QARK Scripts

QARK (Quick Android Review Kit) scripts automate security analysis of Android APK files by identifying vulnerabilities and generating exploit APKs. These scripts support remote Linux execution with automated reporting.

Overview

Script	Purpose	Platform
`qark.bat`	Orchestrate remote QARK analysis	Windows (SSH client)
`qark.sh`	Execute QARK analysis on Linux	Linux

Tool Information

QARK: Quick Android Review Kit

Developer: LinkedIn
Repository: https://github.com/linkedin/qark
Type: Static analysis and exploit generation tool
Purpose: Identify Android application vulnerabilities and create proof-of-concept exploits

Installation

From install scripts (Linux):

cd ~
git clone --depth 1 https://github.com/linkedin/qark
cd qark

# Download Android SDK tools
cd $HOME/qark/
wget https://dl.google.com/android/repository/sdk-tools-linux-4333796.zip -O sdk-tools-linux-4333796.zip
unzip sdk-tools-linux-4333796.zip
echo y | tools/android update sdk --no-ui

# Install QARK
pip install -r requirements.txt
python ./setup.py install

qark.bat

Windows batch script that orchestrates remote QARK analysis on a Linux server.

Parameters

qark.bat <DirApp> <PathAPK> <FileApk> <Timestamp> <Documentacion> <Server> <Username> <Password>

Parameter	Description	Example
`DirApp`	QARK installation directory on server	`/root/qark`
`PathAPK`	Local path to APK file	`C:\samples\app.apk`
`FileApk`	APK filename (no extension)	`app`
`Timestamp`	Unique timestamp identifier	`20230615_143022`
`Documentacion`	Local output directory	`C:\reports`
`Server`	SSH server hostname/IP	`192.168.1.100`
`Username`	SSH username	`root`
`Password`	SSH password	`password123`

Analysis Workflow

Upload APK

Transfers APK file to /tmp/ directory on remote server.

pscp.exe -l %Username% -pw %Password% -C ^
  "%PathAPK%" %Server%:"/tmp/%FileApk%_%Timestamp%.apk"

Upload Helper Script

Transfers qark.sh helper script to server.

pscp.exe -l %Username% -pw %Password% -C ^
  "qark.sh" %Server%:"/tmp/qark.sh"

Converts line endings from Windows to Unix format.

Manual Execution Prompt

Script pauses and instructs user to manually run QARK on server.

cd "/root/qark" ; chmod 755 ./qark.sh ; ./qark.sh "/root/qark" "app_20230615_143022"

User must SSH to server and execute command, then press key to continue.

Archive Results

Creates tar.gz archive of analysis results.

cd '/root/qark/qark'
tar -cvzf '/tmp/QarkReport - app_20230615_143022.tar.gz' \
  '/tmp/app_20230615_143022.apk' \
  'Report_app_20230615_143022/' \
  logs/ \
  exploit/

Download Report

Transfers archive back to local Windows machine.

pscp.exe -P 22 -l %Username% -pw %Password% -C ^
  %Server%:"/tmp/QarkReport - %FileApk%_%Timestamp%.tar.gz" ^
  %Documentacion%

Cleanup

Removes temporary files from remote server.

rm -f '/tmp/QarkReport - app_20230615_143022.tar.gz' '/root/qark/qark.sh'

Script Implementation

@echo off
setlocal
set DirApp=%1
set PathAPK=%2
set FileApk=%3
set Timestamp=%4
set Documentacion=%5
set Server=%6
set Username=%7
set Password=%8

set PathAPK=%PathAPK:"=%
set FileApk=%FileApk:"=%
set DirApp=%DirApp:"=%
set Documentacion=%Documentacion:"=%
set Documentacion="%Documentacion%\QarkReport - %FileApk%_%Timestamp%.tar.gz"

@title=[Qark] - %FileApk%

# Upload APK
"%~dp0pscp.exe" -l %Username% -pw %Password% -C ^
  "%PathAPK%" %Server%:"/tmp/%FileApk%_%Timestamp%.apk"

# Upload helper script
"%~dp0pscp.exe" -l %Username% -pw %Password% -C ^
  "%~dp0qark.sh" %Server%:"/tmp/qark.sh"

# Convert line endings
"%~dp0plink.exe" -P 22 -ssh -l %Username% -pw %Password% -C %Server% ^
  "tr -d '\15\32' < /tmp/qark.sh > '%DirApp%/qark.sh'"

"%~dp0plink.exe" -P 22 -ssh -l %Username% -pw %Password% -C %Server% ^
  "rm -f '/tmp/qark.sh'"

