bmt 0.4.0 → 0.5.0

data/lib/data/0.1/methodologies/mobile_ios.json

@@ -1,452 +0,0 @@
-{
-  "metadata": {
-    "title": "iOS",
-    "release_date": "2022-01-10T00:00:00+00:00",
-    "description": "Bugcrowd iOS testing methodology",
-    "vrt_version": "10.0.1"
-  },
-  "content": {
-    "steps": [
-      {
-        "key": "architecture_design_and_threat_modelling",
-        "title": "Architecture, design and threat modelling",
-        "description": "",
-        "type": "checklist",
-        "items": [
-          {
-            "key": "all_app_components_are_identified_and_known_to_be_needed",
-            "title": "All app components are identified and known to be needed",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "security_controls_client_side",
-            "title": "Security controls are never enforced only on the client side, but on the respective remote endpoints.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "high_level_architecture_for_mobile_app",
-            "title": "A high-level architecture for the mobile app and all connected remote services has been defined and security has been addressed in that architecture.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "sensitive_identified_data",
-            "title": "Data considered sensitive in the context of the mobile app is clearly identified.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "business_and_security_functions",
-            "title": "All app components are defined in terms of the business functions and/or security functions they provide.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "threat_model_for_mobile_app",
-            "title": "A threat model for the mobile app and the associated remote services has been produced that identifies potential threats and countermeasures.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "security_controls",
-            "title": "All security controls have a centralized implementation.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "cryptographic_key_policy",
-            "title": "There is an explicit policy for how cryptographic keys (if any) are managed, and the lifecycle of cryptographic keys is enforced. Ideally, follow a key management standard such as NIST SP 800-57.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "enforce_mobile_app_updates",
-            "title": "A mechanism for enforcing updates of the mobile app exists.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "address_security",
-            "title": "Security is addressed within all parts of the software development lifecycle.",
-            "description": "",
-            "caption": ""
-          }
-        ]
-      },
-      {
-        "key": "data_storage_and_privacy",
-        "title": "Data Storage and Privacy",
-        "description": "",
-        "type": "checklist",
-        "items": [
-          {
-            "key": "system_creentials_storage_facilities",
-            "title": "System credential storage facilities are used appropriately to store sensitive data, such as PII, user credentials or cryptographic keys.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "sensitive_data_storage",
-            "title": "No sensitive data should be stored outside of the app container or system credential storage facilities.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "sensitive_data_in_logs",
-            "title": "No sensitive data is written to application logs.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "sensitive_data_sharing_with_third_party",
-            "title": "No sensitive data is shared with third parties unless it is a necessary part of the architecture.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "keyboard_cache_disabling",
-            "title": "The keyboard cache is disabled on text inputs that process sensitive data.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "sensitive_data_ipc_mechanism",
-            "title": "No sensitive data is exposed via IPC mechanisms.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "sensitive_data_exposure_via_ui",
-            "title": "No sensitive data, such as passwords or pins, is exposed through the user interface.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "sensitive_data_exposure_via_backup",
-            "title": "No sensitive data is included in backups generated by the mobile operating system.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "sensitive_data_removal_on_backgrounded",
-            "title": "The app removes sensitive data from views when backgrounded.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "sensitive_data_holding_in_memory",
-            "title": "The app does not hold sensitive data in memory longer than necessary, and memory is cleared explicitly after use.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "minimum_device_access_security_policy",
-            "title": "The app enforces a minimum device-access-security policy, such as requiring the user to set a device passcode.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "personal_identifiable_information_identification",
-            "title": "The app educates the user about the types of personally identifiable information processed, as well as security best practices the user should follow in using the app.",
-            "description": "",
-            "caption": ""
-          }
-        ]
-      },
-      {
-        "key": "cryptography",
-        "title": "Cryptography",
-        "description": "",
-        "type": "checklist",
-        "items": [
-          {
-            "key": "symmetric_cryptography_with_hardcoded_keys",
-            "title": "The app does not rely on symmetric cryptography with hardcoded keys as a sole method of encryption.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "proven_cryptographic_primitives",
