Android is one of the most widely used mobile operating system, owned by Google Inc. The platform changed the Market scenario by becoming the most popular and widely used mobile OS. It has completely changed the view of mobile and had come up with extraordinary features which the users love to operate. Its interface is good and is user handy. User feels very comfortable while using it. The OS uses touch inputs that loosely correspond to real-world actions, like swiping, tapping, pinching, and reverse pinching to manipulate on-screen objects.
Apart from the normal mobile user, tech guys also like its flexible features that allow them to do various new tasks. But its security issues are also the main concern. Recently there were many cyber attacks targeting Android users which were reported.
So here is some the tools that are meant for the security testers, ethical hackers and pentesting. Most of you might be familiar with the tools discussed but others can find some new things also. So top 10 Android tools that are meant for hacking and hackers are given as:-
Hackode
The hacker’s toolbox is an application for penetration tester, ethical hackers, IT administrators and cyber security professionals to perform different tasks like reconnaissance, scanning performing exploits etc. This Application contains other different tools like Google Hacking, Google Dorks, Whois, Scanning, Ping, Traceroute, DNS lookup, IP, MX Records, DNS Dig, and Exploits Security Rss Feed.
Androrat
Androrat is a client/server application developed in Java Android for the client side and in Java/Swing for the Server. The name Androrat is a mixture of android and RAT {Remote Administration Tool}. The goal of the application is to give the control of the Android system remotely and retrieve information from it. It has additional feature which help to get contacts, get call logs, get all messages, location by GPS/Network, monitoring received messages in live, monitoring phone state in live, take a picture from the camera, stream sound from microphone, streaming video, send a text message, make call, open an URL in the default browser and vibrate the phone.
APKInspector
APKinspector is a powerful GUI tool for analysts to analyse the Android applications. The goal of this project is to aid analysts and reverse engineers to visualize compiled Android packages and their corresponding DEX code. APKInspector provides both analysis functions and graphic features for the users to gain deep insight into the malicious apps. Its helps in UI Improvement have automatic installation, Fine-grained Graph View to Source View, Call Graph, Navigation, Better display of Control Flow Graph. Its new features are Static Instrumentation and Combine Permission Analysis.
DroidBox
DroidBox is developed to offer dynamic analysis of Android applications. This application helps in analysing the hashes for the analyzed package, Incoming/outgoing network data, File read and write operations, Started services and loaded classes through DexClass Loader, Information leaks via the network, file and SMS, Circumvented permissions, Cryptographic operations performed using Android API, Listing broadcast receivers, Sent SMS and phone call.
Burp Suite
Burp Suite is a Java application that can be used to secure or penetrate web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application’s attack surface, through to finding and exploiting security vulnerabilities. Burp gives you full control, letting you combine advanced manual techniques with state-of-the-art automation, to make your work faster, more effective, and more fun. Burp is easy to use and intuitive, allowing new users to begin working right away. Burp is also highly configurable, and contains numerous powerful features to assist the most experienced testers with their work.
zANTI
zANTI is a comprehensive network diagnostics toolkit that enables complex audits and penetration tests at the push of a button. It provides cloud-based reporting that walks you through simple guidelines to ensure network safety. zANTI produces an Automated Network Map that highlights every vulnerability of a given target. It helps to uncover authentication, backdoor and brute-force attacks, DNS and protocol-specific attacks and rogue access points using a comprehensive range of full customizable network reconnaissance scans. Further it also helps to enable Security Officers to easily evaluate an organization’s network and automatically diagnose vulnerabilities within mobile devices or web sites using a host of penetration tests including, man-in-the-Middle (MiTm), password cracking and metasploit. It highlights security gaps in your existing network and mobile defenses and reports the results with advanced cloud-based reporting through zConsole. zANTI mirrors the methods a cyber-attacker can use to identify security holes within your network. Dashboard reporting enables businesses to see the risks and take appropriate corrective actions to fix critical security issues.
Droid Sheep
DroidSheep can be easily used by anybody who has an Android device and wants to test it for vulnerabilities. So anybody can test the security of his account by himself and can decide whether to keep on using the web services. It listens for HTTP packets sent via a wireless network connection and extracts the session id from these packets in order to reuse them. DroidSheep can capture sessions using the libpcap library and supports: OPEN Networks WEP encrypted networks WPA and WPA2 encrypted networks (PSK only). DroidSheep is not intended to steal identities or endamage anybody, but to show the weak security of non-SSL web services. This software uses libpcap and arpspoof.
dSploit
dSploit is an Android network analysis and penetration suite which aims to offer to IT security experts/geeks the most complete and advanced professional toolkit to perform network security assessments on a mobile device. dSploit contains a number of powerful functions that allow you to analyze, capture, and manipulate network transactions. You can scan networks for connected devices, identify the operating system, running services and open ports on each device, as well as checking them for vulnerabilities. Its key features are WiFi Cracking, Router PWN, Trace, Port Scanner, Inspector, Vulnerability finder, Login cracker, Packet forger, Man in the middle, Simple sniff, Password sniff, Session Hijacker, Kill connections.
AppUse – Android Pentest Platform Unified Standalone Environment
AppSec Labs recently developed the AppUse Virtual Machine. This system is a unique, free, platform for mobile application security testing in the android environment, and it includes unique custom-made tools created by AppSec Labs. It allows you to work faster, be more effective, get higher quality results and save precious time. The AppUse will allow you to perform complex actions on your testing device/emulator via single-click; the following is only a partial list that are stated to have following features as to Configure proxy for any protocol/port, Pull APK from the device, Edit application files, Launch emulator/auto detect your testing device directly into the AppUse dashboard interface, Easily send broadcast messages and start activities and services, Perform runtime manipulation with Reframeworker, Easily broadcast receivers, and services detection.
ConnectBot
ConnectBot is a powerful open-source Secure Shell (SSH) client. It can manage simultaneous SSH sessions, create secure tunnels, and copy/paste between other applications. This client allows you to connect to Secure Shell servers that typically run on UNIX-based servers. It user to enter commands from their android device and have the commands run on the remote server instead of the local android device. It uses the standard encryption used by SSH2 to keep any commands and data that are transmitted from being eavesdropped by any potential listeners across the network. Its key feature are that it supports login with a username and password to any arbitrary server on the local network or internet, Supports connections based on a public/private keypair instead of username/password for increased security, Allows frequently accessed hosts to be saved in a menu, so that they can quickly be re-connected to, Other programs on the android device can use ConnectBot as a ssh-agent so that the other program can pass data and commands securely to the server. Once the connection has been made with the remote server, the program presents the user with a terminal where input and output can be sent/received just as if the user were sitting in front of a terminal on the actual server.
Do remember that these tools are very powerful and should be handled only if you are into pentesting, ethical hacking or a cyber security expert. Using the tools without applicable knowledge may be illegal in your country.
Click on the hyperlinks in the heading to know more, download the App.
No comments:
Post a Comment