumptech/glide/gifdecoder/StandardGifDecoder.java, line(s) 154,172,191,153,171,190,212,221\ncom/bumptech/glide/load/data/AssetPathFetcher.java, line(s) 38,37\ncom/bumptech/glide/load/data/HttpUrlFetcher.java, line(s) 57,136,56,60,66,71,135,68,72\ncom/bumptech/glide/load/data/LocalUriFetcher.java, line(s) 40,39\ncom/bumptech/glide/load/data/mediastore/ThumbFetcher.java, line(s) 54,53\ncom/bumptech/glide/load/data/mediastore/ThumbnailStreamOpener.java, line(s) 65,120,64,119\ncom/bumptech/glide/load/engine/DecodeJob.java, line(s) 217,216,371,417,463\ncom/bumptech/glide/load/engine/DecodePath.java, line(s) 60,61\ncom/bumptech/glide/load/engine/Engine.java, line(s) 29,113\ncom/bumptech/glide/load/engine/GlideException.java, line(s) 80\ncom/bumptech/glide/load/engine/SourceGenerator.java, line(s) 93,94\ncom/bumptech/glide/load/engine/bitmap_recycle/LruArrayPool.java, line(s) 93,145,94,146\ncom/bumptech/glide/load/engine/bitmap_recycle/LruBitmapPool.java, line(s) 147,177,185,209,92,99,146,156,176,184,198,208,217,93,100,157,223,199\ncom/bumptech/glide/load/engine/cache/DiskLruCacheWrapper.java, line(s) 54,64,78,84,114,126,55,79,67,85,115,127\ncom/bumptech/glide/load/engine/cache/MemorySizeCalculator.java, line(s) 52,51\ncom/bumptech/glide/load/engine/executor/GlideExecutor.java, line(s) 186,183\ncom/bumptech/glide/load/engine/executor/RuntimeCompat.java, line(s) 40,39\ncom/bumptech/glide/load/engine/prefill/BitmapPreFillRunner.java, line(s) 72,71\ncom/bumptech/glide/load/model/ByteBufferEncoder.java, line(s) 22,21\ncom/bumptech/glide/load/model/ByteBufferFileLoader.java, line(s) 64,63\ncom/bumptech/glide/load/model/FileLoader.java, line(s) 70,69\ncom/bumptech/glide/load/model/ResourceLoader.java, line(s) 41,44\ncom/bumptech/glide/load/model/StreamEncoder.java, line(s) 41,40\ncom/bumptech/glide/load/resource/ImageDecoderResourceDecoder.java, line(s) 66,67\ncom/bumptech/glide/load/resource/bitmap/BitmapEncoder.java, line(s) 72,71,88,89\ncom/bumptech/glide/load/resource/bitmap/BitmapImageDecoderResourceDecoder.java, line(s) 20,21\ncom/bumptech/glide/load/resource/bitmap/DefaultImageHeaderParser.java, line(s) 118,125,144,152,184,194,206,220,234,240,244,249,255,259,117,124,143,151,183,193,205,219,233,239,243,248,254,258\ncom/bumptech/glide/load/resource/bitmap/Downsampler.java, line(s) 224,343,383,173,197,223,307,342,382,174,308,409\ncom/bumptech/glide/load/resource/bitmap/DrawableToBitmapConverter.java, line(s) 47,53,48,54\ncom/bumptech/glide/load/resource/bitmap/HardwareConfigState.java, line(s) 136,137\ncom/bumptech/glide/load/resource/bitmap/TransformationUtils.java, line(s) 174,117,126,133,147,152,171,118,127,134,135,136,137,148,153\ncom/bumptech/glide/load/resource/bitmap/VideoDecoder.java, line(s) 141,138\ncom/bumptech/glide/load/resource/gif/ByteBufferGifDecoder.java, line(s) 82,87,92,101,83,88,93,102\ncom/bumptech/glide/load/resource/gif/GifDrawableEncoder.java, line(s) 27,28\ncom/bumptech/glide/load/resource/gif/StreamGifDecoder.java, line(s) 57,60\ncom/bumptech/glide/manager/DefaultConnectivityMonitor.java, line(s) 24,23,54,72,55,73\ncom/bumptech/glide/manager/DefaultConnectivityMonitorFactory.java, line(s) 17,16\ncom/bumptech/glide/manager/RequestManagerFragment.java, line(s) 127,128\ncom/bumptech/glide/manager/RequestManagerRetriever.java, line(s) 325,326,334\ncom/bumptech/glide/manager/RequestTracker.java, line(s) 27,28\ncom/bumptech/glide/manager/SupportRequestManagerFragment.java, line(s) 134,141,135,142\ncom/bumptech/glide/module/ManifestParser.java, line(s) 24,31,42,47,23,30,35,41,46,36\ncom/bumptech/glide/request/SingleRequest.java, line(s) 437,56,565,485\ncom/bumptech/glide/request/target/CustomViewTarget.java, line(s) 283,284,300,301\ncom/bumptech/glide/request/target/ViewTarget.java, line(s) 281,282,298,299\ncom/bumptech/glide/signature/ApplicationVersionSignature.java, line(s) 