deardaniel/secdata-raw huggingface dataset:
OWASP Mobile Application Security Testing Guide: MASTG TEST 0073

---
masvs_v1_id:
- MSTG-PLATFORM-4
masvs_v2_id:
- MASVS-PLATFORM-1
platform: ios
title: Testing UIPasteboard
masvs_v1_levels:
- L1
- L2
profiles: [L1, L2]
status: deprecated
deprecation_note: New version available in MASTG V2
covered_by: [MASTG-TEST-0276, MASTG-TEST-0277, MASTG-TEST-0278, MASTG-TEST-0279, MASTG-TEST-0280]
---

## Overview

## Static Analysis

The **systemwide general pasteboard** can be obtained by using [`generalPasteboard`](https://developer.apple.com/documentation/uikit/uipasteboard/1622106-generalpasteboard?language=objc "UIPasteboard generalPasteboard"), search the source code or the compiled binary for this method. Using the systemwide general pasteboard should be avoided when dealing with sensitive data.

**Custom pasteboards** can be created with [`pasteboardWithName:create:`](https://developer.apple.com/documentation/uikit/uipasteboard/1622074-pasteboardwithname?language=objc "UIPasteboard pasteboardWithName:create:") or [`pasteboardWithUniqueName`](https://developer.apple.com/documentation/uikit/uipasteboard/1622087-pasteboardwithuniquename?language=objc "UIPasteboard pasteboardWithUniqueName"). Verify if custom pasteboards are set to be persistent as this is deprecated since iOS 10. A shared container should be used instead.

In addition, the following can be inspected:

- Check if pasteboards are being removed with [`removePasteboardWithName:`](https://developer.apple.com/documentation/uikit/uipasteboard/1622072-removepasteboardwithname?language=objc "UIPasteboard removePasteboardWithName:"), which invalidates an app pasteboard, freeing up all resources used by it (no effect for the general pasteboard).
- Check if there are excluded pasteboards, there should be a call to `setItems:options:` with the `UIPasteboardOptionLocalOnly` option.
- Check if there are expiring pasteboards, there should be a call to `setItems:options:` with the `UIPasteboardOptionExpirationDate` option.
- Check if the app clears the pasteboard items when going to background or when terminating. This is done by some password manager apps trying to restrict sensitive data exposure.

## Dynamic Analysis

### Detect Pasteboard Usage

Hook or trace the following:

- `generalPasteboard` for the system-wide general pasteboard.
- `pasteboardWithName:create:` and `pasteboardWithUniqueName` for custom pasteboards.

### Detect Persistent Pasteboard Usage

Hook or trace the deprecated [`setPersistent:`](https://developer.apple.com/documentation/uikit/uipasteboard/1622096-setpersistent?language=objc "UIPasteboard setPersistent:") method and verify if it's being called.

### Monitoring and Inspecting Pasteboard Items

To monitor and inspect pasteboard items at runtime you can follow the instructions from @MASTG-TECH-0134.
OWASP Mobile Application Security Testing Guide: MASTG TEST 0059

---
masvs_v1_id:
- MSTG-STORAGE-9
masvs_v2_id:
- MASVS-PLATFORM-3
platform: ios
title: Testing Auto-Generated Screenshots for Sensitive Information
masvs_v1_levels:
- L2
profiles: [L2]
status: deprecated
covered_by: [MASTG-TEST-0290]
deprecation_note: New version available in MASTG V2
---

## Overview

## Static Analysis

If you have the source code, search for the [`applicationDidEnterBackground`](https://developer.apple.com/documentation/uikit/uiapplicationdelegate/1622997-applicationdidenterbackground) method to determine whether the application sanitizes the screen before being backgrounded.

The following is a sample implementation using a default background image (`overlayImage.png`) whenever the application is backgrounded, overriding the current view:

Swift:

```swift
private var backgroundImage: UIImageView?

func applicationDidEnterBackground(_ application: UIApplication) {
    let myBanner = UIImageView(image: #imageLiteral(resourceName: "overlayImage"))
    myBanner.frame = UIScreen.main.bounds
    backgroundImage = myBanner
    window?.addSubview(myBanner)
}

func applicationWillEnterForeground(_ application: UIApplication) {
    backgroundImage?.removeFromSuperview()
}
```

Objective-C:

```objectivec
@property (UIImageView *)backgroundImage;

- (void)applicationDidEnterBackground:(UIApplication *)application {
    UIImageView *myBanner = [[UIImageView alloc] initWithImage:@"overlayImage.png"];
    self.backgroundImage = myBanner;
    self.backgroundImage.bounds = UIScreen.mainScreen.bounds;
    [self.window addSubview:myBanner];
}

- (void)applicationWillEnterForeground:(UIApplication *)application {
    [self.backgroundImage removeFromSuperview];
}
```

This sets the background image to `overlayImage.png` whenever the application is backgrounded. It prevents sensitive data leaks because `overlayImage.png` will always override the current view.

