bmt 0.5.0 → 0.5.2

data/lib/data/0.1/methodologies/mobile_ios.json

@@ -0,0 +1,452 @@
+{
+  "metadata": {
+    "title": "iOS",
+    "release_date": "2022-01-10T00:00:00+00:00",
+    "description": "Bugcrowd iOS testing methodology",
+    "vrt_version": "10.0.1"
+  },
+  "content": {
+    "steps": [
+      {
+        "key": "architecture_design_and_threat_modelling",
+        "title": "Architecture, design and threat modelling",
+        "description": "",
+        "type": "checklist",
+        "items": [
+          {
+            "key": "all_app_components_are_identified_and_known_to_be_needed",
+            "title": "All app components are identified and known to be needed",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "security_controls_client_side",
+            "title": "Security controls are never enforced only on the client side, but on the respective remote endpoints.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "high_level_architecture_for_mobile_app",
+            "title": "A high-level architecture for the mobile app and all connected remote services has been defined and security has been addressed in that architecture.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "sensitive_identified_data",
+            "title": "Data considered sensitive in the context of the mobile app is clearly identified.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "business_and_security_functions",
+            "title": "All app components are defined in terms of the business functions and/or security functions they provide.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "threat_model_for_mobile_app",
+            "title": "A threat model for the mobile app and the associated remote services has been produced that identifies potential threats and countermeasures.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "security_controls",
+            "title": "All security controls have a centralized implementation.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "cryptographic_key_policy",
+            "title": "There is an explicit policy for how cryptographic keys (if any) are managed, and the lifecycle of cryptographic keys is enforced. Ideally, follow a key management standard such as NIST SP 800-57.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "enforce_mobile_app_updates",
+            "title": "A mechanism for enforcing updates of the mobile app exists.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "address_security",
+            "title": "Security is addressed within all parts of the software development lifecycle.",
+            "description": "",
+            "caption": ""
+          }
+        ]
+      },
+      {
+        "key": "data_storage_and_privacy",
+        "title": "Data Storage and Privacy",
+        "description": "",
+        "type": "checklist",
+        "items": [
+          {
+            "key": "system_creentials_storage_facilities",
+            "title": "System credential storage facilities are used appropriately to store sensitive data, such as PII, user credentials or cryptographic keys.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "sensitive_data_storage",
+            "title": "No sensitive data should be stored outside of the app container or system credential storage facilities.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "sensitive_data_in_logs",
+            "title": "No sensitive data is written to application logs.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "sensitive_data_sharing_with_third_party",
+            "title": "No sensitive data is shared with third parties unless it is a necessary part of the architecture.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "keyboard_cache_disabling",
+            "title": "The keyboard cache is disabled on text inputs that process sensitive data.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "sensitive_data_ipc_mechanism",
+            "title": "No sensitive data is exposed via IPC mechanisms.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "sensitive_data_exposure_via_ui",
+            "title": "No sensitive data, such as passwords or pins, is exposed through the user interface.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "sensitive_data_exposure_via_backup",
+            "title": "No sensitive data is included in backups generated by the mobile operating system.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "sensitive_data_removal_on_backgrounded",
+            "title": "The app removes sensitive data from views when backgrounded.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "sensitive_data_holding_in_memory",
+            "title": "The app does not hold sensitive data in memory longer than necessary, and memory is cleared explicitly after use.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "minimum_device_access_security_policy",
+            "title": "The app enforces a minimum device-access-security policy, such as requiring the user to set a device passcode.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "personal_identifiable_information_identification",
+            "title": "The app educates the user about the types of personally identifiable information processed, as well as security best practices the user should follow in using the app.",
+            "description": "",
+            "caption": ""
+          }
+        ]
+      },
+      {
+        "key": "cryptography",
+        "title": "Cryptography",
+        "description": "",
+        "type": "checklist",
+        "items": [
+          {
+            "key": "symmetric_cryptography_with_hardcoded_keys",
+            "title": "The app does not rely on symmetric cryptography with hardcoded keys as a sole method of encryption.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "proven_cryptographic_primitives",
+            "title": "The app uses proven implementations of cryptographic primitives.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "cryptographic_primitive_for_particular_use_case",