-            "title": "The app uses proven implementations of cryptographic primitives.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "cryptographic_primitive_for_particular_use_case",
-            "title": "The app uses cryptographic primitives that are appropriate for the particular use-case, configured with parameters that adhere to industry best practices.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "depricated_cryptography_protocols",
-            "title": "The app does not use cryptographic protocols or algorithms that are widely considered depreciated for security purposes.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "reuse_same_cryptographic_key",
-            "title": "The app doesnt re-use the same cryptographic key for multiple purposes.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "secure_random_number_generator",
-            "title": "All random values are generated using a sufficiently secure random number generator.",
-            "description": "",
-            "caption": ""
-          }
-        ]
-      },
-      {
-        "key": "authentication_and_session_management",
-        "title": "Authentication and Session Management",
-        "description": "",
-        "type": "checklist",
-        "items": [
-          {
-            "key": "remote_service_authentication",
-            "title": "If the app provides users access to a remote service, some form of authentication, such as username/password authentication, is performed at the remote endpoint.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "stateful_session_management_authentication",
-            "title": "If stateful session management is used, the remote endpoint uses randomly generated session identifiers to authenticate client requests without sending the users credentials.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "stateless_token_based_management_authentication",
-            "title": "If stateless token-based authentication is used, the server provides a token that has been signed using a secure algorithm.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "remote_endpoint_terminate",
-            "title": "The remote endpoint terminates the existing session when the user logs out.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "password_policy_exists",
-            "title": "A password policy exists and is enforced at the remote endpoint.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "remote_endpoint_implementation_mechanism",
-            "title": "The remote endpoint implements a mechanism to protect against the submission of credentials an excessive number of times.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "session_invalidated_at_remote_endpoint",
-            "title": "Sessions are invalidated at the remote endpoint after a predefined period of inactivity and access tokens expire.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "biometric_authentication",
-            "title": "Biometric authentication, if any, is not event-bound (i.e. using an API that simply returns true or false). Instead, it is based on unlocking the keychain/keystore.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "second_factor_authentication",
-            "title": "A second factor of authentication exists at the remote endpoint and the 2FA requirement is consistently enforced.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "sensitive_transaction_setup_authentication",
-            "title": "Sensitive transactions require step-up authentication.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "inform_user_login_activities",
-            "title": "The app informs the user of all login activities with their account. Users are able view a list of devices used to access the account, and to block specific devices.",
-            "description": "",
-            "caption": ""
-          }
-        ]
-      },
-      {
-        "key": "network_communication",
-        "title": "Network Communication",
-        "description": "",
-        "type": "checklist",
-        "items": [
-          {
-            "key": "data_encryption_on_network",
-            "title": "Data is encrypted on the network using TLS. The secure channel is used consistently throughout the app.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "tls_settings_best_practices",
-            "title": "The TLS settings are in line with current best practices, or as close as possible if the mobile operating system does not support the recommended standards.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "remote_endpoint_certificate",
-            "title": "The app verifies the X.509 certificate of the remote endpoint when the secure channel is established. Only certificates signed by a trusted CA are accepted.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "app_certification",
-            "title": "The app either uses its own certificate store, or pins the endpoint certificate or public key, and subsequently does not establish connections with endpoints that offer a different certificate or key, even if signed by a trusted CA.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "insecure_communication_channel",
-            "title": "The app doesnt rely on a single insecure communication channel (email or SMS) for critical operations, such as enrollments and account recovery.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "app_dependency_on_connectivity_and_library",
-            "title": "The app only depends on up-to-date connectivity and security libraries.",
-            "description": "",
-            "caption": ""
-          }
-        ]
-      },
-      {
-        "key": "platform_interaction",
-        "title": "Platform Interaction",
-        "description": "",
-        "type": "checklist",
-        "items": [
-          {
-            "key": "minimum_set_of_permission",
-            "title": "The app only requests the minimum set of permissions necessary.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "external_source_input_validation",