## Dynamic Analysis

You can use a _visual approach_ to quickly validate this test case using any iOS device (jailbroken or not):

1. Navigate to an application screen that displays sensitive information, such as a username, an email address, or account details.
2. Background the application by hitting the **Home** button on your iOS device.
3. Verify that a default image is shown as the top view element instead of the view containing the sensitive information.

If required, you may also collect evidence by performing steps 1 to 3 on a jailbroken device or a non-jailbroken device after repackaging the app with the Frida Gadget (@MASTG-TECH-0090). After that, connect to the iOS device with SSH (@MASTG-TECH-0052) or by other means (@MASTG-TECH-0053) and navigate to the Snapshots directory. The location may differ on each iOS version but it's usually inside the app's Library directory. For instance, on iOS 14.5 the Snapshots directory is located at:

```txt
/var/mobile/Containers/Data/Application/$APP_ID/Library/SplashBoard/Snapshots/sceneID:$APP_NAME-default/
```

The screenshots inside that folder should not contain any sensitive information.
OWASP Mobile Application Security Testing Guide: MASTG TEST 0056

---
masvs_v1_id:
- MSTG-STORAGE-6
masvs_v2_id:
- MASVS-PLATFORM-1
platform: ios
title: Determining Whether Sensitive Data Is Exposed via IPC Mechanisms
masvs_v1_levels:
- L1
- L2
profiles: [L1, L2]
---

## Overview

## Static Analysis

The following section summarizes keywords that you should look for to identify IPC implementations within iOS source code.

### XPC Services

Several classes may be used to implement the NSXPCConnection API:

- NSXPCConnection
- NSXPCInterface
- NSXPCListener
- NSXPCListenerEndpoint

You can set [security attributes](https://www.objc.io/issues/14-mac/xpc/#security-attributes-of-the-connection "Security Attributes of NSXPCConnection") for the connection. The attributes should be verified.

Check for the following two files in the Xcode project for the XPC Services API (which is C-based):

- [`xpc.h`](https://developer.apple.com/documentation/xpc/xpc_services_xpc.h "xpc.h")
- `connection.h`

### Mach Ports

Keywords to look for in low-level implementations:

- mach\_port\_t
- mach\_msg\_*

Keywords to look for in high-level implementations (Core Foundation and Foundation wrappers):

- CFMachPort
- CFMessagePort
- NSMachPort
- NSMessagePort

### NSFileCoordinator

Keywords to look for:

- NSFileCoordinator

## Dynamic Analysis

Verify IPC mechanisms with static analysis of the iOS source code. No iOS tool is currently available to verify IPC usage.
OWASP Mobile Application Security Testing Guide: MASTG TEST 0086

---
masvs_v1_id:
- MSTG-CODE-8
masvs_v2_id:
- MASVS-CODE-4
platform: ios
title: Memory Corruption Bugs
masvs_v1_levels:
- L1
- L2
profiles: [L1, L2]
status: deprecated
covered_by: []
deprecation_note: The associated weaknesses are best addressed during the development process. See @MASTG-KNOW-0060 for more details.
---

## Overview

## Static Analysis

Are there native code parts? If so: check for the given issues in the general memory corruption section. Native code is a little harder to spot when compiled. If you have the sources then you can see that C files use .c source files and .h header files and C++ uses .cpp files and .h files. This is a little different from the .swift and the .m source files for Swift and Objective-C. These files can be part of the sources, or part of third party libraries, registered as frameworks and imported through various tools, such as Carthage, the Swift Package Manager or Cocoapods.

For any managed code (Objective-C / Swift) in the project, check the following items:

- The doubleFree issue: when `free` is called twice for a given region instead of once.
- Retaining cycles: look for cyclic dependencies by means of strong references of components to one another which keep materials in memory.
- Using instances of `UnsafePointer` can be managed wrongly, which will allow for various memory corruption issues.
- Trying to manage the reference count to an object by `Unmanaged` manually, leading to wrong counter numbers and a too late/too soon release.

