bmt 0.7.1 → 0.9.0

data/lib/data/0.9/methodologies/binaries.json

@@ -0,0 +1,252 @@
+{
+  "metadata": {
+    "title": "Binary",
+    "release_date": "2022-01-10T00:00:00+00:00",
+    "description": "Bugcrowd Binary testing methodology",
+    "vrt_version": "10.0.1"
+  },
+  "content": {
+    "steps": [
+      {
+        "key": "insufficient_authentication_authorization",
+        "title": "Insufficient Authentication/Authorization",
+        "description": "",
+        "type": "checklist",
+        "items": [
+          {
+            "description": "",
+            "key": "multi_user_environment",
+            "caption": "",
+            "title": "Assess the application for multi-user environments and ensure it includes functionality for role separation."
+          },
+          {
+            "description": "",
+            "key": "password_recovery_mechanism",
+            "caption": "",
+            "title": "Assess password recovery mechanisms and ensure session management is properly maintained/terminated at the remote endpoint."
+          }
+        ]
+      },
+      {
+        "key": "insecure_network_services",
+        "title": "Insecure Network Services",
+        "description": "",
+        "type": "checklist",
+        "items": [
+          {
+            "description": "",
+            "key": "ensure_network_services",
+            "caption": "",
+            "title": "Assess the application to ensure network services for potentially interesting crashes or denial-of-service conditions that might indicate the presence of a memory corruption issue."
+          },
+          {
+            "description": "",
+            "key": "ensure_debugging_services",
+            "caption": "",
+            "title": "Assess the application to ensure debugging services are not present (and if present, test those services for access controls/default credentials)."
+          }
+        ]
+      },
+      {
+        "key": "lack_of_transport_encryption",
+        "title": "Lack of Transport Encryption",
+        "description": "",
+        "type": "checklist",
+        "items": [
+          {
+            "description": "",
+            "key": "assess_encrypted_communication",
+            "caption": "",
+            "title": "Assess the application to determine the use of modern encrypted communication between endpoints."
+          },
+          {
+            "description": "",
+            "key": "assess_encrypted_practice",
+            "caption": "",
+            "title": "Assess the application to determine if accepted encryption practices are used."
+          }
+        ]
+      },
+      {
+        "key": "privacy_concerns",
+        "title": "Privacy Concerns",
+        "description": "",
+        "type": "checklist",
+        "items": [
+          {
+            "description": "",
+            "key": "assess_personal_information_collected",
+            "caption": "",
+            "title": "Assess the application to determine the amount of personal information collected."
+          },
+          {
+            "description": "",
+            "key": "assess_personal_data_encryption",
+            "caption": "",
+            "title": "Assess the application to determine if collected personal data is properly protected using encryption at rest and in transit."
+          },
+          {
+            "description": "",
+            "key": "assess_data_de_identified_or_anonymized",
+            "caption": "",
+            "title": "Assess the application to determine if data is de-identified or anonymized."
+          },
+          {
+            "description": "",
+            "key": "no_sesitive_data",
+            "caption": "",
+            "title": "No sensitive data, such as passwords or pins, are exposed through the user interface."
+          },
+          {
+            "description": "",
+            "key": "no_sensitive_log_info",
+            "caption": "",
+            "title": "No sensitive information is contained in logs generated by the application."
+          },
+          {
+            "description": "",
+            "key": "assess_personal_info_sending_to_remote_location",
+            "caption": "",
+            "title": "Assess whether the application sends personal/identifying information to a remote location even though it is only required for local use."
+          }
+        ]
+      },
+      {
+        "key": "insecure_cloud_interface",
+        "title": "Insecure Cloud Interface (where applicable)",
+        "description": "",
+        "type": "checklist",
+        "items": [
+          {
+            "description": "",
+            "key": "assess_cloud_for_security_vulnerability",
+            "caption": "",
+            "title": "Assess the cloud interfaces for security vulnerabilities (e.g.testing  both API interfaces and cloud-based web interfaces for common (and uncommon) web application issues)."
