deardaniel/secdata-raw huggingface dataset:
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0024

---
platform: ios
title: Uses of LAContext.canEvaluatePolicy with r2
id: MASTG-DEMO-0024
code: [swift]
test: MASTG-TEST-0248
---

## Sample

The following sample checks whether the device has a set passcode.

{{ MastgTest.swift }}

## Steps

1. Unzip the app package and locate the main binary file (@MASTG-TECH-0058), which in this case is `./Payload/MASTestApp.app/MASTestApp`.
2. Run `run.sh`.

{{ isDevicePasscodeSet.r2 }}

{{ run.sh }}

## Observation

{{ output.asm }}

The output reveals the use of `LAContext().canEvaluatePolicy(.deviceOwnerAuthentication, error: nil)` in the app. However, it's not exactly the same in the output because the compiler transformed this function call into an Objective-C counterpart under the hood. Therefore, an equivalent Objective-C representation in the binary should look like `objc_msgSend(void *address, "canEvaluatePolicy:error:", LAPolicyDeviceOwnerAuthentication)`. By looking at the output we can find this pattern at line 11/12.

The third argument of `objc_msgSend(...)` is `LAPolicyDeviceOwnerAuthentication` because `w2` register at the time of the function invocation is set to `2` with a `mov` instruction at Line 9. `2` is an [enum](https://developer.apple.com/documentation/localauthentication/lapolicy?language=objc) representation of `LAPolicyDeviceOwnerAuthentication`.

## Evaluation

The test passes because the output shows references to passcode verification APIs.
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0036

---
title: Debuggable Entitlement Enabled in the entitlements.plist with rabin2
platform: ios
code: [swift]
id: MASTG-DEMO-0036
test: MASTG-TEST-0261
---

## Sample

The sample code includes the entitlements.plist file with the `get-task-allow' entitlement, which makes the app debuggable.

{{ entitlements.plist }}

## Steps

1. Unzip the app package and locate the main binary file (@MASTG-TECH-0058), which in this case is `./Payload/MASTestApp.app/MASTestApp`.
2. Run @MASTG-TOOL-0129 with the `-OC` options to obtain the entitlements file.

{{ run.sh }}

## Observation

The output reveals the value of the `get-task-allow` entitlement.

{{ output.asm }}

## Evaluation

The test fails because the app is debuggable due to the `get-task-allow` entitlement being present and set to `true`.
OWASP Mobile Application Security Testing Guide: output

json.NSAppTransportSecurity.NSAllowsArbitraryLoads = true;
json.NSAppTransportSecurity.NSAllowsArbitraryLoadsForLocalNetworking = true;
json.NSAppTransportSecurity.NSAllowsArbitraryLoadsForMedia = true;
json.NSAppTransportSecurity.NSAllowsArbitraryLoadsInWebContent = true;
json.NSAppTransportSecurity.NSExceptionDomains["api.example.com"].NSExceptionAllowsInsecureHTTPLoads = true;
json.NSAppTransportSecurity.NSExceptionDomains["httpbin.org"].NSExceptionAllowsInsecureHTTPLoads = true;
OWASP Mobile Application Security Testing Guide: output

Uses of http:// URLs:
0   0x00006bd0 0x100006bd0 56  57   2.__TEXT.__cstring       ascii HTTP request to http://httpbin.org/get returned status:
1   0x00006c10 0x100006c10 47  48   2.__TEXT.__cstring       ascii HTTP request to http://httpbin.org/get failed:
3   0x00006c60 0x100006c60 22  23   2.__TEXT.__cstring       ascii http://httpbin.org/get
4   0x00006c80 0x100006c80 36  37   2.__TEXT.__cstring       ascii Invalid URL: http://httpbin.org/get\n

xrefs to http://httpbin.org/get:
sym.func.100005024 0x100005130 [STRN:r--] add x8, x8, str.http:__httpbin.org_get

