---

What’s New (v1.1.5)

Segment Write Key Detection

pSlip now detects hardcoded Segment write keys during code/config triage.

Detection is case-insensitive and catches common Java/Kotlin and JSON/config patterns, including:

SEGMENT_WRITE_KEY = "..."
segment_write_key = "..."

"segmentWriteKey": "..."

Category Summaries

Reports include summaries for: Hardening, Component Exposure, Crypto, JavaScript Injection,
URL Redirect, Permissions, Tapjacking, and Secrets.

Updated Severity Model (Android 15)

Severity weights reflect realistic exploitability under modern Android.
Tapjacking is treated as Informational unless paired with sensitive UI actions.

Cleaner Detail Sections

Improved formatting for component names, ADB PoC commands, severity chips,
and long package paths.

Unified CLI (Simpler Flags!)

Scanning behavior is simplified into two modes:

• -all → Full analysis
• -allsafe → Full analysis without AES/JADX decompilation

---

pSlip

pSlip detects Android applications vulnerable to Permission-Slip / Confused-Deputy paths by analyzing:

• exported Activities, Services, BroadcastReceivers, Providers
• intent filters and unsafe CALL/VIEW handlers
• JavaScript-enabled WebViews and URL schemes
• manifest hardening controls
• unsafe permissions and custom-role exposure
• tapjacking/taptrap surface area
• cryptographic misuse (AES/IV/key/ECB detection)
• hardcoded secrets such as Segment write keys

pSlip is designed for application-security testing, CI/CD pipelines, and bulk APK triage.

---

Highlights

Exported Component Triage

• CALL actions
• VIEW + javascript: handlers
• Wildcard deep links
• Weak or normal-protection custom permissions

Crypto, Secrets & Code Triage

• Hardcoded AES/DES/IV patterns
• Unsafe mode detection (ECB, static IVs, insecure PRNG)
• Hardcoded Segment write-key detection
• Case-insensitive secret-name matching for common config styles

UI / Tapjacking Detection

• Layout XML parsing
• Compose tree heuristics
• Sensitive-action token scoring

Reporting

• HTML and JSON output
• ADB PoC generation
• Severity + confidence scoring (0–100)

---

---

Install

git clone https://github.com/actuator/pSlip.git
cd pSlip
sudo apt install apktool jadx

---

Usage

# Directory sweep (full scan)
python pSlip.py . -all -html demo.html -json demo.json

# Fast sweep (skip AES/JADX)
python pSlip.py path/to/apks -allsafe -html report.htm

Supported Flags

-all                   Full analysis, including code/config triage
-allsafe               Disable AES/JADX/code decompilation for speed/stability
-html <file>           Write HTML report
-json <file>           Write JSON report
-aes-timeout <minutes> Time limit for AES/JADX work (default: 5)

---

Secret Detection

pSlip detects hardcoded Segment write keys in Java, Kotlin, JSON, XML, JavaScript, TypeScript, properties, text, and smali outputs.

Examples detected:

private static final String SEGMENT_WRITE_KEY = "pHYN1qhsRsz...

{
  "segmentWriteKey": "CaVz3hRhBJKCNlParpK4kvWJLNUf164N"
}

Matches are reported as:

Issue Type: Hardcoded Segment Write Key
Severity: High
Confidence: 95

---

Tapjacking Signals

Tokens used for semantic scoring:

login | auth | verify | pay | checkout | approve
password | otp | pin | confirm | secure
submit | card | transfer | send

---

Output

HTML Output

• Category summaries: Hardening, Exposure, Crypto, Secrets, JS Injection, URL Redirect, Permissions, Tapjacking
• Responsive index: table on desktop, cards on mobile
• Per-app findings with severity, confidence, and ADB PoC actions

JSON Output

• Structured dataset for ingestion