+          },
+          {
+            "description": "",
+            "key": "assess_secure_transport_in_cloud",
+            "caption": "",
+            "title": "Assess all cloud interfaces to ensure secure transport encryption is used."
+          }
+        ]
+      },
+      {
+        "key": "insecure_software_firmware",
+        "title": "Insecure Software/Firmware",
+        "description": "",
+        "type": "checklist",
+        "items": [
+          {
+            "description": "",
+            "key": "assess_application_update_capability",
+            "caption": "",
+            "title": "Assess the application to ensure it includes update capability and can be updated quickly when vulnerabilities are discovered."
+          },
+          {
+            "description": "",
+            "key": "assess_encrypted_file_transfer",
+            "caption": "",
+            "title": "Assess the application to ensure it uses encrypted update files and that the files are transmitted using encryption."
+          },
+          {
+            "description": "",
+            "key": "assess_signed_files",
+            "caption": "",
+            "title": "Assess the application to ensure it uses signed files and then validates those files before installation."
+          },
+          {
+            "description": "",
+            "key": "assess_insecure_function_calls",
+            "caption": "",
+            "title": "Assess the application for insecure/dangerous function calls."
+          },
+          {
+            "description": "",
+            "key": "assess_user_input_sanitization",
+            "caption": "",
+            "title": "Assess the application to ensure ensure all user-controllable input data is sanitized prior to use."
+          },
+          {
+            "description": "",
+            "key": "ensure_all_third_party_components",
+            "caption": "",
+            "title": "Ensure all third party components used by the application, such as libraries and frameworks, are identified, and checked for known vulnerabilities."
+          },
+          {
+            "description": "",
+            "key": "assess_hardcoded_sensitive_info",
+            "caption": "",
+            "title": "Assess the application for signs of hardcoded sensitive information - e.g. credentials, URLs, API keys, etc."
+          },
+          {
+            "description": "",
+            "key": "assess_secure_random_number_generator",
+            "caption": "",
+            "title": "Assess the application to ensure all random values are generated using a sufficiently secure random number generator."
+          },
+          {
+            "description": "",
+            "key": "assess_input_via_dynamic_testing",
+            "caption": "",
+            "title": "Assess inputs on the application via dynamic testing (e.g. fuzzing) to identify potentially interesting crashes or denial-of-service conditions that might suggest the presence of a memory corruption or command injection issue."
+          },
+          {
+            "description": "",
+            "key": "assess_misconfigured_permission",
+            "caption": "",
+            "title": "Assess the application for misconfigured permissions, allowing for the escalation of privileges (e.g. DLL spoofing/hijacking, etc)."
+          },
+          {
+            "description": "",
+            "key": "assess_minimal_permissions",
+            "caption": "",
+            "title": "Assess the application to ensure it only uses the minimum set of permissions necessary."
+          },
+          {
+            "description": "",
+            "key": "assess_object_deserialization",
+            "caption": "",
+            "title": "Assess the application for unsafe object deserialization behavior that might lead to command injection."
+          },
+          {
+            "description": "",
+            "key": "assess_compiler_os_exploit_mitigation",
+            "caption": "",
+            "title": "Assess the application to ensure Basic OS/compiler exploit mitigation features, such stack protection/exploit mitigation (DEP, ASLR, stack canaries, etc) are activated."
+          },
+          {
+            "description": "",
+            "key": "assess_authentication_bypass",
+            "caption": "",
+            "title": "Assess the application for authentication bypasses and backdoors, allowing for access to functions/features outside of intended-use flows."
+          },
+          {
+            "description": "",
+            "key": "assess_application_for_internal_use",
+            "caption": "",
+            "title": "Assess the application for ability to access/use components meant for internal or administrative use (e.g. leftover debugging functionality not intended to exist in production)."