Use of http://httpbin.org/get:
│           0x100005130      add x8, x8, 0xc60                         ; 0x100006c60 ; "http://httpbin.org/get"
│           0x100005134      sub x27, x8, 0x20
│           0x100005138      mov x0, x24
│           0x10000513c      bl sym.imp.swift_retain
│           0x100005140      mov x0, x23                               ; void *arg0
│           0x100005144      bl sym.imp.swift_bridgeObjectRetain       ; void *swift_bridgeObjectRetain(void *arg0)
│           0x100005148      orr x1, x27, 0x[PII_REDACTED]000000
│           0x10000514c      mov x8, x26
│           0x100005150      mov x0, 0x16
│           0x100005154      movk x0, 0xd000, lsl 48
│           0x100005158      bl sym.imp.Foundation.URL.string_...cfC_  ; Foundation.URL.string(...cfC)
│           0x10000515c      ldr x8, [x28, 0x30]
│           0x100005160      mov x0, x26
│           0x100005164      mov w1, 1
│           0x100005168      mov x2, x22
...
│           0x100005224      mov x0, x27
│           0x100005228      mov x1, x26
│           0x10000522c      mov x2, x22
│           0x100005230      blr x8
│           0x100005234      adrp x8, segment.__DATA                   ; 0x10000c000
│           0x100005238      ldr x0, [x8, 0xc8]                        ; [0x10000c0c8:4]=158
│                                                                      ; reloc.NSURLSession ; void *arg0
│           0x10000523c      bl sym.imp.objc_opt_self                  ; void *objc_opt_self(void *arg0)
│           0x100005240      adrp x8, segment.__DATA                   ; 0x10000c000
│           0x100005244      ldr x1, [x8, 0xa0]                        ; [0x10000c0a0:4]=0x6e87 ; reloc.fixup.sharedSession ; char *selector
│           0x100005248      bl sym.imp.objc_msgSend                   ; void *objc_msgSend(void *instance, char *selector)
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0084

---
platform: ios
title: Hardcoded HTTP URLs in iOS Binary
code: [swift]
id: MASTG-DEMO-0084
test: MASTG-TEST-0321
kind: fail
---

## Sample

The code snippet below shows sample code that uses hardcoded HTTP URLs:

{{ ../MASTG-DEMO-0083/MastgTest.swift }}

## Steps

1. Unzip the app package and locate the main binary file (@MASTG-TECH-0058), which in this case is `./Payload/MASTestApp.app/MASTestApp`.
2. Run @MASTG-TOOL-0073 with the script to search for HTTP URLs in the binary.

{{ http_urls.r2 }}

{{ run.sh }}

## Observation

The output contains a list of HTTP URLs found in the binary and locations in the app binary:

{{ output.txt }}

## Evaluation

The test fails because the hardcoded HTTP URL `http://httpbin.org/get` was found in the binary, and the app has an ATS configuration that allows cleartext HTTP traffic to that domain (see @MASTG-DEMO-0083).

We know that the URL is actually used by the app because the string is used at `0x100005130` and passed to an `URL` instance at `0x100005158` which is then used in a `URLSession` at `0x100005238`.
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0085

---
platform: ios
title: Uses of Network Framework Bypassing ATS
code: [swift]
id: MASTG-DEMO-0085
test: MASTG-TEST-0323
kind: fail
---

## Sample

The code sample code uses the `Network` framework to establish a connection to `httpbin.org` on port `80`. The demo doesn't send any data over the connection, but for the purposes of this demo, assume that it does.

{{ MastgTest.swift }}

Note that we do not modify ATS so such a connection should be blocked. However, ATS does not apply to the `Network` framework so the connection will succeed.

## Steps

1. Unzip the app package and locate the main binary file (@MASTG-TECH-0058), which in this case is `./Payload/MASTestApp.app/MASTestApp`.
2. Run @MASTG-TOOL-0073 with the script to search for low-level networking APIs in the binary. In this case, we'll focus on `NWEndpoint.Port.integerLiteral`, which is used to specify the port number when creating a network endpoint, but you could also look for `NWConnection` and `NWParameters`.

