Listen to this Post
Introduction:
In the escalating battle for mobile application security, static analysis tools are indispensable for developers and security researchers. The release of reAVS (reinvented Android Vulnerability Scanner) marks a significant evolution, transforming a passion project into a production-ready, open-source tool designed to comprehensively scan Android APKs for severe security flaws. By automating the detection of issues from Intent redirection to weak cryptography, reAVS empowers professionals to proactively harden their applications against exploitation.
Learning Objectives:
- Install and configure reAVS on a Linux-based security workstation.
- Execute a comprehensive static analysis scan on a target APK file.
- Interpret scan results to identify and understand critical vulnerability classes like WebView hijacking and Content Provider SQL injection.
You Should Know:
- Installing and Configuring reAVS for Your Security Lab
Before diving into scans, a proper environment is crucial. reAVS is a Python-based tool, requiring specific dependencies to function correctly.
Step-by-step guide:
Step 1 – Clone the Repository: First, obtain the tool from its public GitHub repository.
git clone https://github.com/aimar-sechan-adhitya/reAVS.git cd reAVS
(Note: The actual GitHub URL was shared as a LinkedIn shortlink lnkd.in/ge9guvvz. The command above uses a placeholder; replace with the actual repo URL once resolved.)
Step 2 – Set Up a Python Virtual Environment: Isolate dependencies to avoid conflicts.
python3 -m venv reavs-env source reavs-env/bin/activate
Step 3 – Install Dependencies: Use the provided requirements file.
pip install -r requirements.txt
Step 4 – Prepare the APK: Ensure you have the APK file to test, either from a build process or a legally obtained target for research.
cp /path/to/your/target.apk ./test_apks/
What this does: This setup creates a controlled, reproducible environment for running reAVS. The virtual environment ensures that library versions for `androguard` (which reAVS likely uses for APK decomposition) and other dependencies do not interfere with system-wide packages.
2. Running a Baseline Vulnerability Scan
The core function of reAVS is to perform a static analysis sweep. This does not execute the app but dissects its components and code for known insecure patterns.
Step-by-step guide:
Step 1 – Execute the Scanner: Run the tool against your target APK.
python3 reavs.py -a ./test_apks/target.apk -o ./scan_report.json
-a: Specifies the path to the APK file.
-o: Defines the output file for the JSON-formatted report.
Step 2 – Review Console Output: The tool will print progress, indicating decompilation stages and check categories being analyzed (e.g., “Checking for Intent Redirection…”, “Analyzing Crypto usage…”).
Step 3 – Parse the JSON Report: The structured output contains findings categorized by vulnerability type, along with file paths and code snippets.
cat ./scan_report.json | python3 -m json.tool | less
3. Identifying and Exploiting Intent Redirection Vulnerabilities
Intent redirection is a critical flaw where an app exposes an exported component that can be fed a malicious Intent by a third-party app, potentially leading to data theft or privilege escalation.
Step-by-step guide:
Step 1 – Locate Findings: In your scan_report.json, find the `”intent_redirection”` section. It will list vulnerable Activity classes.
Step 2 – Analyze the Vulnerable Code: reAVS highlights the problematic line. For example:
// In VulnerableActivity.java
Intent forward = (Intent) getIntent().getParcelableExtra("forward_intent");
startActivity(forward); // Tainted Intent is launched
Step 3 – Craft a Proof-of-Concept Exploit: You can demonstrate this using `adb` with an Android emulator or device.
adb shell am start -n com.vulnerable.app/.VulnerableActivity \ --es "forward_intent" 'intent:Intent;component=com.vulnerable.app/.AdminActivity;action=android.intent.action.DELETE;end'
Step 4 – Mitigation: The fix involves validating the destination component and sanitizing the incoming Intent.
Intent forward = getIntent().getParcelableExtra("forward_intent");
if (forward != null && forward.getComponent() != null && "com.vulnerable.app".equals(forward.getComponent().getPackageName())) {
startActivity(forward);
}
4. Detecting Content Provider SQL Injection Flaws
Content Providers that use raw SQL queries with user-controlled input are susceptible to injection, potentially allowing an attacker to read, modify, or delete app data.
Step-by-step guide:
Step 1 – Review Scanner Output: Check the `”contentprovider_sql_injection”` section of the report.
Step 2 – Understand the Pattern: reAVS flags methods like `query()` where selection arguments are improperly concatenated.
// Vulnerable query
Cursor c = db.rawQuery("SELECT FROM users WHERE id = " + userInput, null);
Step 3 – Test the Vulnerability: If the Provider is exported, you can probe it from another app context using the `content` command.
adb shell content query --uri content://com.vulnerable.app.provider/users \ --where "id=1 OR 1=1--"
Step 4 – Implement Parameterized Queries: The secure alternative is to use parameterized statements.
String selection = "id = ?";
String[] selectionArgs = { userInput };
Cursor c = db.query("users", null, selection, selectionArgs, null, null, null);
5. Auditing Cryptographic Misconfigurations
Weak or misapplied cryptography is alarmingly common. reAVS checks for patterns like ECB mode, static Initialization Vectors (IVs), and hardcoded keys.
Step-by-step guide:
Step 1 – Examine Crypto Findings: Look at the `”crypto_issues”` array in the report. An entry might state: `”Uses ECB mode for encryption, which is not semantically secure.”`
Step 2 – Locate the Insecure Code:
Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
cipher.init(Cipher.ENCRYPT_MODE, key);
Step 3 – Understand the Risk: ECB mode produces identical ciphertext for identical plaintext blocks, revealing patterns. A hardcoded IV (byte[] iv = {0,0,...}) in CBC mode makes the cipher vulnerable to dictionary attacks.
Step 4 – Apply Best Practices: Enforce secure algorithms and proper random generation.
// Use GCM mode for authenticated encryption
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
SecureRandom random = new SecureRandom();
byte[] iv = new byte[bash]; // GCM recommended IV length
random.nextBytes(iv);
GCMParameterSpec parameterSpec = new GCMParameterSpec(128, iv);
cipher.init(Cipher.ENCRYPT_MODE, key, parameterSpec);
What Undercode Say:
- Automation Democratizes Deep Security Audits: Tools like reAVS lower the barrier to entry for sophisticated static analysis, allowing developer teams without dedicated AppSec personnel to integrate vulnerability checks into their CI/CD pipelines.
- The Detail is in the Remediation: While detection is powerful, the true value is unlocked by the developer’s or researcher’s ability to understand the flagged code pattern and implement the correct, context-aware fix—not just any fix.
Analysis: reAVS represents the maturation of open-source Android security tooling, moving from proof-of-concept scripts to structured, extensible frameworks. Its focus on high-impact vulnerability classes aligns perfectly with the OWASP Mobile Top 10. The call for contributions suggests a roadmap towards even greater coverage, potentially integrating with SAST platforms or adding taint-flow analysis for more complex vulnerability discovery. For the security community, the tool serves as both a practical scanner and an educational resource, clearly illustrating common coding pitfalls that lead to severe breaches.
Prediction:
The proliferation of accessible, high-quality tools like reAVS will accelerate a shift-left movement in mobile app security, making basic vulnerability scanning a standard part of the development lifecycle. In the next 2-3 years, we can expect these tools to incorporate AI-assisted code reasoning, significantly reducing false positives and uncovering novel, complex vulnerability chains that traditional pattern-matching misses. This will force attackers to find more subtle, logic-based flaws, raising the overall security baseline and fundamentally changing the mobile attack landscape.
▶️ Related Video (84% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Aimardcr Androidsecurity – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