+          },
+          {
+            "description": "",
+            "key": "assess_for_undocumented_api_endpoints",
+            "caption": "",
+            "title": "Assess the application for undocumented API endpoints, and assess those for common vulnerabilities, as well as authentication bypasses."
+          }
+        ]
+      },
+      {
+        "key": "upload_logs",
+        "title": "Upload logs",
+        "description": "This should include all associated traffic associated to the in-scope targets.",
+        "type": "large_upload"
+      },
+      {
+        "key": "executive_summary",
+        "title": "Executive summary",
+        "description": "The executive summary should be written with a high-level view of both risk and business impact. It should be concise and clear, therefore it is important to use plain English. This ensures that non-technical readers can gain insight into security concerns outlined in your report.",
+        "type": "executive_summary"
+      }
+    ]
+  }
+}

data/lib/data/0.9/methodologies/hardware_testing.json

@@ -0,0 +1,216 @@
+{
+  "metadata": {
+    "title": "Hardware",
+    "release_date": "2025-08-29T00:00:00+00:00",
+    "description": "Bugcrowd Hardware Testing Methodology",
+    "vrt_version": "1.17"
+  },
+  "content": {
+    "steps": [
+       {
+        "key": "passive_recon",
+        "title": "Passive Recon",
+        "description": "Information gathering before turning off or opening the device",
+        "type": "checklist",
+        "items": [
+          { 
+            "key": "open_source_intelligence",
+            "title": "Open Source Intelligence",
+            "caption": "",
+            "description": "Gathering information using search engines to find publicly available information about the device",
+            "tools": "Google Dorking components/device, FCC Database (fccid.io or fcc.io), Patents (patents.google.com, worldwide.espacenet.com/patent, appft.uspto.gov), Chinese OSINT (baidu.com, qichacha.com, right.com.cn, codechina.csdn.net, pudn.com, search.gitee.com), Finding datasheets for components",
+            "vrt_category": "sensitive_data_exposure"
+          },
+          {
+            "key": "network_scanning",
+            "title": "Network Scanning",
+            "caption": "",
+            "description": "Scan the network for devices to find the one being tested, identify wireless protocols in use",
+            "tools": "NMAP, Wireshark, tcpdump"
+          },
+          {
+            "key": "rf_scanning",
+            "title": "Radio Frequency Scanning",
+            "caption": "",
+            "description": "Identify any radio communications, frequencies, modulation the device might be using, identify wireless protocols in use",
+            "tools": "HackRF, LimeSDR, BladeRF, Universal Radio Hacker (URH), other various rf sniffers",
+            "type": "checklist",
+            "items": [
+                {
+                  "key": "bluetooth_ble",
+                  "title": "Bluetooth and BLE",
+                  "caption": "",
+                  "description": "Try to sniff the communication, check if it's encrypted, can it be decrypted, are replay attacks possible, check if sensitive information being transmitted in plaintext",
+                  "tools": "Flipper, Ubertooth, Nordic nRF, Wireshark (might need to install an additional plugin and/or connect external hardware), btmon (linux), Bluetooth Virtual Sniffer (Windows)"
+                },
+                {
+                  "key": "zigbee_lora",
+                  "title": "ZigBee and LoRa",
+                  "caption": "",
+                  "description": "For ZigBee and LoRa devices, try to sniff the communication, capture the encryption key exchange (during active recon see if it's hardcoded on the device), check if the communication can be decrypted, and determine if replay attacks are possible. For LoRa, also check for LoRaWAN-specific vulnerabilities, such as weak join procedures, unencrypted payloads, and improper key management.",
+                  "tools": "Nordic nRF, Wireshark (might need to install an additional plugin and/or connect external hardware), ZT-CHK, TI SmartRF Protocol Packet Sniffer (SPPS) software, Semtech LoRaWAN sniffer, TTN Packet Forwarder, SDR tools supporting LoRa (HackRF, LimeSDR, BladeRF), Universal Radio Hacker (URH)"
+                },
+                {
+                  "key": "near_field_communication",
+                  "title": "NFC Testing",
+                  "caption": "",
