漏洞分析

0

高危漏洞

2

中危漏洞

0

低危漏洞

2

警告

文件名 app-release.apk.1_1.0.apk
上传者 ak
文件大小 12.972199440002MB
MD5 fd18420c955cd3464d7972e162c64323
包名 parim.net.mobile.chinalife.mobilelearning
Main Activity parim.net.mobile.unicom.unicomlearning.activity.login.SplashLoginActivity
Min SDK 16
Target SDK 27

权限列表

# 名称 说明 提示
0 android.permission.CALL_PHONE 允许应用程序在您不介入的情况下拨打电话。恶意应用程序可借此在您的话费单上产生意外通话费。请注意,此权限不允许应用程序拨打紧急呼救电话。 警告
1 android.permission.ACCESS_COARSE_LOCATION 访问大概的位置源(例如蜂窝网络数据库)以确定手机的大概位置(如果可以)。恶意应用程序可借此确定您所处的大概位置。 注意
2 android.permission.ACCESS_FINE_LOCATION 访问精准的位置源,例如手机上的全球定位系统(如果有)。恶意应用程序可能会借此确定您所处的位置,并可能消耗额外的电池电量。 注意
3 android.permission.ACCESS_LOCATION_EXTRA_COMMANDS 访问额外的位置信息提供程序命令。恶意应用程序可借此干扰GPS或其他位置源的正常工作。 注意
4 android.permission.BLUETOOTH 允许应用程序查看本地蓝牙手机的配置,以及建立或接受与配对设备的连接。 注意
5 android.permission.GET_TASKS 允许应用程序检索有关当前和最近运行的任务的信息。恶意应用程序可借此发现有关其他应用程序的保密信息。 注意
6 android.permission.READ_PHONE_STATE 允许应用程序访问设备的手机功能。有此权限的应用程序可确定此手机的号码和序列号,是否正在通话,以及对方的号码等。 注意
7 android.permission.RECORD_AUDIO 允许应用程序访问录音路径。 注意
8 android.permission.SYSTEM_ALERT_WINDOW 允许应用程序显示系统警报窗口。恶意应用程序可借此掌控整个手机屏幕。 注意
9 android.permission.WRITE_SETTINGS 允许应用程序修改系统设置方面的数据。恶意应用程序可借此破坏您的系统配置。 注意
10 android.permission.ACCESS_NETWORK_STATE 允许应用程序查看所有网络的状态。 提示
11 android.permission.ACCESS_WIFI_STATE 允许应用程序查看有关WLAN状态的信息。 提示
12 android.permission.BLUETOOTH_ADMIN 允许应用程序配置本地蓝牙手机,以及发现远程设备并与其配对。 提示
13 android.permission.CAMERA 允许应用程序使用相机拍照,这样应用程序可随时收集进入相机镜头的图像。 提示
14 android.permission.CHANGE_CONFIGURATION 允许应用程序更改当前配置,例如语言设置或整体的字体大小。 提示
15 android.permission.CHANGE_WIFI_STATE 允许应用程序连接到WLAN接入点以及与WLAN接入点断开连接,并对配置的WLAN网络进行更改。 提示
16 android.permission.GET_ACCOUNTS 允许应用程序获取手机已知的帐户列表。 提示
17 android.permission.INTERNET 允许程序访问网络. 提示
18 android.permission.MANAGE_ACCOUNTS 允许应用程序执行添加、删除帐户及删除其密码之类的操作。 提示
19 android.permission.MODIFY_AUDIO_SETTINGS 允许应用程序修改整个系统的音频设置,如音量和路由。 提示
20 android.permission.MOUNT_UNMOUNT_FILESYSTEMS 允许应用程序装载和卸载可移动存储器的文件系统。 提示
21 android.permission.READ_LOGS 允许应用程序从系统的各日志文件中读取信息。这样应用程序可以发现您的手机使用情况,但这些信息不应包含任何个人信息或保密信息。 提示
22 android.permission.VIBRATE 允许应用程序控制振动器。 提示
23 android.permission.WAKE_LOCK 允许应用程序防止手机进入休眠状态。 提示
24 android.permission.WRITE_EXTERNAL_STORAGE 允许应用程序写入SD卡。 提示