{{ low_level_network.r2 }}

{{ run.sh }}

## Observation

The output contains references to the `NWEndpoint.Port.integerLiteral` function, including the locations where it is used in the binary and the value passed to it:

{{ output.asm }}

## Evaluation

The test fails because the app uses `NWEndpoint.Port.integerLiteral` to specify port `80` for a network connection by loading the value `0x50` (which is `80` in decimal) into register `w0` before calling the function.
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0086

---
platform: ios
title: Uses of BSD Sockets Bypassing ATS
code: [swift]
id: MASTG-DEMO-0086
test: MASTG-TEST-0323
kind: fail
---

## Sample

The code sample code uses BSD sockets directly to establish a connection to `httpbin.org` on port `80`. The demo doesn't send any data over the connection, but for the purposes of this demo, assume that it does.

{{ MastgTest.swift }}

## Steps

1. Unzip the app package and locate the main binary file (@MASTG-TECH-0058), which in this case is `./Payload/MASTestApp.app/MASTestApp`.
2. Run @MASTG-TOOL-0073 with the script to search for BSD socket APIs in the binary.

{{ bsd_sockets.r2 }}

{{ run.sh }}

## Observation

The output contains references to BSD socket APIs found in the binary:

{{ output.asm }}

## Evaluation

The test fails because the app uses BSD sockets directly, including `socket`, `connect`, `send`, `recv`, and `getaddrinfo`. The binary imports these symbols and calls them to create a cleartext network connection that bypasses ATS. The `getaddrinfo` call resolves the hostname `httpbin.org` and is supplied with a service value representing port `80`.

The signature of the `getaddrinfo` function from the [Darwin libc man pages](https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/getaddrinfo.3.html) is as follows:

```c
int getaddrinfo(
    const char *restrict nodename,
    const char *restrict servname,
    const struct addrinfo *restrict hints,
    struct addrinfo **restrict res
);
```

Where `nodename` is the host (e.g., `"example.com"`) and `servname` is the service name or port string (e.g., `"http"` or `"80"`).

At `0x100004188` the code loads `w8` with `0x50` and stores it as a halfword at `var_30h`, then sets `x20` to `sp + 0x30` and later calls `utf8CString.ContiguousArray.setter`. This sequence uses the numeric value `0x50`, which is `80` in decimal, and converts it into a NUL terminated UTF8 string buffer.

At `0x1000041c4` the code sets `x1` to `x24 + 0x20`, which points to the previous string buffer, and passes it into `getaddrinfo` as the `servname` parameter. The `nodename` parameter in `x0` points to the literal `httpbin.org`. The `hints` and `res` pointers are passed via stack addresses `sp + 0x50` and `sp + 0x48`.
OWASP Mobile Application Security Testing Guide: output

List all uses of the UIWebView class:
0x100010108 8 reloc.UIWebView

List all xrefs to the 'UIWebView' class:
sym.MASTestApp.MastgTest.mastg.completion__1 0x100004514 [DATA:r--] ldr x0, reloc.UIWebView

Code snippet that contains the xref to 'UIWebView':
│           0x100004514      ldr x0, [x8, 0x108]                       ; [0x100010108:4]=231
│                                                                      ; reloc.UIWebView ; void *arg0
│           0x100004518      bl sym.imp.objc_allocWithZone             ; void *objc_allocWithZone(void *arg0)
│           0x10000451c      adrp x26, sym.__METACLASS_DATA__TtC10MASTestAppP33_[PII_REDACTED]C95FC8EC1D59DD4CF2A2DB19ResourceBundleClass ; 0x100010000
│           0x100004520      ldr x1, [x26, 0x90]                       ; [0x100010090:4]=0xb0d9 ; reloc.fixup.init
│                                                                      [21] -rw- section size 112 named 21.__DATA.__objc_selrefs ; char *selector
│           0x100004524      bl sym.imp.objc_msgSend                   ; void *objc_msgSend(void *instance, char *selector)
│           0x100004528      mov x21, x0
│           0x10000452c      adrp x8, sym.imp.swift_deallocObject      ; 0x10000a000
│           0x100004530      add x8, x8, 0xc90                         ; 0x10000ac90 ; "https://owasp.org"
│           0x100004534      sub x8, x8, 0x20
│           0x100004538      orr x1, x8, 0x[PII_REDACTED]000000
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0094

---
platform: ios
title: Use of the Deprecated UIWebView
code: [swift]
id: MASTG-DEMO-0094
test: MASTG-TEST-0331
kind: fail
---

## Sample

The following sample demonstrates the use of [`UIWebView`](https://developer.apple.com/documentation/uikit/uiwebview).