:retry
cls
echo Ejecutar en el server %Server% el comando:
echo cd "%DirApp%" ; chmod 755 ./qark.sh ; ./qark.sh "%DirApp%" "%FileApk%_%Timestamp%"
echo Solo cuando termine, presione una tecla para obtener el reporte
set /p respuesta="Desea continuar? (y/n)"
pause

if %respuesta% == y (
  # Archive results
  "%~dp0plink.exe" -P 22 -ssh -l %Username% -pw %Password% -C %Server% ^
    "cd '%DirApp%/qark' ; tar -cvzf '/tmp/QarkReport - %FileApk%_%Timestamp%.tar.gz' ^
    '/tmp/%FileApk%_%Timestamp%.apk' 'Report_%FileApk%_%Timestamp%/' logs/ exploit/"
  
  # Download archive
  "%~dp0pscp.exe" -P 22 -l %Username% -pw %Password% -C ^
    %Server%:"/tmp/QarkReport - %FileApk%_%Timestamp%.tar.gz" %Documentacion%
  
  # Cleanup
  "%~dp0plink.exe" -P 22 -ssh -l %Username% -pw %Password% -C %Server% ^
    "rm -f '/tmp/QarkReport - %FileApk%_%Timestamp%.tar.gz' '%DirApp%/qark.sh'"
  
  echo %Documentacion%
  pause
) else (
  if %respuesta% == n (
    goto :fin
  ) else (
    goto :retry
  )
)

:fin

Usage Example

qark.bat ^
  "/root/qark" ^
  "C:\samples\vulnerable_app.apk" ^
  "vulnerable_app" ^
  "20230615_143022" ^
  "C:\reports" ^
  "192.168.1.100" ^
  "root" ^
  "password123"

qark.sh

Linux shell script that executes QARK analysis with proper parameters.

Parameters

qark.sh <DirApp> <APK>

Parameter	Description	Example
`DirApp`	QARK installation directory	`/root/qark`
`APK`	APK filename in /tmp (no extension)	`vulnerable_app_20230615_143022`

Script Implementation

#!/bin/bash
DirApp=$1
APK=$(echo $2 | sed 's/"//g')

cd $DirApp

# Clean previous results
rm -fr report/build/ logs/ exploit/

# Run QARK analysis
qark --apk "/tmp/$APK.apk" \
     --debug \
     --exploit-apk \
     --report-type html \
     --sdk-path tools/

# Copy exploit APK if generated
if [ -f build/qark/app/build/outputs/apk/app-debug.apk ] ; then
    mkdir exploit/
    cp build/qark/app/build/outputs/apk/app-debug.apk exploit/
fi

if [ -f build/qark/app/build/outputs/apk/app-debug-unaligned.apk ] ; then
    mkdir exploit/
    cp build/qark/app/build/outputs/apk/app-debug-unaligned.apk exploit/
fi

QARK Command Options

Option	Purpose
`--apk`	Path to APK file to analyze
`--debug`	Enable debug output for troubleshooting
`--exploit-apk`	Generate exploit APK for identified vulnerabilities
`--report-type html`	Generate HTML format report
`--sdk-path tools/`	Path to Android SDK tools

Analysis Output

The script generates:

HTML Report: Detailed vulnerability findings in Report_<APK>/
Logs: Analysis execution logs in logs/
Exploit APKs: Proof-of-concept exploits in exploit/

Output Structure

After analysis, the tar.gz archive contains:

QarkReport - vulnerable_app_20230615_143022.tar.gz
├── /tmp/vulnerable_app_20230615_143022.apk   # Original APK
├── Report_vulnerable_app_20230615_143022/     # HTML report
│   ├── index.html                             # Main report page
│   ├── css/                                   # Stylesheets
│   └── ...                                    # Report assets
├── logs/                                      # Analysis logs
│   └── qark.log                               # Execution log
└── exploit/                                   # Exploit APKs
    ├── app-debug.apk                          # Signed exploit
    └── app-debug-unaligned.apk                # Unsigned exploit

Vulnerability Detection

QARK identifies common Android security issues:

Security Checks

Exported Components: Activities, services, receivers without protection
Intent Vulnerabilities: Implicit intents, intent injection
WebView Issues: JavaScript enabled, file access, XSS vulnerabilities
Cryptography: Weak algorithms, hardcoded keys, insecure random
Data Storage: World-readable files, unencrypted databases
Network Security: Clear-text traffic, SSL/TLS issues
Permissions: Dangerous permissions, custom permission issues
Code Obfuscation: ProGuard configuration analysis

Exploit Generation

QARK automatically generates exploit APKs for:

Exported component exploitation
Intent hijacking
Broadcast theft
Activity hijacking
Service manipulation

