GitHub repository: OWASP/owasp-mastg

Issues:
issue_2594: state: open
title: Add Risk and Tests for Sensitive Data Stored Unencrypted in External Storage
user: serek8
issue_2593: state: open
title: Add NTLM authentication to MSTG-CRYPTO-3
user: majed79342
issue_2592: state: open
title: [New Tool] Add reflutter tool
user: sk3l10x1ng
issue_2590: state: open
title: New Risk - Improper Verification of Cryptographic Signature [improper-signature-verification]
user: cpholguera
issue_2589: state: open
title: New Risk - Weak Signature [weak-signatures]
user: cpholguera
issue_2588: state: open
title: New Risk - Weak Message Authentication Codes (MAC) [weak-mac]
user: cpholguera
issue_2587: state: open
title: New Risk - Weak Padding [weak-padding]
user: cpholguera
issue_2586: state: open
title: New Risk - Predictable Initialization Vectors (IVs) [predictable-ivs]
user: cpholguera
issue_2585: state: open
title: New Risk - Weak Hashing [weak-hashing]
user: cpholguera
issue_2584: state: open
title: New Risk - Weak Encryption [weak-encryption]
user: cpholguera
issue_2583: state: open
title: New Risk - Potentially Weak Cryptography Implementations [potentially-weak-crypto-impl]
user: cpholguera
issue_2582: state: open
title: New Risk - Cryptographic Keys Access Not Restricted [crypto-key-access-not-restricted]
user: cpholguera
issue_2581: state: open
title: New Risk - Cryptographic Keys Not Properly Protected on Export [crypto-keys-not-protected-export]
user: cpholguera
issue_2580: state: open
title: New Risk - Unsafe Handling of Imported Cryptographic Keys [unsafe-imported-key-handling]
user: cpholguera
issue_2579: state: open
title: New Risk - Deprecated Android KeyStore Implementations [deprecated-keystore]
user: cpholguera
issue_2578: state: open
title: New Risk - Cryptographic Keys Not Properly Protected at Rest [crypto-keys-not-protected-at-rest]
user: cpholguera
issue_2577: state: open
title: New Risk - Hardcoded Cryptographic Keys in Use [hardcoded-crypto-keys-usage]
user: cpholguera
issue_2576: state: open
title: New Risk - Insecure or Wrong Usage of Cryptographic Key [insecure-key-usage]
user: cpholguera
issue_2575: state: open
title: New Risk - Cryptographic Key Rotation Not Implemented [no-key-rotation]
user: cpholguera
issue_2574: state: open
title: New Risk - Weak Cryptographic Key Derivation [weak-crypto-key-derivation]
user: cpholguera
issue_2573: state: open
title: New Risk - Weak Cryptographic Key Generation [weak-crypto-key-generation]
user: cpholguera
issue_2571: state: open
title: updated ssl-kill-switch from v2 to v3 (by @appknox)
user: ScreaMy7
issue_2570: state: open
title: Updated Decrypting Realm Databases in 0x05d - Testing Data Storage and 0x06d-Testing-Data-Storage 
user: R3zk0n
issue_2569: state: open
title: [Bug] Broken link in MASVS-RESILIENCE/MASTG-TEST-0050.md
user: chagemann
issue_2567: state: open
title: New Test - data-unencrypted-internal/android-data-in-sandbox/test.md
user: thomascannon
issue_2566: state: open
title: Add Risk and Test - Sensitive Data Stored Unencrypted in Internal Locations [data-unencrypted-internal]
user: thomascannon
issue_2565: state: open
title: Create risk.md for data-hardcoded-app-package
user: juanmanuelmartinez-dekra
issue_2561: state: open
title: Broken Links in MASVS-CODE/MASTG-TEST-0025
user: cpholguera
issue_2560: state: open
title: MASTG Refactor Part 3: Knowledge
user: cpholguera
issue_2559: state: open
title: Review New Risk & Tests for data-in-logs
user: cpholguera
issue_2558: state: open
title: Review New Risk & Tests for sensitive-data-in-network-traffic
user: cpholguera
issue_2557: state: open
title: Review New Risk & Tests for insecure-random 
user: cpholguera
issue_2547: state: open
title: [Bug] Link to Android non-verifiable deep links (Android <12) is broken
user: maennel
issue_2546: state: open