{{ MastgTest.swift }}

## Steps

1. Unzip the app package and locate the main binary file (@MASTG-TECH-0058), which in this case is `./Payload/MASTestApp.app/MASTestApp`.
2. Open the app binary with @MASTG-TOOL-0073 with the `-i` option to run the script.

{{ uiwebview.r2 # run.sh }}

## Observation

The output contains a reference to [`UIWebView`](https://developer.apple.com/documentation/uikit/uiwebview) used from the `sym.MASTestApp.MastgTest.mastg.completion__1` function.

{{ output.txt }}

## Evaluation

The test fails because the app uses the deprecated `UIWebView` class.
OWASP Mobile Application Security Testing Guide: output

Uses of loadRequest or loadFileURL:
0x10000c0ff 37 str.loadFileURL:allowingReadAccessToURL:
0x100018118 8 reloc.fixup.loadFileURL:allowingReadAccessT

xrefs to 'loadFileURL' selector
sym.MASTestApp.MastgTest.showHtmlRegistrationView._6E8AB2C58CE173A727EF27CB85DF8CD8.username.completion 0x100004f10 [DATA:r--] ldr x1, reloc.fixup.loadFileURL:allowingReadAccessT
HTML template string (contains innerHTML injection):
0x10000b261 hit4_0 "yId('username').innerHTML = name;</scrip"
OWASP Mobile Application Security Testing Guide: output

[+] Hooks deployed successfully.
[WKPreferences: allowFileAccess] = 1
[WKWebViewConfig: universalAccess] = 0
[WKWebView] loadFileURL called
  fileURL: file:///Users/user/Library/Developer/CoreSimulator/Devices/196D4426-FBB3-4AD8-B1FA-B09E13C6B6E0/data/Containers/Data/Application/028A3B5E-BFE9-4C33-B07F-AA84E9570298/Library/Caches/demoRoot/app/index.html
  allowingReadAccessTo: file:///Users/user/Library/Developer/CoreSimulator/Devices/196D4426-FBB3-4AD8-B1FA-B09E13C6B6E0/data/Containers/Data/Application/028A3B5E-BFE9-4C33-B07F-AA84E9570298/Library/Caches/demoRoot/
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0099

---
platform: ios
title: Runtime Monitoring of WebView File Access with Frida
id: MASTG-DEMO-0099
code: [swift]
test: MASTG-TEST-0336
---

## Sample

This demo uses the same sample as @MASTG-DEMO-0098.

{{ ../MASTG-DEMO-0098/MastgTest.swift }}

## Steps

1. Install the app on a device (@MASTG-TECH-0056).
2. Make sure you have @MASTG-TOOL-0039 installed on your machine and the `frida-server` running on the device.
3. Launch the MASTestApp on the device.
4. Run `run.sh` to attach Frida to the running app.
5. Click the **Start** button in the app to trigger the WebView configuration.
6. Stop the script by pressing `Ctrl+C`.

{{ run.sh # script.js }}

The Frida script hooks several WebKit APIs at runtime and logs their arguments when they are invoked:

- `WKPreferences _setAllowFileAccessFromFileURLs:` to detect when the app enables access from `file://` pages to other local files.
- `WKWebViewConfiguration _setAllowUniversalAccessFromFileURLs:` to detect when the app allows `file://` pages to access any origin.
- `WKPreferences setJavaScriptEnabled:` to determine whether JavaScript execution is enabled in the WebView.
- `WKWebView loadFileURL:allowingReadAccessToURL:` to identify when the app loads local files into a WebView and to capture both the loaded file and the granted read access scope.

## Observation

The output shows that the application enables file access from `file://` URLs in the WebView and loads a local HTML file from a demo directory under the app's caches directory.

{{ output.txt }}

The logs indicate that:

- `allowFileAccessFromFileURLs` is set to `1`.
- `allowUniversalAccessFromFileURLs` remains `0` (disabled).
- The WebView loads a local file such as `.../Library/Caches/demoRoot/index.html`.
- `allowingReadAccessTo` is set to the `demoRoot` directory under the app's caches directory `.../Library/Caches/demoRoot/`.

