Develop Reference

How to check for network security config with Androguard in python script

I have an .apk file and want to check wheter the res/xml/network_security_config.xml [1] trusts user supplied certificates.
I read into the androguard docuemntation and I think it should be able to do what I want. However I am confused on how to run code like this from the documentation on an .apk file instead of the already extracted resources.arsc
from androguard.core.bytecodes.axml import ARSCParser
with open("resouces.arsc", "rb") as fp:
res = ARSCParser(fp.read())
# Now you can resolve IDs:
name = res.get_resource_xml_name(0x7F040001)
if name:
print(name)
# To get the content of an ID, you need to iterate over configurations
# You need to decide which configuration to use...
for config, entry in res.get_res_configs(0x7F040001):
# You can query `config` for specific configuration
# or check with `is_default()` if this is a default configuration.
print("{} = '{}'".format(config.get_qualifier() if not config.is_default() else "<default>", entry.get_key_data()))
How would I check whether the res/xml/network_security_config.xml file exists in an .apk file without extracting it and how would I check if it trusts user certificates?
This is all I could figure out so far:
from androguard.core.bytecodes import apk
apk_file = apk.APK(app_path)
if 'res/xml/network_security_config.xml' in apk_file.files.keys():
print("found network_security_config.xml")
example network_security_config.xml:
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<base-config cleartextTrafficPermitted="true">
<trust-anchors>
<certificates src="system" />
<certificates src="user" />
</trust-anchors>
</base-config>
</network-security-config>
Edit: found out how to check for the presence of the .xml file and edited my code
[1] https://developer.android.com/training/articles/security-config.html

I figured it out:
apk_file = apk.APK(app_path)
manifest = apk.get_android_manifest_xml()
if 'res/xml/network_security_config.xml' in apk_file.files.keys():
print("Network Security Config present in .apk")
axml = AXMLPrinter(apk_file.get_file('res/xml/network_security_config.xml'))
axml_obj = axml.get_xml_obj()
for element in axml_obj.iter("certificates"):
if element.values() == ['user']:
print("User certificates trusted by network security configuration")

What is the credentials.txt format used by selenium?

The README for the project at https://github.com/apurvmishra99/facebook-scraper-selenium includes the instruction:
Store your email and password for Facebook login in credentials.txt
This project doesn't contain any code that tries to read or parse credentials.txt, so I assume that the format has to be standard to selenium or to Python.
What exactly is the format this file should be in?

It's not a selenium or python thing. That file was deleted during one of the developer's commits:
I've had a look for you, and if you look in this file in the project: https://github.com/apurvmishra99/facebook-scraper-selenium/blob/master/fb-scraper/settings.py
You can see it gets the email and password:
# User credentials
EMAIL = os.getenv("EMAIL")
PASSWORD = os.getenv("PASSWORD")
os.getenv is python, and does:
os.getenv(key, default=None) Return the value of the environment
variable key if it exists, or default if it doesn’t. key, default and
the result are str.
What you can try is create environment variables called "EMAIL" and "PASSWORD" set the respectively and then run the main.py
Also be aware that in the same settings files the binaries are set as so:
# Required binaries
BROWSER_EXE = '/usr/bin/firefox'
GECKODRIVER = '/usr/bin/geckodriver'
FIREFOX_BINARY = FirefoxBinary(BROWSER_EXE)
You'll need to ensure these reflect your system.

What is the efficient way to extract the stored username and password from a file and use it by python script? [closed]

Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 4 years ago.
Improve this question
I am trying automate the process by providing all the login details. I had written only a script not with frameworks. I don't want to extract the logins from database because I don't want to authorize it manually.
Is there possibility to extract the data securely? Is it a good way or bay way to store the logins in a file?
Any advice would be helpful.

If you have the credentials stored in a file,
Use ConfigParser to extract it. Read the link.
Or you can store credentials as environment variables.
For instance pwd = os.environ['My_Password'] would load the environment var My_password into that variable.

You can save the username and password in a text file in d drive like below:
username, password
Then in your code, do as the following:
with open('d:\myfile.txt') as f:
credential = [x.strip().split(',')]
username = credential[0]
password = credential[1]

I normally use ConfigParser and store passwords as hashes in a text file. I then retrieve the hash from the text file and decode it inside my scripts, then send it to whatever needs it as a property of a Config object.
Here's an example of how the config parser class would look like:
import configparser
import os
cwd = os.path.dirname(__file__)
class UserEntity:
def __init__(self, user=None,
password=None):
config = configparser.ConfigParser()
config_file = 'users.cfg'
config_location = os.path.join(cwd, config_file)
with open(config_location, 'r') as cfg:
config.read_file(cfg)
if not user:
self.user = config['credentials']['user']
else:
self.user = user
if not password:
self.password = config['credentials']['password']
else:
self.password = password
usr = UserEntity()
print(usr.password, usr.user)
usr2 = UserEntity(user='Test')
print(usr2.password, usr2.user)
usr3 = UserEntity(user='Test', password='eb65af66881341099ebf28dad3800d0f')
print(usr3.password, usr3.user)
Do note that you will need "users.cfg" to be present in the same folder as the script running this code for it to work
The users.cfg file looks like this
[credentials]
user=user123
password=password123
To parse and store the passwords encrypted, you could use implementations listed here:
Simple way to encode a string according to a password?
You can use the resulting code inside a function that generates the hash and then writes it to a config file. Your other scripts can then use that file as a config like in the first example. Use the decrypt functionality to use the password wherever you need without ever showing it in plain text anywhere.