四大组件

组件名称

parim.net.mobile.unicom.unicomlearning.MainActivity
parim.net.mobile.unicom.unicomlearning.activity.login.LoginActivity
parim.net.mobile.unicom.unicomlearning.activity.login.SplashLoginActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.opencourse.OpenCourseActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.archives.ArchiveActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.message.MessageActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.collection.CollectionActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.trainclass.TrainClassActivity
parim.net.mobile.unicom.unicomlearning.activity.course.CourseDetailActivity
parim.net.mobile.unicom.unicomlearning.activity.home.learningzone.LearningzoneActivity
parim.net.mobile.unicom.unicomlearning.activity.course.CourseActivity
parim.net.mobile.unicom.unicomlearning.activity.course.CourseNoteActivity
parim.net.mobile.unicom.unicomlearning.activity.home.lecture.LectureListActivity
parim.net.mobile.unicom.unicomlearning.activity.knowledge.KnowledgeActivity
parim.net.mobile.unicom.unicomlearning.activity.course.discounts.DiscountDetailsActivity
parim.net.mobile.unicom.unicomlearning.activity.home.professionalCenter.ProfessionalActivity
parim.net.mobile.unicom.unicomlearning.activity.consultation.ConsultationGroupActivity
parim.net.mobile.unicom.unicomlearning.activity.train.TrainDetailsActivity
parim.net.mobile.unicom.unicomlearning.activity.special.SpecialDetailsActivity
parim.net.mobile.unicom.unicomlearning.activity.train.TrainInformActivity
parim.net.mobile.unicom.unicomlearning.activity.train.TrainScheduleActivity
parim.net.mobile.unicom.unicomlearning.activity.train.TrainCaseActivity
parim.net.mobile.unicom.unicomlearning.activity.train.TrainCourseDataActivity
parim.net.mobile.unicom.unicomlearning.activity.home.lectureZone.LectureDetailActivity
parim.net.mobile.unicom.unicomlearning.activity.train.TrainShowCaseActivity
parim.net.mobile.unicom.unicomlearning.activity.train.TrainClassDataActivity
parim.net.mobile.unicom.unicomlearning.activity.course.CourseRevertActivity
parim.net.mobile.unicom.unicomlearning.activity.exceptional.ExceptionalActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.goldcoins.GoldCoinsActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.mypoints.MyPointsActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.mypoints.IntegralMallActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.mypoints.IntegralMallDetailActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.mypoints.ForSuccessfulActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.mypoints.IntegralDetailActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.archives.area.AreaArchiveActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.survey.MySurveyActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.survey.SurveyActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.exam.MyExamActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.exam.ExamActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.message.MessageDetailActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.exam.ExamInfoActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.exam.ExamDetailWebActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.survey.TestWebActivity
parim.net.mobile.unicom.unicomlearning.activity.home.lecture.LectureCenterActivity
parim.net.mobile.unicom.unicomlearning.activity.home.information.InformationCenterActivity
parim.net.mobile.unicom.unicomlearning.activity.home.resources.ResourcesCenterActivity
parim.net.mobile.unicom.unicomlearning.activity.home.lecture.join.FillInformationActivity
parim.net.mobile.unicom.unicomlearning.activity.home.lecture.join.PersonalInformationActivity
parim.net.mobile.unicom.unicomlearning.activity.home.lecture.join.TrainingExperienceActivity
parim.net.mobile.unicom.unicomlearning.activity.home.lecture.join.MentorExperienceActivity
parim.net.mobile.unicom.unicomlearning.activity.home.lecture.join.MainCoursesActivity
parim.net.mobile.unicom.unicomlearning.activity.home.lecture.join.CommonFillInActivity
parim.net.mobile.unicom.unicomlearning.activity.home.information.detail.InfoCourseDetailActivity
parim.net.mobile.unicom.unicomlearning.activity.home.information.more.InfoDocumentMoreActivity
parim.net.mobile.unicom.unicomlearning.activity.home.information.more.InfoTeacherMoreActivity