+            "title": "The app uses cryptographic primitives that are appropriate for the particular use-case, configured with parameters that adhere to industry best practices.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "depricated_cryptography_protocols",
+            "title": "The app does not use cryptographic protocols or algorithms that are widely considered depreciated for security purposes.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "reuse_same_cryptographic_key",
+            "title": "The app doesnt re-use the same cryptographic key for multiple purposes.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "secure_random_number_generator",
+            "title": "All random values are generated using a sufficiently secure random number generator.",
+            "description": "",
+            "caption": ""
+          }
+        ]
+      },
+      {
+        "key": "authentication_and_session_management",
+        "title": "Authentication and Session Management",
+        "description": "",
+        "type": "checklist",
+        "items": [
+          {
+            "key": "remote_service_authentication",
+            "title": "If the app provides users access to a remote service, some form of authentication, such as username/password authentication, is performed at the remote endpoint.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "stateful_session_management_authentication",
+            "title": "If stateful session management is used, the remote endpoint uses randomly generated session identifiers to authenticate client requests without sending the users credentials.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "stateless_token_based_management_authentication",
+            "title": "If stateless token-based authentication is used, the server provides a token that has been signed using a secure algorithm.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "remote_endpoint_terminate",
+            "title": "The remote endpoint terminates the existing session when the user logs out.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "password_policy_exists",
+            "title": "A password policy exists and is enforced at the remote endpoint.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "remote_endpoint_implementation_mechanism",
+            "title": "The remote endpoint implements a mechanism to protect against the submission of credentials an excessive number of times.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "session_invalidated_at_remote_endpoint",
+            "title": "Sessions are invalidated at the remote endpoint after a predefined period of inactivity and access tokens expire.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "biometric_authentication",
+            "title": "Biometric authentication, if any, is not event-bound (i.e. using an API that simply returns true or false). Instead, it is based on unlocking the keychain/keystore.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "second_factor_authentication",
+            "title": "A second factor of authentication exists at the remote endpoint and the 2FA requirement is consistently enforced.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "sensitive_transaction_setup_authentication",
+            "title": "Sensitive transactions require step-up authentication.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "inform_user_login_activities",
+            "title": "The app informs the user of all login activities with their account. Users are able view a list of devices used to access the account, and to block specific devices.",
+            "description": "",
+            "caption": ""
+          }
+        ]
+      },
+      {
+        "key": "network_communication",
+        "title": "Network Communication",
+        "description": "",
+        "type": "checklist",
+        "items": [
+          {
+            "key": "data_encryption_on_network",
+            "title": "Data is encrypted on the network using TLS. The secure channel is used consistently throughout the app.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "tls_settings_best_practices",
+            "title": "The TLS settings are in line with current best practices, or as close as possible if the mobile operating system does not support the recommended standards.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "remote_endpoint_certificate",
+            "title": "The app verifies the X.509 certificate of the remote endpoint when the secure channel is established. Only certificates signed by a trusted CA are accepted.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "app_certification",
+            "title": "The app either uses its own certificate store, or pins the endpoint certificate or public key, and subsequently does not establish connections with endpoints that offer a different certificate or key, even if signed by a trusted CA.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "insecure_communication_channel",
+            "title": "The app doesnt rely on a single insecure communication channel (email or SMS) for critical operations, such as enrollments and account recovery.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "app_dependency_on_connectivity_and_library",
+            "title": "The app only depends on up-to-date connectivity and security libraries.",
+            "description": "",
+            "caption": ""
+          }
+        ]
+      },
+      {
+        "key": "platform_interaction",
+        "title": "Platform Interaction",
+        "description": "",
+        "type": "checklist",
+        "items": [
+          {
+            "key": "minimum_set_of_permission",
+            "title": "The app only requests the minimum set of permissions necessary.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "external_source_input_validation",