title: New Risk - Device Access Security Policy Not Enforced [device-access-policy-not-enforced]
user: cpholguera
issue_2545: state: open
title: New Risk - Sensitive Data Stored Unencrypted in External Locations [data-unencrypted-external]
user: cpholguera
issue_2544: state: open
title: New Risk - Sensitive Data Stored Unencrypted in Internal Locations [data-unencrypted-internal]
user: cpholguera
issue_2543: state: open
title: New Risk - Sensitive Data Hardcoded in the App Package [data-hardcoded-app-package]
user: cpholguera
issue_2542: state: open
title: New Risk - Sensitive Data Not Excluded From Backup [data-not-excluded-backup]
user: cpholguera
issue_2541: state: open
title: New Risk - Backup Unencrypted [backup-unencrypted]
user: cpholguera
issue_2540: state: open
title: New Risk - Sensitive Data Stored With Insufficient Access Restrictions in Internal Locations [data-insufficient-access-restrictions-internal]
user: cpholguera
issue_2512: state: open
title: [Tool] gplaycli
user: ckgal
issue_2454: state: open
title: OWASP_MAS_Checklist excel broken
user: Captain404
issue_2442: state: open
title: [Technique] Update Android Traffic Interception (Android 14)
user: cpholguera
issue_2441: state: open
title: [Tool] Add BinDiff by Google
user: cpholguera
issue_2438: state: open
title: [new tool] uber-apk-signer
user: TheDauntless
issue_2429: state: open
title: [Tool] Hetty for MITM?
user: cpholguera
issue_2428: state: open
title: Add Android Credential Manager with passkeys
user: cpholguera
issue_2418: state: open
title: [new tool] Add jtool2 to iOS tools section
user: TheDauntless
issue_2412: state: open
title: [Bug] The MASTG v1.6 does not have a unique identifier for each test
user: gand3lf
issue_2384: state: open
title: Investigate dual-language code boxes
user: TheDauntless
issue_2376: state: open
title: [Bug] Xamarin 
user: sushi2k
issue_2375: state: open
title: [Tool] patch-apk
user: TheDauntless
issue_2374: state: open
title: [Tool] Add frida-android-helper
user: TheDauntless
issue_2370: state: open
title: Android 14 Updates 
user: cpholguera
issue_2344: state: open
title: Testing Preload (system) Apps 
user: cpholguera
issue_2329: state: open
title: [Bug] Device Monitor is Deprecated
user: cpholguera
issue_2285: state: open
title: Check for Pending Intents
user: cpholguera
issue_2283: state: open
title: Add Passkeys 
user: cpholguera
issue_2230: state: open
title: [Bug] Swift language not supported by pandoc
user: TheDauntless
issue_2184: state: open
title: Using Google Paranoid to Test for Bad Crypto
user: cpholguera
issue_2159: state: open
title: Add Hide Sensitive Content from Clipboard

MSTG-STORAGE-7
user: cpholguera
issue_2141: state: open
title: [0x06j] Upgrade Test Case: Jailbreak Detection (MSTG-RESILIENCE-1)
user: cpholguera
issue_2135: state: open
title: Enhance iOS Platform Overview Chapter
user: cpholguera
issue_2113: state: open
title: Update 0x05j with Play Integrity
user: cpholguera
issue_2110: state: open
title: Add References to Frida Book
user: cpholguera
issue_2109: state: open
title: iOS Developer Mode
user: cpholguera
issue_2106: state: open
title: [MSTG-PLATFORM-10] Additional option to prevent caching
user: irbishop
issue_2104: state: open
title: Testing iOS App Clips
user: cpholguera
issue_2093: state: open
title: Upgrade pandocker
user: cpholguera
issue_2091: state: open
title: [Tool] medusa
user: cpholguera
issue_2063: state: open
title: [Test Case] Dynamic Pinning
user: cpholguera
issue_2062: state: open
title: [Android Privacy] Photo Picker to avoid Storage Permission (Android 13)
user: cpholguera
issue_2052: state: open
title: [Android] Improve Activity Testing to include implicit Intent attacks 
user: LukasMarckmiller
issue_2044: state: open
title: Android Nearby Connections API
user: cpholguera
issue_2019: state: open
title: [Android] Add Windows Subsystem for Android (WSA)
