Mobile App Looting / Analysis

[TheTechromancer]

Can we identify mobile apps via the target domain? Is there a search engine / API where we can put in the domain and get back a list of google play store links?

If we can find a service like this, we could create a family of modules for downloading .apk files and looting them with trufflehog etc. (They would also be useful for subdomain extraction)

[Sh4d0wHunt3rX]

Not sure if these can help in any way, appbrain.com or apkpure.com . Still needs to check manually to see which app is official. Maybe possible to give the link of the mobile app directly to the module ourselves by config switch, or maybe something like github_org looks for mobile app links on the pages, if it found it, then something like git_clone, download them.

[Sh4d0wHunt3rX]

Maybe helpful
https://github.com/n0mi1k/apk2url
https://github.com/kurodenjiro/api.apkpure

[domwhewell-sage]

The play store app details page contains a appstore:developer_url meta tag. We can probably pop in the ORG name into the play store browse to each of the apps that are returned and validate if they are in-scope by checking for in-scope domain names in that meta tag

[TheTechromancer]

I like where this is going

[domwhewell-sage]

In working on this validation function

async def validate_apk(self, apk_name):
    in_scope = False
    url = f"{self.base_url}/store/apps/details?id={apk_name}"
    r = await self.helpers.request(url)
    if r is None:
        return in_scope
    status_code = getattr(r, "status_code", 0)
    try:
        html = self.helpers.beautifulsoup(r.content, "html.parser")
    except Exception as e:
        self.warning(f"Failed to parse html response from {r.url} (HTTP status: {status_code}): {e}")
        return in_scope
    # The developer meta tag usually contains the developer's URL
    developer_meta = html.find("meta", attrs={"name": "appstore:developer_url"})
    developer_url = developer_meta['content'] if developer_meta else None
    if self.scan.in_scope(developer_url):
        in_scope = True
        return in_scope
    # If the developers URL is left blank then a support email is usually provided
    links = html.find_all("a", href=True)
    emails = [a['href'].split('mailto:')[1] for a in links if 'mailto:' in a['href']]
    for email in emails:
        if self.scan.in_scope(email):
            in_scope = True
            break
    return in_scope

And thinking of adding some regex to code_repository.py to extract playstore links out of web page responses

Edit: Im also thinking of adding a MOBILE_APP event type which would contain the app_id and url of the application in the play store. A module such as apkpure would consume this and download the app_id from its store (Since you cant get apks directly from the playstore)

[domwhewell-sage]

WIP PR: #1831

[domwhewell-sage]

Update

A new module has been created to enumerate official android apps from the google play store #1831

Todo

• Enhance code_repository.py to extract google play store links from URL_UNVERIFIED
  • Without url_querystring_remove=False URL_UNVERIFIED will not include the app_id (as it is a query parameter) which means code_repository will not re-raise it an event without that config setting
  • The _data_validator of the CODE_REPOSITORY event strips the querystring even when url_querystring_remove=False is supplied
• Create a new module to download MOBILE_APP events from apkpure(?) New Module: APK pure #1851
• Create a new module to extract apks with jadx
• Folder gets ingested by trufflehog to find API secrets