parim.net.mobile.unicom.unicomlearning.activity.home.information.more.InfoCourseMoreActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.exam.ExamTrackListActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.exam.ExamTrackWebActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.creating.CreatingActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.setting.SettingActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.setting.personal.PersonalActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.setting.personal.PostOfInterestActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.setting.password.ChangePasswordActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.setting.password.ChangePhoneActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.setting.mail.ChangeMailActivity
parim.net.mobile.unicom.unicomlearning.activity.login.ForgetPasswordActivity
parim.net.mobile.unicom.unicomlearning.activity.home.information.external.ExternalDetailActivity
parim.net.mobile.unicom.unicomlearning.activity.home.information.external.MyWorkListActivity
parim.net.mobile.unicom.unicomlearning.activity.home.information.teacher.ExternalTeacherDetailActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.fans.MyFansActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.fans.FansDetailActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.certificate.MyCertificateActivity
parim.net.mobile.unicom.unicomlearning.activity.home.information.InformationDetailWebActivity
parim.net.mobile.unicom.unicomlearning.activity.DateWebActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.special.SpecialActivity
parim.net.mobile.unicom.unicomlearning.activity.live.LiveActivity
parim.net.mobile.unicom.unicomlearning.activity.live.LiveDetailActivity
parim.net.mobile.unicom.unicomlearning.activity.course.WebViewActivity
parim.net.mobile.unicom.unicomlearning.activity.course.html.VideoWebActivity
parim.net.mobile.unicom.unicomlearning.activity.qrcode.QrCodeActivity
parim.net.mobile.unicom.unicomlearning.activity.course.CityPickerActivity
parim.net.mobile.unicom.unicomlearning.activity.picture.PictureSelectorActivity
parim.net.mobile.unicom.unicomlearning.activity.courseware.course.CWCourseActivity
parim.net.mobile.unicom.unicomlearning.activity.courseware.course.MakeCourseActivity
parim.net.mobile.unicom.unicomlearning.activity.courseware.course.detail.CourseDetailActivity
parim.net.mobile.unicom.unicomlearning.activity.courseware.picture.PictureSelectorActivity
parim.net.mobile.unicom.unicomlearning.activity.courseware.course.SearchActivity
parim.net.mobile.unicom.unicomlearning.activity.courseware.course.CourseCategoryActivity
parim.net.mobile.unicom.unicomlearning.activity.courseware.microlecture.RecordingActivity
parim.net.mobile.unicom.unicomlearning.activity.courseware.microlecture.RecordPreviewActivity
parim.net.mobile.unicom.unicomlearning.activity.home.lectureZone.AddArticleActivity
parim.net.mobile.unicom.unicomlearning.activity.home.lectureZone.LectureContentActivity
parim.net.mobile.unicom.unicomlearning.activity.home.lectureZone.LeaveMessageActivity
parim.net.mobile.unicom.unicomlearning.activity.home.lectureZone.MyLectureZoneActivity
parim.net.mobile.unicom.unicomlearning.activity.home.lectureZone.LectureZoneActivity
parim.net.mobile.unicom.unicomlearning.activity.courseware.graphic.GraphicActivity
parim.net.mobile.unicom.unicomlearning.activity.courseware.graphic.GraphicCheckActivity
parim.net.mobile.unicom.unicomlearning.activity.courseware.videocourse.VideoCourseActivity
parim.net.mobile.unicom.unicomlearning.activity.courseware.videocourse.VideoPreViewActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.studymap.StudyMapActivity
parim.net.mobile.unicom.unicomlearning.activity.mine.studymap.PhaseActivity
parim.net.mobile.unicom.unicomlearning.activity.courseware.videocourse.VideoPlayerActivity
parim.net.mobile.unicom.unicomlearning.activity.courseware.graphic.GraphicPreviewActivity
parim.net.mobile.unicom.unicomlearning.activity.courseware.course.SeeChapterActivity
parim.net.mobile.unicom.unicomlearning.activity.train.TrainStudentsActivity
parim.net.mobile.unicom.unicomlearning.activity.courseware.graphic.GraphicEditTextActivity
parim.net.mobile.unicom.unicomlearning.activity.courseware.microlecture.MakeSpeechActivity
com.yanzhenjie.permission.PermissionActivity
com.luck.picture.lib.PictureSelectorActivity
com.luck.picture.lib.PictureBaseActivity
com.luck.picture.lib.PicturePreviewActivity
com.luck.picture.lib.PictureVideoPlayActivity
com.luck.picture.lib.PictureExternalPreviewActivity
com.yalantis.ucrop.UCropActivity
com.yalantis.ucrop.PictureMultiCuttingActivity
com.luck.picture.lib.PicturePlayAudioActivity