user: cpholguera
issue_2014: state: open
title: Enhance General Mobile Security Testing chapter
user: cpholguera
issue_2012: state: open
title: Use Custom Linting Rules
user: cpholguera
issue_1991: state: open
title: [SMS 2FA] - Enhance SMS-delivered code security with domain-bound codes
user: cpholguera
issue_1983: state: open
title: [Tool] FlowDroid
user: cpholguera
issue_1974: state: open
title: [Android Privacy] New BLE permissions and Companion Device Pairing to avoid location permission
user: cpholguera
issue_1968: state: open
title: [Tool] xpcspy
user: cpholguera
issue_1951: state: open
title: Decrypting Realm Databases
user: R3zk0n
issue_1950: state: open
title: [iOS Privacy] Limited Library to avoid Storage Permission
user: cpholguera
issue_1949: state: open
title: iOS Pasteboard transparency and Secure Paste
user: cpholguera
issue_1946: state: open
title: Centralize Crackmes
user: cpholguera
issue_1935: state: open
title: [Tool] Update Frida based testing to use frida-swift-bridge
user: imdadvs
issue_1933: state: open
title: Release Process Improvements
user: sushi2k
issue_1917: state: open
title: Android Package Visibility
user: cpholguera
issue_1912: state: open
title: Review iOS Secure Data Storage options
user: cpholguera
issue_1907: state: open
title: [Android] Anti-debug and Anti-memory dump techniques
user: darvincisec
issue_1895: state: open
title: [Tool] Android Static Analyzers
user: cpholguera
issue_1890: state: open
title: 0x5d - Android AccountManager not yet addressed
user: cpholguera
issue_1886: state: open
title: Reading system log with socat does not work (anymore?)
user: gl4nce
issue_1881: state: open
title: [Tool] strongarm Static Analyzer
user: cpholguera
issue_1867: state: open
title: Testing for setWebContentsDebuggingEnabled() is Enabled
user: kousha1999
issue_1853: state: open
title: 0x05d - Expand firebase and add scoped storage
user: 0x10f2c
issue_1848: state: open
title: 0x05h - Add Android 11 Changes and update android 10
user: 0x10f2c
issue_1841: state: open
title: 0x05d Refactor - Remove Info already available Online
user: cpholguera
issue_1838: state: open
title: Objection - more consistence in the guide
user: sushi2k
issue_1823: state: open
title: [Tool] LibScout
user: cpholguera
issue_1820: state: open
title: MSTG-Platform-11 is missing as test case 
user: sushi2k
issue_1818: state: open
title: Review existing Source Code 
user: sushi2k
issue_1767: state: open
title: iOS DeviceCheck to detect tampering
user: jeroenleenarts
issue_1752: state: open
title: Add a test case to check for sensitive information hardcoded
user: crazykid95
issue_1717: state: open
title: Cleanup in-chapter write-up-like content
user: cpholguera
issue_1713: state: open
title: Android quality code next level (MSTG-CODE-5)
user: lwierzbicki
issue_1709: state: open
title: Warning message and/or preventing screenshot for personal data sensitive applications
user: ninedter
issue_1689: state: open
title: Android crypto next level (MSTG-CRYPTO-1, MSTG-CRYPTO-2, MSTG-CRYPTO-3 and MSTG-CRYPTO-5)
user: lwierzbicki
issue_1688: state: open
title: [iOS] Have a testcase for MSTG‑RESILIENCE‑13
user: sushi2k
issue_1662: state: open
title: Encrypted Shared Preferences not covered in MSTG-STORAGE-1 and MSTG-STORAGE-2
user: galapogos
issue_1647: state: open
title: [Tool Android] GDA Android Reversing Tool
user: lwierzbicki
issue_1645: state: open
title: Non-Proxy Aware Apps DNS method addition
user: DemanNL
issue_1634: state: open
title: iOS level 2 crackme issues
user: chq-matteo
issue_1629: state: open
title: Double check Frida Detection
user: cpholguera
issue_1624: state: open
title: Enhance testing with Frida for non-jailbroken devices
user: sushi2k
issue_1575: state: open
title: [Android Tool] VirtualXposed
user: cpholguera
issue_1541: state: open
title: migrate away crackme write-ups folder