+            "title": "All inputs from external sources and the user are validated and if necessary sanitized. This includes data received via the UI, IPC mechanisms such as intents, custom URLs, and network sources.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "sensitive_functionality_via_url_schemes",
+            "title": "The app does not export sensitive functionality via custom URL schemes, unless these mechanisms are properly protected.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "export_sensitive_functionality_through_ipc",
+            "title": "The app does not export sensitive functionality through IPC facilities, unless these mechanisms are properly protected.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "javascript_disabled",
+            "title": "JavaScript is disabled in WebViews unless explicitly required.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "webview_minimum_set_of_protocol_handlers",
+            "title": "WebViews are configured to allow only the minimum set of protocol handlers required (ideally, only https is supported). Potentially dangerous handlers, such as file, tel and app-id, are disabled.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "webview_within_app_javascript_render",
+            "title": "If native methods of the app are exposed to a WebView, verify that the WebView only renders JavaScript contained within the app package.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "object_deserialization",
+            "title": "Object deserialization, if any, is implemented using safe serialization APIs.",
+            "description": "",
+            "caption": ""
+          }
+        ]
+      },
+      {
+        "key": "code_quality_and_build_settings",
+        "title": "Code Quality and Build Settings",
+        "description": "",
+        "type": "checklist",
+        "items": [
+          {
+            "key": "valid_certificate_sign",
+            "title": "The app is signed and provisioned with a valid certificate, of which the private key is properly protected.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "built_in_release_mode",
+            "title": "The app has been built in release mode, with settings appropriate for a release build (e.g. non-debuggable).",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "debugging_symbol",
+            "title": "Debugging symbols have been removed from native binaries.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "debugging_and_verbose_errors",
+            "title": "Debugging code has been removed, and the app does not log verbose errors or debugging messages.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "third_party_vulnerability_check",
+            "title": "All third party components used by the mobile app, such as libraries and frameworks, are identified, and checked for known vulnerabilities.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "exception_handling",
+            "title": "The app catches and handles possible exceptions.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "security_controls_error_handling",
+            "title": "Error handling logic in security controls denies access by default",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "memory_allocation",
+            "title": "In unmanaged code, memory is allocated, freed and used securely.",
+            "description": "",
+            "caption": ""
+          },
+          {
+            "key": "free_security_features_offered_by_toolchain",
+            "title": "Free security features offered by the toolchain, such as byte-code minification, stack protection, PIE support and automatic reference counting, are activated.",
+            "description": "",
+            "caption": ""
+          }
+        ]
+      },
+      {
+        "key": "upload_logs",
+        "title": "Upload logs",
+        "description": "This should include all associated traffic associated to the in-scope targets.",
+        "type": "large_upload"
+      },
+      {
+        "key": "executive_summary",
+        "title": "Executive summary",
+        "description": "The executive summary should be written with a high-level view of both risk and business impact. It should be concise and clear, therefore it is important to use plain English. This ensures that non-technical readers can gain insight into security concerns outlined in your report.",
+        "type": "executive_summary"
+      }
+    ]
+  }
+}

data/lib/data/0.1/methodologies/network.json

@@ -0,0 +1,207 @@
+{
+  "metadata": {
+    "title": "Network",
+    "release_date": "2022-01-10T00:00:00+00:00",
+    "description": "Bugcrowd network testing methodology",
+    "vrt_version": "10.0.1"
+  },
+  "content": {
+    "steps": [
+      {
+        "key": "information",
+        "title": "Information Gathering / Recon",
+        "description": "",
+        "type": "checklist",
+        "caption": "Please include any valuable pieces of information found; and the source of said information",
+        "items": [
+          {
+            "key": "credentials_leaked",
+            "title": "Credentials or keys leaked on Github, Pastebin, etc.",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "leaked_as_part_of_past_breaches",
+            "title": "Usernames, emails, passwords, and other information leaked as part of past breaches.",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "internal_subdomain",
+            "title": "Internal subdomains, known software, etc.",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "zone_transfer_in_scope_ip",
+            "title": "Check for the ability to perform a zone transfer on the in-scope IP addresses",
+            "caption": "",
+            "description": ""
+          }
+        ]
+      },
+      {
+        "key": "scanning",
+        "title": "Scanning",
+        "description": "",
+        "type": "checklist",