[A great talk is given on this subject at Realm academy](https://academy.realm.io/posts/russ-bishop-unsafe-swift/ "Russh Bishop on Unsafe Swift") and [a nice tutorial to see what is actually happening](https://www.raywenderlich.com/780-unsafe-swift-using-pointers-and-interacting-with-c "Unsafe Swift: Using Pointers And Interacting With C") is provided by Ray Wenderlich on this subject.

!!! note
    With Swift 5, you can only deallocate full blocks, which means the playground has changed a bit.

## Dynamic Analysis

There are various tools provided which help to identify memory bugs within Xcode, such as the Debug Memory graph introduced in Xcode 8 and the Allocations and Leaks instrument in Xcode.

Next, you can check whether memory is freed too fast or too slow by enabling `NSAutoreleaseFreedObjectCheckEnabled`, `NSZombieEnabled`, `NSDebugEnabled` in Xcode while testing the application.

See @MASTG-KNOW-0060 for more details on memory corruption bugs in iOS applications.
OWASP Mobile Application Security Testing Guide: MASTG TEST 0087

---
masvs_v1_id:
- MSTG-CODE-9
masvs_v2_id:
- MASVS-CODE-4
platform: ios
title: Make Sure That Free Security Features Are Activated
masvs_v1_levels:
- L1
- L2
profiles: [L1, L2]
status: deprecated
covered_by: [MASTG-TEST-0228, MASTG-TEST-0229, MASTG-TEST-0230]
deprecation_note: New version available in MASTG V2
---

## Overview

## Static Analysis

You can use radare2 to check the binary security features.

Let's use the [Damn Vulnerable iOS App DVIA v1](https://github.com/prateek147/DVIA/) as an example. Open its main binary with radare2:

```bash
r2 DamnVulnerableIOSApp
```

And run the following commands:

```bash
[0x1000180c8]> i~pic,canary
canary   true
pic      true
```

```bash
[0x1000180c8]> is~release,retain
124  0x002951e0 0x1000891e0 LOCAL  FUNC 0        imp.dispatch_release
149  0x00294e80 0x100088e80 LOCAL  FUNC 0        imp.objc_autorelease
150  0x00294e8c 0x100088e8c LOCAL  FUNC 0        imp.objc_autoreleasePoolPop
151  0x00294e98 0x100088e98 LOCAL  FUNC 0        imp.objc_autoreleasePoolPush
152  0x00294ea4 0x100088ea4 LOCAL  FUNC 0        imp.objc_autoreleaseReturnValue
165  0x00294f40 0x100088f40 LOCAL  FUNC 0        imp.objc_release
167  0x00294f58 0x100088f58 LOCAL  FUNC 0        imp.objc_retainAutorelease
168  0x00294f64 0x100088f64 LOCAL  FUNC 0        imp.objc_retainAutoreleaseReturnValue
169  0x00294f70 0x100088f70 LOCAL  FUNC 0        imp.objc_retainAutoreleasedReturnValue
```

All the features are enabled in these examples:

- PIE (Position Independent Executable): indicated by the flag `pic true`.
    - Applies to all apps independently of the language used.
    - Applies only to the main executable (`MH_EXECUTE`), not to dynamic libraries (`MH_DYLIB`).

- Stack Canary: indicated by the flag `canary true`.
    - Applies to apps containing Objective-C code.
    - Not necessarily required for pure Swift apps (Swift is memory safe by design).
    - Especially important for apps containing C/C++ code, as they provide direct access to memory and pointers, making them more vulnerable to buffer overflows.

- ARC (Automatic Reference Counting): indicated by symbols such as `objc_autorelease` or `objc_retainAutorelease`.
    - Important for binaries containing Objective-C code.
    - For binaries written purely in Swift, ARC is enabled by default.
    - ARC is not relevant for binaries written purely in C/C++, as it's a memory management feature specific to Objective-C and Swift.

## Dynamic Analysis

These checks can be performed dynamically using @MASTG-TOOL-0038. Here's one example:

```bash
com.yourcompany.PPClient on (iPhone: 13.2.3) [usb] # ios info binary
Name                  Type     Encrypted    PIE    ARC    Canary    Stack Exec    RootSafe
--------------------  -------  -----------  -----  -----  --------  ------------  ----------
PayPal                execute  True         True   True   True      False         False
CardinalMobile        dylib    False        False  True   True      False         False
FraudForce            dylib    False        False  True   True      False         False
...
```
OWASP Mobile Application Security Testing Guide: MASTG TEST 0080

---
masvs_v1_id:
- MSTG-ARCH-9
masvs_v2_id:
- MASVS-CODE-2
platform: ios
title: Testing Enforced Updating
masvs_v1_levels:
- L2
profiles: [L2]
---

## Overview

## Static Analysis

First see whether there is an update mechanism at all: if it is not yet present, it might mean that users cannot be forced to update.
If the mechanism is present, see whether it enforces "always latest" and whether that is indeed in line with the business strategy. Otherwise check if the mechanism is supporting to update to a given version.
Make sure that every entry of the application goes through the updating mechanism in order to make sure that the update-mechanism cannot be bypassed.