user: commjoen
issue_1513: state: open
title: Create a testcase for not synchronizing confidential data using cloudkit
user: commjoen
issue_1511: state: open
title: Have testcases for sign in with apple integration (MSTG-AUTH)
user: commjoen
issue_1508: state: open
title: Update android 10 at storage: scoped storage (MSTG-STORAGE)
user: commjoen
issue_1506: state: open
title: Andriod 10 anti-tampering: run embedded uncompressed DEX directly
user: commjoen
issue_1495: state: open
title: Open todo's for 0x05a Broadcast Receiver fix 
user: commjoen
issue_1494: state: open
title: [Android] Have a testcase for MSTG‑RESILIENCE‑13
user: commjoen
issue_1492: state: open
title: Extend MSTG‑NETWORK‑3 with Certificate transparency for iOS and Android
user: commjoen
issue_1488: state: open
title: Implement testcase for MSTG-PLATFORM-11
user: commjoen
issue_1487: state: open
title: Extend webview testcases with MSTG-Platform-10
user: commjoen
issue_1486: state: open
title: Extend MSTG-CODE-4 testcases
user: commjoen
labels: close?: Issue can potentially be closed according to the new approach.
issue_1485: state: open
title: Create testcase for MSTG-Storage-15
user: commjoen
labels: close?: Issue can potentially be closed according to the new approach.
issue_1484: state: open
title: Create testcase for MSTG-Storage-13 & MSTG‑STORAGE‑14
user: commjoen
labels: close?: Issue can potentially be closed according to the new approach.
issue_1450: state: open
title: [Android Tool] Dexcalibur
user: cpholguera
issue_1449: state: open
title: Android Anti-Reversing Defenses: Testing File Integrity Checks (MSTG-RESILIENCE-3) requires updating
user: olex-st
issue_1421: state: open
title: [Android/iOS Tool] Dwarf
user: TheDauntless
issue_1402: state: open
title: Use of PKCE is recommended in 0x04e, but there appears to be no testcase for verifying if it's in place
user: meetinthemiddle-be
issue_1364: state: open
title: 5c - Create Information Gathering (Dynamic Instrumentation)
user: cpholguera
issue_1347: state: open
title: [iOS] Making Sure that the App Is Properly Signed (MSTG‑CODE‑1)
user: sushi2k
issue_1201: state: open
title: Slow down attack’s on Android keystore via side channel attacks MSTG‑STORAGE‑14
user: sushi2k
issue_1181: state: open
title: Update 0x05a-Platform-Overview regarding ART
user: sushi2k
issue_1174: state: open
title: update oauth2 
user: commjoen
issue_1163: state: open
title: iOS and Android: improve platform interaction on notifications
user: commjoen
issue_1162: state: open
title: iOS 12 update: update on password management & credential/session sharing
user: commjoen
issue_1146: state: open
title: [Android] Ways to detect Magisk
user: galapogos
issue_1116: state: open
title: Add missing reverse engineering testcases for iOS
user: commjoen
issue_1113: state: open
title: Add MSTG-RESILIENCE-7 and MSTG-RESILIENCE-8
user: commjoen
issue_1050: state: open
title: Clean Git Repo
user: sushi2k
issue_1041: state: open
title: Create testcase issues on data storage for Parse and CouchDB
user: commjoen
issue_955: state: open
title: Android Oreo update: change in classloaders & native app-wrapping
user: commjoen
issue_954: state: open
title: Android Oreo change: Install from unknown sources
user: commjoen
issue_948: state: open
title: Android P update: Android protected confirmation
user: commjoen
issue_945: state: open
title: Android Oreo updates: changes in how shared memory is handled
user: commjoen
issue_943: state: open
title: Android Oreo and P update: autofill framework
user: commjoen
issue_941: state: open
title: Android Oreo change: broadcast limitations & background service limitations
user: commjoen
issue_940: state: open
title: Add section on Android enterprise
user: commjoen
issue_889: state: open
title: Add content for secure compiler settings for Android NDK 
user: sushi2k