## Evaluation

The test **fails** because the application enables file access from `file://` URLs for a `WKWebView` that loads local `file://` content from the app's caches directory.

Specifically:

- `allowFileAccessFromFileURLs` is set to `true`, allowing JavaScript running in a `file://` page to access other local files within the granted read scope.
- The WebView loads a local HTML file and grants read access to the `demoRoot` directory under the application's caches directory.

These settings weaken the isolation normally applied to local content and increase the impact of WebView vulnerabilities. If attacker-controlled JavaScript executes in the local page context, it may access files within the granted read scope and potentially exfiltrate them to remote servers.
OWASP Mobile Application Security Testing Guide: output

URLsForDirectory:inDomains: selector (API anchor for the allowingReadAccessTo initializer):
0x10000c043 28 str.URLsForDirectory:inDomains:
0x100018130 8 reloc.fixup.URLsForDirectory:inDomains:

xrefs to URLsForDirectory:inDomains: (finds the allowingReadAccessTo lazy initializer):
sym.MASTestApp.MastgTest.docDir._6E8AB2C58CE173A727EF27CB85DF8CD8_...Z_ 0x100004094 [DATA:r--] ldr x1, reloc.fixup.URLsForDirectory:inDomains:

appendingPathComponent selector (API anchor for the fileURL initializer):
0x10000a738 12 sym.imp.Foundation.URL.appendingPathComponent_...CSSF_
0x1000146b8 8 reloc.Foundation.URL.appendingPathComponent_...CSSF_

xrefs to appendingPathComponent import stub (finds the fileURL materializer ZTm_):
sym.MASTestApp.MastgTest.fileURL._6E8AB2C58CE173A727EF27CB85DF8CD8_...ZTm_ 0x100004240 [CALL:--x] bl sym.imp.Foundation.URL.appendingPathComponent_...CSSF_

xrefs to ZTm_ (finds the swift_once guard Z_ that encodes the filename as inline constants):
sym.MASTestApp.MastgTest.fileURL._6E8AB2C58CE173A727EF27CB85DF8CD8_...Z_ 0x100004164 [CODE:--x] b sym.MASTestApp.MastgTest.fileURL._6E8AB2C58CE173A727EF27CB85DF8CD8_...ZTm_
sym.MASTestApp.MastgTest.secretURL._6E8AB2C58CE173A727EF27CB85DF8CD8_...Z_ 0x100004188 [CODE:--x] b sym.MASTestApp.MastgTest.fileURL._6E8AB2C58CE173A727EF27CB85DF8CD8_...ZTm_

HTML template string (contains innerHTML injection):
0x10000b261 hit4_0 "yId('username').innerHTML = name;</scrip"
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0053

---
platform: ios
title: Identifying Insecure Dependencies in SwiftPM through SBOM creation
id: MASTG-DEMO-0053
test: MASTG-TEST-0273
---

## Steps

Execute @MASTG-TOOL-0134 in the root directory of the Xcode project.

{{ run.sh }}

This will create a SBOM file that can be uploaded to @MASTG-TOOL-0132 by following @MASTG-TECH-0132.

## Observation

In the project of @MASTG-TOOL-0132, where the SBOM has been uploaded, the scan should have identified 2 unique dependencies (components) with 2 vulnerable dependencies and 2 vulnerabilities (as more vulnerabilities might be found over time this number might increase).

{{ output.txt }}

## Evaluation

Review each of the reported instances. The dependency `swift-nio` has 2 known vulnerabilities and should be updated to the latest version.
OWASP Mobile Application Security Testing Guide: MASTG DEMO 0052

---
platform: ios
title: Scanning Package Manager Artifacts for Insecure iOS Dependencies
id: MASTG-DEMO-0052
code: [java]
test: MASTG-TEST-0273
---

## Sample

{{ Package.resolved # Package.resolved }}

## Steps

Let's run @MASTG-TOOL-0131 in the root directory of the Xcode project.

