sigeryang / tlshunter

Detect TLS misconfiguration in Android applications.

Android TLS Hunter

Detect TLS misconfiguration in Android applications.

Reference: USENIX'21 Why Eve and Mallory Still Love Android: Revisiting TLS (In)Security in Android Applications

Features

Typical misconfiguration:

• Permits cleartext traffic in AndroidManifest.xml (or omitted before Android 9)
• Permits cleartext traffic in network security configuration (a.k.a. NSC)
• Does not pin any certificates in NSC
• User CA store overrides pinned certificates in NSC
• Trust anchors contain proxy tool CA
• Malformed domain config
• ...

Usage

go run ./cmd/tlshunter a.apk b.apk c.apk
# or
go build ./cmd/tlshunter
./tlshunter a.apk b.apk c.apk