parim.net.mobile.unicom.unicomlearning.activity.courseware.microlecture.service.RecordingDownLoadService
com.amap.api.location.APSService
com.liulishuo.filedownloader.services.FileDownloadService$SharedMainProcessService
com.liulishuo.filedownloader.services.FileDownloadService$SeparateProcessService

android.support.v4.content.FileProvider

第三方库

# 库名 介绍
0 com.alibaba.fastjson Fast JSON Processor https://github.com/alibaba/fastjson/wiki
1 com.tencent.bugly 腾讯Bugly,面向移动开发者提供最专业的Crash监控、崩溃分析等质量跟踪服务,为您修复用户的每一次Crash!
2 android.support.transition A backport of the new Transitions API for Android.
3 de.hdodenhof.circleimageview A fast circular ImageView perfect for profile images.
4 butterknife View "injection" library for Android.
5 me.zhanghai.android.materialprogressbar Material design ProgressBar with consistent appearance
6 com.amap.api 高德LBS开放平台将高德最专业的定位、地图、搜索、导航等能力,以API、SDK等形式向广大开发者免费开放
7 com.bumptech.glide An image loading and caching library for Android focused on smooth scrolling
8 com.afollestad.materialcamera One of the most difficult APIs on Android, made easy in a small library. http://aidanfollestad.com
9 com.afollestad.materialdialogs Not even AppCompat uses Material theming for AlertDialogs on pre-Lollipop. This is a beautiful and easy solution.
10 cn.sharesdk ShareSDK是中国最大的APP内分享服务提供商,ShareSDK社会化分享全面支持微信,微博,QQ空间,来往,易信,Facebook等国内外40个平台,帮助开发者轻松实现社会化分享、第三方登录、好友关系运用、一键分享、短链转换、评论和赞功能,还有强大的社会化统计分析管理后台,可以实时了解用户、信息流、回流率、传播效率等数据,有效地指导移动APP的日常运营与推广,同时为APP引入更多的社会化流量。
11 com.google.zxing Official ZXing ("Zebra Crossing") project home
12 com.zhy.view An Android Library that allows users to pull down a menu and select different actions. It can be implemented inside ScrollView, GridView, ListView.
13 android.support.multidex DEPRECATED
14 uk.co.senab.photoview Implementation of ImageView for Android that supports zooming, by various touch gestures.
15 uk.co.senab.photoview Implementation of ImageView for Android that supports zooming, by various touch gestures.

静态扫描发现风险点

风险等级 风险名称

中危

检测到1个未移除的敏感Test或Debug组件

parim.net.mobile.unicom.unicomlearning.activity.mine.survey.TestWebActivity

建议:
在正式发布app前移除敏感的Test或Debug组件

中危

检测到6条敏感明文信息,建议移除。

位置: classes.dex
'file:///android_asset/' used in: Lcom/bumptech/glide/load/model/AssetUriLoader;->()V
'http://android.bugly.qq.com/rqd/async' used in: Lcom/tencent/bugly/crashreport/common/strategy/StrategyBean;->()V
'http://api.exc.mob.com:80' used in: Lcom/mob/commons/logcollector/c;->()V
'http://apilocate.amap.com/mobile/binary' used in: Lcom/loc/cw;->()V
'http://rqd.uu.qq.com/rqd/sync' used in: Lcom/tencent/bugly/crashreport/common/strategy/StrategyBean;->()V
'http://schemas.android.com/apk/res/android' used in: Landroid/support/graphics/drawable/TypedArrayUtils;->hasAttribute(Lorg/xmlpull/v1/XmlPullParser; Ljava/lang/String;)Z

警告

检测到1处IvParameterSpec的使用。

位置: classes.dex
com.loc.cj;->()V

使用IVParameterSpec函数,如果使用了固定的初始化向量,那么密码文本可预测性高得多,容易受到字典攻击等。建议禁止使用常量初始化矢量构造IVParameterSpec,使用聚安全提供的安全组件。

参考资料:
http://drops.wooyun.org/tips/15870
https://developer.android.com/training/articles/keystore.html
http://wolfeye.baidu.com/blog/weak-encryption/
http://www.freebuf.com/articles/terminal/99868.html

警告

检测到1处provider的grantUriPermissions设置为true。
android.support.v4.content.FileProvider


grant-uri-permission若设置为true,可被其它程序员通过uri访问到content provider的内容,容易造成信息泄露。

参考资料:
https://security.tencent.com/index.php/blog/msg/6


动态扫描发现风险点

风险等级 风险名称

服务端分析

风险等级 风险名称

警告

检测到?处XSS漏洞。
开发中...

警告

检测到?处XSS跨站漏洞。
开发中...

应用证书