Move Lotus Notes Email to a Different Folder Python

After extracting some of the email's data, I would like to move the email to a specified folder with python. I've searched and haven't seemed to find what I need.
Has anyone done this before?
Per a comment, I've added my current logic in hopes that it will clarify my problem. I loop through my folder, extract the details. After doing that, I want to move the email to a different folder.
import win32com.client
import getpass
import re
'''
Loops through Lotus Notes folder to view messages
'''
def docGenerator(folderName):
# Get credentials
mailServer = 'server'
mailPath = 'PubDir\inbox.nsf'
# Password
pw = getpass.getpass('Enter password: ')
# Connect
session = win32com.client.Dispatch('Lotus.NotesSession')
# Initializing the session and database
session.Initialize(pw)
db = session.GetDatabase(mailServer, mailPath)
# Get folder
folder = db.GetView(folderName)
if not folder:
raise Exception('Folder "%s" not found' % folderName)
# Get the first document
doc = folder.GetFirstDocument()
# If the document exists,
while doc:
# Yield it
yield doc
# Get the next document
doc = folder.GetNextDocument(doc)
# Loop through emails
for doc in docGenerator('Folder\Here'):
# setting variables
subject = doc.GetItemValue('Subject')[0].strip()
invoice = re.findall(r'\d+',subject)[0]
body = doc.GetItemValue('Body')[0].strip()
# Move email after extracting above data
# ???

As you will move the document before getting the next one, I'd recommend to replace your loop with
doc = folder.GetFirstDocument()
while doc:
docN = folder.GetNextDocument(doc)
yield doc
doc = docN
And then to move the message to the proper folder you need
doc.PutInFolder(r"Destination\Folder")
doc.RemoveFromFolder(r"Origin\Folder")
Of course, take care of escaping your backslashes or using raw strings literals to pass correctly the view name.
doc.PutInFolder creates the folder if it doesn't exist. In that case the user needs to have permissions to create public folders, otherwise the created folder will be private. (If the folder already exists, of course, this is not a problem.)

Self-Updating Code?

I have a module that needs to update new variable values from the web, about once a week. I could place those variable values in a file & load those values on startup. Or, a simpler solution would be to simply auto-update the code.
Is this possible in Python?
Something like this...
def self_updating_module_template():
dynamic_var1 = {'dynamic var1'} # some kind of place holder tag
dynamic_var2 = {'dynamic var2'} # some kind of place holder tag
return
def self_updating_module():
dynamic_var1 = 'old data'
dynamic_var2 = 'old data'
return
def updater():
new_data_from_web = ''
new_dynamic_var1 = new_data_from_web # Makes API call. gets values.
new_dynamic_var2 = new_data_from_web
# loads self_updating_module_template
dynamic_var1 = new_dynamic_var1
dynamic_var2 = new_dynamic_var2
# replace module place holders with new values.
# overwrite self_updating_module.py.
return

I would recommend that you use configparser and a set of default values located in an ini-style file.
The ConfigParser class implements a basic configuration file parser
language which provides a structure similar to what you would find on
Microsoft Windows INI files. You can use this to write Python programs
which can be customized by end users easily.
Whenever the configuration values are updated from the web api endpoint, configparser also lets us write those back out to the configuration file. That said, be careful! The reason that most people recommend that configuration files be included at build/deploy time and not at run time is for security/stability. You have to lock down the endpoint that allows updates to your running configuration in production and have some way to verify any configuration value updates before they are retrieved by your application:
import configparser
filename = 'config.ini'
def load_config():
config = configparser.ConfigParser()
config.read(filename)
if 'WEB_DATA' not in config:
config['WEB_DATA'] = {'dynamic_var1': 'dynamic var1', # some kind of place holder tag
'dynamic_var2': 'dynamic var2'} # some kind of place holder tag
return config
def update_config(config):
new_data_from_web = ''
new_dynamic_var1 = new_data_from_web # Makes API call. gets values.
new_dynamic_var2 = new_data_from_web
config['WEB_DATA']['dynamic_var1'] = new_dynamic_var1
config['WEB_DATA']['dynamic_var2'] = new_dynamic_var2
def save_config(config):
with open(filename, 'w') as configfile:
config.write(configfile)
Example usage::
# Load the configuration
config = load_config()
# Get new data from the web
update_config(config)
# Save the newly updated configuration back to the file
save_config(config)