Manual Execution Workflow

Windows to Linux
Direct Linux

Run qark.bat on Windows machine
Wait for prompt to execute on server
SSH to Linux server in separate terminal

Execute command shown in prompt:

cd "/root/qark"
chmod 755 ./qark.sh
./qark.sh "/root/qark" "vulnerable_app_20230615_143022"

Wait for completion (may take several minutes)
Return to Windows terminal and press key
Archive downloads automatically

# Upload APK
scp vulnerable_app.apk root@192.168.1.100:/tmp/vulnerable_app_20230615_143022.apk

# SSH to server
ssh root@192.168.1.100

# Run QARK
cd /root/qark
qark --apk "/tmp/vulnerable_app_20230615_143022.apk" \
     --debug \
     --exploit-apk \
     --report-type html \
     --sdk-path tools/

# Archive results
cd /root/qark/qark
tar -cvzf /tmp/QarkReport.tar.gz \
  /tmp/vulnerable_app_20230615_143022.apk \
  Report_vulnerable_app_20230615_143022/ \
  logs/ \
  exploit/

# Download
scp root@192.168.1.100:/tmp/QarkReport.tar.gz ./

Troubleshooting

Script Not Found

bash: ./qark.sh: No such file or directory

Solution: Ensure qark.sh was uploaded and has correct permissions:

ls -la /root/qark/qark.sh
chmod 755 /root/qark/qark.sh

Line Ending Issues

bash: ./qark.sh: /bin/bash^M: bad interpreter

Solution: Script includes tr -d '\15\32' to fix Windows line endings automatically.

QARK Not Installed

qark: command not found

Solution: Install QARK using installation commands:

cd ~/qark
python ./setup.py install

Missing Android SDK

Error: Android SDK not found

Solution: Download and configure SDK tools:

cd $HOME/qark/
wget https://dl.google.com/android/repository/sdk-tools-linux-4333796.zip
unzip sdk-tools-linux-4333796.zip
echo y | tools/android update sdk --no-ui

Exploit APK Not Generated

If no exploit APK appears in exploit/ directory:

No exploitable vulnerabilities found
Build process failed (check logs/)
Android SDK tools not properly configured

Performance Considerations

Analysis Time: 5-15 minutes for typical APK
Large APKs: May take 30+ minutes for complex applications
Server Resources: Requires adequate CPU and memory
Network: Upload/download time depends on APK size and connection speed

Security Best Practices

Credential Management: Avoid hardcoding passwords in scripts
Secure Transport: Use SSH keys instead of passwords when possible
Network Security: Ensure SSH traffic is on trusted network
Cleanup: Script automatically removes temporary files
Archive Security: Protect downloaded archives containing sensitive analysis data

mobsf.bat: Alternative mobile security framework
androbugs_framework.bat: Another APK security scanner
apktool_decode_local.bat: Manual APK decompilation for code review

Web Scanners

Service Scanners

Mobile Analysis

Information Gathering

Utilities

Overview

Tool Information

Installation

qark.bat

Parameters

Analysis Workflow

Script Implementation

Usage Example

qark.sh

Parameters

Script Implementation

QARK Command Options

Analysis Output

Output Structure

Vulnerability Detection

Security Checks

Exploit Generation

Manual Execution Workflow

Troubleshooting

Script Not Found

Line Ending Issues

QARK Not Installed

Missing Android SDK

Exploit APK Not Generated

Performance Considerations

Security Best Practices

Web Scanners

Service Scanners

Mobile Analysis

Information Gathering

Utilities

​Overview

​Tool Information

​Installation

​qark.bat

​Parameters

​Analysis Workflow

​Script Implementation

​Usage Example

​qark.sh

​Parameters

​Script Implementation

​QARK Command Options

​Analysis Output

​Output Structure

​Vulnerability Detection

​Security Checks

​Exploit Generation

​Manual Execution Workflow

​Troubleshooting

​Script Not Found

​Line Ending Issues

​QARK Not Installed

​Missing Android SDK

​Exploit APK Not Generated

​Performance Considerations

​Security Best Practices

​Related Scripts

Overview

Tool Information

Installation

qark.bat

Parameters

Analysis Workflow

Script Implementation

Usage Example

qark.sh

Parameters

Script Implementation

QARK Command Options

Analysis Output

Output Structure

Vulnerability Detection

Security Checks

Exploit Generation

Manual Execution Workflow

Troubleshooting

Script Not Found

Line Ending Issues

QARK Not Installed

Missing Android SDK

Exploit APK Not Generated

Performance Considerations

Security Best Practices

Related Scripts