48\ncom/bumptech/glide/util/ContentLengthInputStream.java, line(s) 30,29\ncom/bumptech/glide/util/pool/FactoryPools.java, line(s) 92,93\ncom/github/rtoshiro/view/video/FullscreenVideoLayout.java, line(s) 120,125,152,174,183,210,221,231,239,259,267,307,313,319\ncom/github/rtoshiro/view/video/FullscreenVideoView.java, line(s) 92,99,105,112,123,144,161,167,178,183,198,204,214,221,264,279,288,300,321,339,359,410,446,454,607,608,609,677,687,693,704,714,806,822,524,529\nme/zhanghai/android/materialprogressbar/BaseProgressLayerDrawable.java, line(s) 74\nme/zhanghai/android/materialprogressbar/MaterialProgressBar.java, line(s) 121,364,374",
      "section": "code"
    }
  ],
  "secure": [
    {
      "title": "This App uses SSL certificate pinning to detect or  prevent MITM attacks in secure communication channel.",
      "description": "This App uses SSL certificate pinning to detect or  prevent MITM attacks in secure communication channel.\nhttps://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-4\n\nFiles:\ncom/aeologic/cctv/Utility/AppController.java, line(s) 133,107,131,133,129,130,130",
      "section": "code"
    },
    {
      "title": "This application has no privacy trackers",
      "description": "This application does not include any user or device trackers. Unable to find trackers during static analysis.",
      "section": "trackers"
    }
  ],
  "hotspot": [
    {
      "title": "Found 8 critical permission(s)",
      "description": "Ensure that these permissions are required by the application.\n\nandroid.permission.CAMERA (dangerous): take pictures and videos - Allows application to take pictures and videos with the camera. This allows the application to collect images that the camera is seeing at any time.\n\nandroid.permission.READ_PHONE_NUMBERS (dangerous): allows reading of the device's phone number(s). - Allows read access to the device's phone number(s). This is a subset of the capabilities granted by READ_PHONE_STATE but is exposed to instant applications.\n\nandroid.permission.READ_PHONE_STATE (dangerous): read phone state and identity - Allows the application to access the phone features of the device. An application with this permission can determine the phone number and serial number of this phone, whether a call is active, the number that call is connected to and so on.\n\nandroid.permission.READ_EXTERNAL_STORAGE (dangerous): read external storage contents - Allows an application to read from external storage.\n\nandroid.permission.ACCESS_COARSE_LOCATION (dangerous): coarse (network-based) location - Access coarse location sources, such as the mobile network database, to determine an approximate phone location, where available. Malicious applications can use this to determine approximately where you are.\n\nandroid.permission.RECORD_AUDIO (dangerous): record audio - Allows application to access the audio record path.\n\nandroid.permission.ACCESS_FINE_LOCATION (dangerous): fine (GPS) location - Access fine location sources, such as the Global Positioning System on the phone, where available. Malicious applications can use this to determine where you are and may consume additional battery power.\n\nandroid.permission.WRITE_EXTERNAL_STORAGE (dangerous): read/modify/delete external storage contents - Allows an application to write to external storage.",
      "section": "permissions"
    },
    {
      "title": "Found 2 certificate/key file(s)",
      "description": "Ensure that these files does not contain any private information or sensitive key materials.\n\nres/CK.crt\nres/3G.crt",
      "section": "files"
    }
  ],
  "total_trackers": 432,
  "trackers": 0,
  "security_score": 49,
  "app_name": "Green Delhi App",
  "file_name": "app-live-release.apk",
  "hash": "2933ca74baf976f47ea752417b6f6976",
  "version_name": "1.9.1"
}