+                  "description": "For card readers like access control locks and credit cards, can also be used in mobile testing. Try to read the information on the card, is it encrypted, can it be decrypted, can you forge a request, does the reader allow you to write to it so it will accept forged messages",
+                  "tools": "Flipper (base model is limited, additional hardware can be installed), Proxmark"
+                }
+              ] 
+          }
+        ]
+        },
+        {
+          "key": "active_recon",
+          "title": "Active Recon - Opening up the Device Under Test",
+          "description": "Open up the device to identify the various components and find data sheets online for the various components, map out PCB, find open ports (UART, JTAG). Use tools like screwdrivers, anti-tamper bits, prying tools, soldering iron, desoldering workstation, multimeter, XRAY, probes, oscilloscope, magnifying glass, and logic analyzer.",
+          "type": "checklist",
+          "items": [
+            {
+              "key": "visual_component_identification",
+              "title": "Visual Component Identification",
+              "caption": "",
+              "description": "Using a magnifying glass identify the various components on the PCB in the device, determine what they do and how they connect together, look up datasheets for important components online and read through them",
+              "tools": "magnifying glass, Search Engines"
+            },
+            {
+              "key": "measure_voltage_resistance_continuity",
+              "title": "Measuring Voltage, Resistance, and Continuity",
+              "caption": "",
+              "description": "Using a multimeter identify GND, Vcc, N/C, Pull-Up resistors to help map out the board, verify the different pins identified in the datasheets, and enumerate debug ports",
+              "tools": "multimeter"
+            },
+            {
+              "key": "id_debug_ports",
+              "title": "ID Debug Ports",
+              "caption": "",
+              "description": "Determine which debug protocols are being used, UART, JTAG, SPI, I2C, SWD, and/or NAND/MMC and find out which pins can be used to access those ports. In some cases you may need to desolder the ports and solder header pins to them to access them",
+              "tools": "multimeter, logic analyzer, oscilloscope, soldering iron"
+            }
+          ]
+        },
+        {
+          "key": "firmware",
+          "title": "Accessing and Analysing Firmware",
+          "description": "Using info gathered during active and passive recon access and reverse engineer the firmware for the device.",
+          "type": "checklist",
+          "items": [
+            {
+              "key": "dump_download_firmware",
+              "title": "Dump or Download Firmware for Analysis",
+              "caption": "",
+              "description": "Using the identified debug ports try to dump the firmware from the device for reverse engineering. Desoldering the SPI flash and using a tool to dump the firmware from it directly. Try downloading the firmware from the vendor site, however it might be encrypted.",
+              "tools": "desoldering station, JTAGulator, Minicom, PuTTy, Bus Pirate, Raspberry Pi Pico"
+            },
+            {
+              "key":"firmware_analysis",
+              "title":"Firmware Analysis",
+              "caption": "",
+              "description":"Reverse engineering the dumped firmware. Identify encryption if used and try to decrypt it. Use emulation software to help analyze it. Analyze and search the firmware for hardcoded passwords/keys and other sensitive information.",
+              "tools":"binwalk, QEMU, Ghidra, grep, strings, hexdump, readelf"
+            }
+          ]
+        },
+        {
+          "key":"testing_device",
+          "title":"Testing the Device",
+          "description":"Using all of the information gathered start testing the device for security vulnerabilities.",
+          "type":"checklist",
+          "items": [
+            { 
+              "key":"replay_attacks",
+              "title":"Replay Attacks",
+              "caption": "",
+              "description":"Using the sniffed traffic, determine if replay attacks are possible. Check if the device accepts modified requests and if you can make changes to the configuration. Verify if the device uses unencrypted communication.",
+              "tools":"Wireshark, HackRF, python"
+            },
+            { 
+              "key":"shared_resources",
+              "title":"Improper Isolation of Shared Resources",
+              "caption": "",