+        "caption": "Please include your full nmap scan output + banner information in a single file. Similarly, include all other tooling outputs.",
+        "items": [
+          {
+            "key": "scan_in_scope_targets",
+            "title": "Fully scan the range of in-scope targets (all 65,535 TCP and UDP ports).",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "ensure_host_scan",
+            "title": "Ensure that hosts are still scanned, even if they are not responsive to a ping sweep.",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "in_scope_services_and_version_numbers",
+            "title": "Enumerate and document all in-scope services and version numbers.",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "document_services_that_communicate_insecurely",
+            "title": "Document services that communicate insecurely (e.g. telnet, http).",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "subdomain_takeovers",
+            "title": "Document any services with misconfigured DNS records allowing for subdomain takeovers.",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "leverage_available_services",
+            "title": "Review results and leverage any available services to obtain more information around the targets or users. Examples are RPC, SMB, SMTP, SNMP, etc.",
+            "caption": "",
+            "description": ""
+          }
+        ]
+      },
+      {
+        "key": "exploitation",
+        "title": "Exploitation",
+        "description": "",
+        "type": "checklist",
+        "caption": "Include any screenshots as proof of successful exploitation. For unsuccessful attacks, please document the commands/tools executed.",
+        "items": [
+          {
+            "key": "lack_of_auth",
+            "title": "Check for lack of auth or default creds to any available services. e.g. auth portals, anonymous FTP, SSH, RDP, mail relays, etc.",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "service_bypass",
+            "title": "Check for any auth bypasses on any available services.",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "cross_reference_software_version",
+            "title": "Cross reference software version numbers against known vulnerable versions or exploits (exploit db, CVEs, etc. often facilitated by the use of nessus/nikto/openvas/etc).",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "attempt_to_exploit_known_vulnerabilities",
+            "title": "Configure and attempt to exploit any known vulnerabilities (existing scripts with custom shellcode, metasploit modules, etc).",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "presence_of_sensitive_information_publicly",
+            "title": "Check for the presence of sensitive information that is publicly available on any service (e.g. documents available via anonymous FTP).",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "server_side_vulnerability_auth_bypass",
+            "title": "Test any available webservers for server-side vulnerabilities including Auth bypasses",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "server_side_vulnerability_default_credentials",
+            "title": "Test any available webservers for server-side vulnerabilities including Default credentials",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "server_side_vulnerability_known_exploits",
+            "title": "Test any available webservers for server-side vulnerabilities including Known exploits based on running vulnerable software",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "server_side_vulnerability_sql_injection",
+            "title": "Test any available webservers for server-side vulnerabilities including SQL Injection (SQLi)",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "server_side_rce",
+            "title": "Test any available webservers for server-side vulnerabilities including Remote Code Execution (RCE)",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "server_side_xxe",
+            "title": "Test any available webservers for server-side vulnerabilities including XML Entity Injection (XXE)",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "server_side_ssrf",
+            "title": "Test any available webservers for server-side vulnerabilities including Server Side Request Forgery (SSRF)",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "server_side_lfi_afi",
+            "title": "Test any available webservers for server-side vulnerabilities including Local/Arbitrary File Inclusion (LFI/AFI)",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "server_side_hidden_directory_pages",
+            "title": "Test any available webservers for server-side vulnerabilities including Hidden directories or pages with sensitive information",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "basic_web_app_scanner",
+            "title": "Run a basic web application scanner over the app, and report any valid issues. (nikto, burp, zap, et al)",
+            "caption": "",
+            "description": ""
+          },
+          {
+            "key": "attempt_bruteforcing",
+            "title": "Attempt moderate, informed/educated brute-forcing on available services - based on information gathered earlier in the assessment.",
+            "caption": "",
+            "description": ""
+          }
+        ]
+      },
+      {
+        "key": "upload_logs",
+        "title": "Upload logs",
+        "description": "This should include all associated traffic associated to the in-scope targets.",
+        "type": "large_upload"
+      },
+      {
+        "key": "executive_summary",
+        "title": "Executive summary",
+        "description": "The executive summary should be written with a high-level view of both risk and business impact. It should be concise and clear, therefore it is important to use plain English. This ensures that non-technical readers can gain insight into security concerns outlined in your report.",
+        "type": "executive_summary"
+      }
+    ]
+  }
+}