## Dynamic analysis

In order to test for proper updating: try downloading an older version of the application with a security vulnerability, either by a release from the developers or by using a third party app-store.
Next, verify whether or not you can continue to use the application without updating it. If an update prompt is given, verify if you can still use the application by canceling the prompt or otherwise circumventing it through normal application usage. This includes validating whether the backend will stop calls to vulnerable backends and/or whether the vulnerable app-version itself is blocked by the backend.
Lastly, try modifying the version number of an app while intercepting its traffic using a [Machine-in-the-Middle (MITM)](../../../Document/0x04f-Testing-Network-Communication.md#intercepting-network-traffic-through-mitm) proxy, and observe how the backend responds (including whether the change is recorded, for example).
OWASP Mobile Application Security Testing Guide: MASTG TEST 0079

---
masvs_v1_id:
- MSTG-PLATFORM-8
masvs_v2_id:
- MASVS-CODE-4
platform: ios
title: Testing Object Persistence
masvs_v1_levels:
- L1
- L2
profiles: [L1, L2]
---

## Overview

## Static Analysis

All different flavors of object persistence share the following concerns:

- If you use object persistence to store sensitive information on the device, then make sure that the data is encrypted: either at the database level, or specifically at the value level.
- Need to guarantee the integrity of the information? Use an HMAC mechanism or sign the information stored. Always verify the HMAC/signature before processing the actual information stored in the objects.
- Make sure that keys used in the two notions above are safely stored in the KeyChain and well protected. See the chapter "[Data Storage on iOS](../../../Document/0x06d-Testing-Data-Storage.md)" for more details.
- Ensure that the data within the deserialized object is carefully validated before it is actively used (e.g., no exploit of business/application logic is possible).
- Do not use persistence mechanisms that use [Runtime Reference](https://developer.apple.com/documentation/objectivec/objective-c_runtime "Objective-C Runtime Reference") to serialize/deserialize objects in high-risk applications, as the attacker might be able to manipulate the steps to execute business logic via this mechanism (see the chapter "[iOS Anti-Reversing Defenses](../../../Document/0x06j-Testing-Resiliency-Against-Reverse-Engineering.md)" for more details).
- Note that in Swift 2 and beyond, a [Mirror](https://developer.apple.com/documentation/swift/mirror "Mirror") can be used to read parts of an object, but cannot be used to write against the object.

## Dynamic Analysis

There are several ways to perform dynamic analysis:

- For the actual persistence: Use the techniques described in the "Data Storage on iOS" chapter.
- For the serialization itself: Use a debug build or use Frida / objection to see how the serialization methods are handled (e.g., whether the application crashes or extra information can be extracted by enriching the objects).
OWASP Mobile Application Security Testing Guide: index

---
hide: toc
title: Testing Tools
---

??? info "About the tools listed below"

    The OWASP MASTG includes many tools to assist you in executing test cases, allowing you to perform static analysis, dynamic analysis, network interception, etc. These tools are intended to help you perform your own assessments, rather than provide a conclusive result on the security status of an app. It's important to review the output of these tools carefully, as it can contain both false positives and false negatives.

    These tools have been tested to work when added, but compatibility may vary depending on your OS version, the device you're testing, or whether you're using a rooted or jailbroken device. Tool functionality may also be affected by specific versions of the rooting/jailbreaking method or the tool itself. OWASP MASTG does not guarantee the functionality of the tools. If you encounter problems, try to search for solutions online or contact the tool owner (e.g. via GitHub Issues).

    Before proposing a new tool via GitHub Issues/Pull Requests, please check our [contribution guidelines](../../contributing/index.md#tool-inclusion-disclaimer-for-contributors).
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0076

---
title: bettercap
platform: network
source: https://github.com/bettercap/bettercap
---

Bettercap is a powerful framework which aims to offer to security researchers and reverse engineers an easy to use, all-in-one solution for Wi-Fi, Bluetooth Low Energy, wireless HID hijacking and Ethernet networks reconnaissance. It can be used during network penetration tests in order to simulate a [Machine-in-the-Middle (MITM)](../../Document/0x04f-Testing-Network-Communication.md#intercepting-network-traffic-through-mitm) attack. This is achieved by executing [ARP poisoning or spoofing](https://en.wikipedia.org/wiki/ARP_spoofing "ARP poisoning/spoofing") to the target computers. When such an attack is successful, all packets between two computers are redirected to a third computer that acts as the MITM and is able to intercept the traffic for analysis.