+              "description":"A SOC may use pin multiplexing allowing an untrusted agent to access assets/info intended to trusted agents only",
+              "CWE": ["CWE-1189"]
+            },
+            { 
+              "key":"bac_on_chip_debugger",
+              "title":"Broken Access Control for On-Chip Debugger",
+              "caption": "",
+              "description":"Unauthenticated access to the on chip debugger through the JTAG, allowing root access or access to sensitive information. Or not implementing proper access control during different boot stages.",
+              "CWE": ["CWE-1191", "CWE-1244"],
+              "tools":"JTAGulator, SOIC-8 clip"
+            },
+            { 
+              "key":"improper_lock_bit_protection",
+              "title":"Improper Lock Bit Protection",
+              "caption": "",
+              "description":"Assess the integrated circuit trusted lock bit to see if it's missing or can be modified by software later giving access to protected registers, address regions, systems and features that should be protected.",
+              "CWE": ["CWE-1231", "CWE-1233"]
+            },
+            { 
+              "key":"cryptographic_implementation",
+              "title":"Cryptographic Implementation",
+              "caption": "",
+              "description":"Assess if the cryptographic algorithm in use is non-standard or a disallowed/non-compliant version.",
+              "CWE": ["CWE-1240"]
+            },
+            {
+              "key": "fault_injection_and_side_channel_attacks",
+              "title": "Fault Injection and Side Channel Attacks",
+              "caption": "",
+              "description": "Test for fault injection and side channel attacks that can bypass security measures to dump firmware, access sensitive information, perform code execution, skip authentication, or escalate privileges.",
+              "CWE": ["CWE-1256", "CWE-1300"],    
+              "tools": "chipwhisperer, oscilloscope, pcb workstation with nano probes"
+            },
+            {
+             "key":"memory_overlap",
+             "title":"Improper Handling of Memory Overlap",
+             "caption": "",
+             "description":"Assess if isolated memory regions and access control policies allow software with low privileges to make changes to overlapping memory also used by software running with higher privileges.",
+             "CWE": ["CWE-1260"]
+            },
+            {
+              "key":"clearing_memory_during_state_transition",
+              "title":"Sensitive Information Uncleared Before State Transition",
+              "caption": "",
+              "description":"Assess if sensitive information only needed for one state is cleared after transitioning to the next state, such as during boot or waking up from sleep mode.",
+              "CWE": ["CWE-1272"]
+            },
+            {
+              "key":"volatile_memory_boot_code",
+              "title":"Improper Access Control for Volatile Memory for Boot Code",
+              "caption": "",
+              "description":"Assess if the secure boot process can be bypassed to execute untrusted malicious boot code",
+              "CWE": ["CWE-1274"]
+            },
+            {
+              "key":"firmware_not_updating",
+              "title":"Firmware Not Getting Updates",
+              "caption": "",
+              "description":"Verify if the firmware can receive regular updates as vulnerabilities are discovered in the future.",
+              "CWE": ["CWE-1277"]
+            },
+            {
+              "key":"root_shell",
+              "title":"Root Shell Access",
+              "caption": "",
+              "description":"Try to gain root shell access on the device using an enabled communication protocol, i.e. telnet or ssh, or using an open debug port to interrupt the boot process.",
+              "tools":"SOIC-8 clip, Burp, Caido, GNU Screen"
+            }
+          ]
+        },    
+        {
+          "key": "upload_logs",
+          "title": "Upload logs",
+          "description": "This should include all associated traffic associated to the in-scope targets.",
+          "type": "large_upload"
+        },
+        {
+          "key": "executive_summary",
+          "title": "Executive summary",
+          "description": "The executive summary should be written with a high-level view of both risk and business impact. It should be concise and clear, therefore it is important to use plain English. This ensures that non-technical readers can gain insight into security concerns outlined in your report.",
+          "type": "executive_summary"
+        }
+      ]
+    }
+  }