-            "title": "The app only requests the minimum set of permissions necessary.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "sensitive_functionality_via_url_schemes",
-            "title": "The app does not export sensitive functionality via custom URL schemes, unless these mechanisms are properly protected.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "export_sensitive_functionality_through_ipc",
-            "title": "The app does not export sensitive functionality through IPC facilities, unless these mechanisms are properly protected.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "javascript_disabled",
-            "title": "JavaScript is disabled in WebViews unless explicitly required.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "webview_minimum_set_of_protocol_handlers",
-            "title": "WebViews are configured to allow only the minimum set of protocol handlers required (ideally, only https is supported). Potentially dangerous handlers, such as file, tel and app-id, are disabled.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "webview_within_app_javascript_render",
-            "title": "If native methods of the app are exposed to a WebView, verify that the WebView only renders JavaScript contained within the app package.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "object_deserialization",
-            "title": "Object deserialization, if any, is implemented using safe serialization APIs.",
-            "description": "",
-            "caption": ""
-          }
-        ]
-      },
-      {
-        "key": "code_quality_and_build_settings",
-        "title": "Code Quality and Build Settings",
-        "description": "",
-        "type": "checklist",
-        "items": [
-          {
-            "key": "valid_certificate_sign",
-            "title": "The app is signed and provisioned with a valid certificate, of which the private key is properly protected.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "built_in_release_mode",
-            "title": "The app has been built in release mode, with settings appropriate for a release build (e.g. non-debuggable).",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "debugging_symbol",
-            "title": "Debugging symbols have been removed from native binaries.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "debugging_and_verbose_errors",
-            "title": "Debugging code has been removed, and the app does not log verbose errors or debugging messages.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "third_party_vulnerability_check",
-            "title": "All third party components used by the mobile app, such as libraries and frameworks, are identified, and checked for known vulnerabilities.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "exception_handling",
-            "title": "The app catches and handles possible exceptions.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "security_controls_error_handling",
-            "title": "Error handling logic in security controls denies access by default",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "memory_allocation",
-            "title": "In unmanaged code, memory is allocated, freed and used securely.",
-            "description": "",
-            "caption": ""
-          },
-          {
-            "key": "free_security_features_offered_by_toolchain",
-            "title": "Free security features offered by the toolchain, such as byte-code minification, stack protection, PIE support and automatic reference counting, are activated.",
-            "description": "",
-            "caption": ""
-          }
-        ]
-      },
-      {
-        "key": "upload_logs",
-        "title": "Upload logs",
-        "description": "This should include all associated traffic associated to the in-scope targets.",
-        "type": "large_upload"
-      },
-      {
-        "key": "executive_summary",
-        "title": "Executive summary",
-        "description": "The executive summary should be written with a high-level view of both risk and business impact. It should be concise and clear, therefore it is important to use plain English. This ensures that non-technical readers can gain insight into security concerns outlined in your report.",
-        "type": "executive_summary"
-      }
-    ]
-  }
-}

data/lib/data/0.1/methodologies/network.json

@@ -1,207 +0,0 @@
-{
-  "metadata": {
-    "title": "Network",
-    "release_date": "2022-01-10T00:00:00+00:00",
-    "description": "Bugcrowd network testing methodology",
-    "vrt_version": "10.0.1"
-  },
-  "content": {
-    "steps": [
-      {
-        "key": "information",
-        "title": "Information Gathering / Recon",
-        "description": "",
-        "type": "checklist",
-        "caption": "Please include any valuable pieces of information found; and the source of said information",
-        "items": [
-          {
-            "key": "credentials_leaked",
-            "title": "Credentials or keys leaked on Github, Pastebin, etc.",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "leaked_as_part_of_past_breaches",
-            "title": "Usernames, emails, passwords, and other information leaked as part of past breaches.",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "internal_subdomain",
-            "title": "Internal subdomains, known software, etc.",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "zone_transfer_in_scope_ip",
-            "title": "Check for the ability to perform a zone transfer on the in-scope IP addresses",
-            "caption": "",
-            "description": ""
-          }
-        ]
-      },
-      {
-        "key": "scanning",
-        "title": "Scanning",
-        "description": "",
-        "type": "checklist",
-        "caption": "Please include your full nmap scan output + banner information in a single file. Similarly, include all other tooling outputs.",