> bettercap is a powerful tool to execute MITM attacks and should be preferred nowadays, instead of ettercap. See also [Why another MITM tool?](https://www.bettercap.org/legacy/#why-another-mitm-tool "Why another MITM tool?") on the bettercap site.

bettercap is available for all major Linux and Unix operating systems and should be part of their respective package installation mechanisms. You need to install it on your host computer that will act as the MITM. On macOS it can be installed by using brew.

```bash
brew install bettercap
```

For Kali Linux you can install bettercap with `apt-get`:

```bash
apt-get update
apt-get install bettercap
```
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0078

---
title: MITM Relay
platform: network
source: https://github.com/jrmdev/mitm_relay
---

MITM Relay is a script to intercept and modify non-HTTP protocols through Burp and others with support for SSL and STARTTLS interception.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0077

---
title: Burp Suite
platform: network
source: https://portswigger.net/burp/communitydownload
---

Burp Suite is an integrated platform for performing security testing mobile and web applications.

Its tools work together seamlessly to support the entire testing process, from initial mapping and analysis of attack surfaces to finding and exploiting security vulnerabilities. Burp Proxy operates as a web proxy server for Burp Suite, which is positioned as a [Machine-in-the-Middle (MITM)](../../Document/0x04f-Testing-Network-Communication.md#intercepting-network-traffic-through-mitm) between the browser and web servers. Burp Suite allows you to intercept, inspect, and modify incoming and outgoing raw HTTP traffic.

Setting up Burp to proxy your traffic is pretty straightforward. We assume that both your device and host computer are connected to a Wi-Fi network that permits client-to-client traffic.

PortSwigger provides good tutorials on setting up both Android as iOS devices to work with Burp:

- [Configuring an Android Device to Work With Burp](https://support.portswigger.net/customer/portal/articles/1841101-configuring-an-android-device-to-work-with-burp "Configuring an Android Device to Work With Burp").
- [Installing Burp's CA certificate to an Android device](https://support.portswigger.net/customer/portal/articles/1841102-installing-burp-s-ca-certificate-in-an-android-device "Installing Burp\'s CA Certificate in an Android Device").
- [Configuring an iOS Device to Work With Burp](https://support.portswigger.net/customer/portal/articles/1841108-configuring-an-ios-device-to-work-with-burp "Configuring an iOS Device to Work With Burp").
- [Installing Burp's CA certificate to an iOS device](https://support.portswigger.net/customer/portal/articles/1841109-installing-burp-s-ca-certificate-in-an-ios-device "Installing Burp\'s CA Certificate in an iOS Device").

Please refer to @MASTG-TECH-0011 (Android) and @MASTG-TECH-0063 (iOS) for more information.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0075

---
title: tcpdump (Android)
platform: network
source: https://www.androidtcpdump.com
---

tcpdump (Android) is an Android-specific build of @MASTG-TOOL-0080.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0080

---
title: tcpdump
platform: network
source: https://www.tcpdump.org
---

tcpdump is a command-line tool to capture and analyze network traffic in real time or from saved capture files.

An Android-specific build is available: @MASTG-TOOL-0075
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0079

---
title: ZAP (Zed Attack Proxy)
platform: network
source: https://github.com/zaproxy/zaproxy
---

ZAP (Zed Attack Proxy) is a free security tool which helps to automatically find security vulnerabilities in web applications and web services.
OWASP Mobile Application Security Testing Guide: MASTG TOOL 0115

---
title: HTTP Toolkit
platform: network
source: https://httptoolkit.com
---

HTTP Toolkit is an open-source tool designed to intercept, analyze, and debug HTTPS traffic. The tool captures HTTP traffic from Android, iOS, web or desktop applications.

It comes in a (limited) free version and paid version with additional features. HTTP Toolkit allows to setup its CA certificate and disabling SSL pinning via Frida and is also able to intercept HTTP requests from Flutter. In the free version it is not possible to set an up-stream proxy to re-direct the HTTP traffic to a penetration testing tool like BurpSuite.

Instead of HTTP Toolkit, you can rely on the tools mentioned in @MASTG-TECH-0109.