{{ run.sh }}

## Observation

The SARIF file can be opened by using @MASTG-TOOL-0133 for analyzing the identified vulnerabilities.

{{ output.txt }}

## Evaluation

Review each of the reported instances, as it can contain false positives. The library `swift-nio` has at least 2 known vulnerabilities as part of Swift with CVE-2022-3918 and CVE-2022-1642 and should be updated to the latest version.
OWASP Mobile Application Security Testing Guide: MASTG BEST 0017

---
title: Use `setSecure` to Prevent Screenshots in SurfaceViews
alias: preventing-screenshots-and-screen-recording
id: MASTG-BEST-0017
platform: android
status: placeholder
note: Preventing screenshots and screen recording helps protect sensitive data from being exposed in system-generated snapshots and recordings.
---
OWASP Mobile Application Security Testing Guide: MASTG BEST 0004

---
title: Exclude Sensitive Data from Backups
alias: exclude-sensitive-data-from-backups
id: MASTG-BEST-0004
platform: android
knowledge: [MASTG-KNOW-0050]
---

For the sensitive files found, instruct the system to exclude them from the backup:

- If you are using Auto Backup, mark them with the `exclude` tag in `backup_rules.xml` (for Android 11 or lower using `android:fullBackupContent`) or `data_extraction_rules.xml` (for Android 12 and higher using `android:dataExtractionRules`), depending on the target API. Make sure to use both the `cloud-backup` and `device-transfer` parameters.
- If you are using the key-value approach, set up your [BackupAgent](https://developer.android.com/identity/data/keyvaluebackup#BackupAgent) accordingly.

Refer to ["Security recommendations for backups - Mitigations"](https://developer.android.com/privacy-and-security/risks/backup-best-practices#security-recommendations-for-backups-mitigations) for more information.
OWASP Mobile Application Security Testing Guide: MASTG BEST 0003

---
title: Comply with Privacy Regulations and Best Practices
alias: comply-with-privacy-regulations
id: MASTG-BEST-0003
platform: android
---


Recommendations from [CWE-359](https://cwe.mitre.org/data/definitions/359.html).

## Phase: Requirements

Identify and consult all relevant regulations for personal privacy. An organization may be required to comply with certain federal and state regulations, depending on its location, the type of business it conducts, and the nature of any private data it handles. Regulations may include Safe Harbor Privacy Framework [REF-340], Gramm-Leach Bliley Act (GLBA) [REF-341], Health Insurance Portability and Accountability Act (HIPAA) [REF-342], General Data Protection Regulation (GDPR) [REF-1047], California Consumer Privacy Act (CCPA) [REF-1048], and others.

## Phase: Architecture and Design

Carefully evaluate how secure design may interfere with privacy, and vice versa. Security and privacy concerns often seem to compete with each other.

- From a security perspective, all important operations should be recorded so that any anomalous activity can later be identified.
- However, when private data is involved, this practice can in fact create risk. Although there are many ways in which private data can be handled unsafely, a common risk stems from misplaced trust.

Programmers often trust the operating environment in which a program runs, and therefore believe that it is acceptable store private information on the file system, in the registry, or in other locally-controlled resources. However, even if access to certain resources is restricted, this does not guarantee that the individuals who do have access can be trusted.

## References

- [REF-340] U.S. Department of Commerce. "Safe Harbor Privacy Framework". <https://web.archive.org/web/[PII_REDACTED]3241/http://www.export.gov/safeharbor/>. URL validated: 2023-04-07.
- [REF-341] Federal Trade Commission. "Financial Privacy: The Gramm-Leach Bliley Act (GLBA)". <https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act>. URL validated: 2023-04-07.
- [REF-342] U.S. Department of Human Services. "Health Insurance Portability and Accountability Act (HIPAA)". <https://www.hhs.gov/hipaa/index.html>. URL validated: 2023-04-07.
- [REF-1047] Wikipedia. "General Data Protection Regulation". <https://en.wikipedia.org/wiki/General_Data_Protection_Regulation>.
- [REF-1048] State of California Department of Justice, Office of the Attorney General. "California Consumer Privacy Act (CCPA)". <https://oag.ca.gov/privacy/ccpa>.