-        "items": [
-          {
-            "key": "scan_in_scope_targets",
-            "title": "Fully scan the range of in-scope targets (all 65,535 TCP and UDP ports).",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "ensure_host_scan",
-            "title": "Ensure that hosts are still scanned, even if they are not responsive to a ping sweep.",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "in_scope_services_and_version_numbers",
-            "title": "Enumerate and document all in-scope services and version numbers.",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "document_services_that_communicate_insecurely",
-            "title": "Document services that communicate insecurely (e.g. telnet, http).",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "subdomain_takeovers",
-            "title": "Document any services with misconfigured DNS records allowing for subdomain takeovers.",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "leverage_available_services",
-            "title": "Review results and leverage any available services to obtain more information around the targets or users. Examples are RPC, SMB, SMTP, SNMP, etc.",
-            "caption": "",
-            "description": ""
-          }
-        ]
-      },
-      {
-        "key": "exploitation",
-        "title": "Exploitation",
-        "description": "",
-        "type": "checklist",
-        "caption": "Include any screenshots as proof of successful exploitation. For unsuccessful attacks, please document the commands/tools executed.",
-        "items": [
-          {
-            "key": "lack_of_auth",
-            "title": "Check for lack of auth or default creds to any available services. e.g. auth portals, anonymous FTP, SSH, RDP, mail relays, etc.",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "service_bypass",
-            "title": "Check for any auth bypasses on any available services.",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "cross_reference_software_version",
-            "title": "Cross reference software version numbers against known vulnerable versions or exploits (exploit db, CVEs, etc. often facilitated by the use of nessus/nikto/openvas/etc).",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "attempt_to_exploit_known_vulnerabilities",
-            "title": "Configure and attempt to exploit any known vulnerabilities (existing scripts with custom shellcode, metasploit modules, etc).",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "presence_of_sensitive_information_publicly",
-            "title": "Check for the presence of sensitive information that is publicly available on any service (e.g. documents available via anonymous FTP).",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "server_side_vulnerability_auth_bypass",
-            "title": "Test any available webservers for server-side vulnerabilities including Auth bypasses",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "server_side_vulnerability_default_credentials",
-            "title": "Test any available webservers for server-side vulnerabilities including Default credentials",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "server_side_vulnerability_known_exploits",
-            "title": "Test any available webservers for server-side vulnerabilities including Known exploits based on running vulnerable software",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "server_side_vulnerability_sql_injection",
-            "title": "Test any available webservers for server-side vulnerabilities including SQL Injection (SQLi)",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "server_side_rce",
-            "title": "Test any available webservers for server-side vulnerabilities including Remote Code Execution (RCE)",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "server_side_xxe",
-            "title": "Test any available webservers for server-side vulnerabilities including XML Entity Injection (XXE)",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "server_side_ssrf",
-            "title": "Test any available webservers for server-side vulnerabilities including Server Side Request Forgery (SSRF)",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "server_side_lfi_afi",
-            "title": "Test any available webservers for server-side vulnerabilities including Local/Arbitrary File Inclusion (LFI/AFI)",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "server_side_hidden_directory_pages",
-            "title": "Test any available webservers for server-side vulnerabilities including Hidden directories or pages with sensitive information",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "basic_web_app_scanner",
-            "title": "Run a basic web application scanner over the app, and report any valid issues. (nikto, burp, zap, et al)",
-            "caption": "",
-            "description": ""
-          },
-          {
-            "key": "attempt_bruteforcing",
-            "title": "Attempt moderate, informed/educated brute-forcing on available services - based on information gathered earlier in the assessment.",
-            "caption": "",
-            "description": ""
-          }
-        ]
-      },
-      {
-        "key": "upload_logs",
-        "title": "Upload logs",
-        "description": "This should include all associated traffic associated to the in-scope targets.",
-        "type": "large_upload"
-      },
-      {
-        "key": "executive_summary",
-        "title": "Executive summary",
-        "description": "The executive summary should be written with a high-level view of both risk and business impact. It should be concise and clear, therefore it is important to use plain English. This ensures that non-technical readers can gain insight into security concerns outlined in your report.",
-        "type": "executive_summary"
-      }
-    ]
-  }
-}