bmt 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 54db582c2fa9dee7782d78679c394a81bd58be62c19a543dcf2f343b48f9acd9
-  data.tar.gz: c2c95ae74e58f7025f7a9a1e3f39238e83a5350c8f1bee875f407e9bf4d435c5
+  metadata.gz: c8f63d37d7567b8009bd97b4f4762bf12ed9561419e33aaf8aff1a5be7886b95
+  data.tar.gz: 59384b86157f6b45ddd2528510759c08c9afe7b794a420416bfb0b9066e5862f
 SHA512:
-  metadata.gz: 3a8a16cb4896e1b004f69790782a3a89eb294ac42b87821fca2664bc6823acfd9ec83cbcfa4c8dbbceb556ffecb35919a6a671a542419eb3d5bcf368b0f74aa4
-  data.tar.gz: c0de897ad4c9bcf04412fee1035eb108b9f2f905b16616df7c0c316c981e473744df0475e3245cb207ee9ed826798e32e755a427d253a4251995077dd7183eda
+  metadata.gz: 56460d63293b10510e4b0ef5dd7bc08bdfad20fa26234b3550a74bb6e490029e66836d751c2d83e0c0a6d670b7c2310a131351247a12ed2e17c074c86d9cd392
+  data.tar.gz: 0b4386393e5970030151df3a432d9a5efbbe8466b12e147035318f8a6963545b5f836f948127414e0695dc9740c281d04dcedaa3f43ca90752166717772ede73

data/lib/bmt/version.rb

@@ -1,3 +1,3 @@
 module Bmt
-  VERSION = '0.4.0'.freeze
+  VERSION = '0.5.0'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bmt
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Federico Tagliabue
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-03-23 00:00:00.000000000 Z
+date: 2023-04-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -92,15 +92,6 @@ files:
 - lib/bmt/methodology.rb
 - lib/bmt/step.rb
 - lib/bmt/version.rb
-- lib/data/0.1/mappings/templates.json
-- lib/data/0.1/mappings/templates.schema.json
-- lib/data/0.1/methodologies/binaries.json
-- lib/data/0.1/methodologies/mobile_android.json
-- lib/data/0.1/methodologies/mobile_ios.json
-- lib/data/0.1/methodologies/network.json
-- lib/data/0.1/methodologies/template.json
-- lib/data/0.1/methodologies/website_testing.json
-- lib/data/0.1/schema.json
 homepage: https://github.com/bugcrowd/bmt-ruby
 licenses:
 - MIT
@@ -124,7 +115,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
+rubygems_version: 3.1.6
 signing_key:
 specification_version: 4
 summary: Ruby wrapper for Bugcrowd's Methodology Taxonomy

data/lib/data/0.1/mappings/templates.json

@@ -1,17 +0,0 @@
-{
-  "metadata": {
-    "title": "Methodology Taxonomy Template Mapping"
-  },
-  "content": [
-    {
-      "methodology": "website_testing",
-      "children": [
-        {
-          "key": "information",
-          "attribute": "notes",
-          "template": "information.md"
-        }
-      ]
-    }
-  ]
-}

data/lib/data/0.1/mappings/templates.schema.json

@@ -1,62 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "Methodology Taxonomy Mapping",
-  "description": "Mapping to methodology taxonomy",
-  "definitions": {
-    "MappingMetadata": {
-      "type": "object",
-      "properties": {
-        "title": {
-          "type": "string",
-          "pattern": "^[ a-zA-Z0-9\\-+()\/,.<]*$"
-        }
-      },
-      "required": ["title"]
-    },
-    "BMTKey": { "type": "string", "pattern": "^[a-z_]*$" },
-    "Attribute": { "type": "string", "pattern": "^[a-z_]*$" },
-    "Template": { "type": "string", "pattern": "[a-z_.]*$" },
-    "Mapping": {
-      "type": "object",
-      "properties": {
-        "key": { "$ref": "#/definitions/BMTKey" },
-        "attribute": { "$ref": "#/definitions/Attribute" },
-        "template" : { "$ref": "#/definitions/Template" }
-      },
-      "required": ["key", "attribute", "template"],
-      "additionalProperties": false
-    },
-    "MappingParent": {
-      "type": "object",
-      "properties": {
-        "methodology": { "$ref": "#/definitions/BMTKey" },
-        "children": {
-          "type": "array",
-          "items" : {
-            "anyOf": [
-              { "$ref": "#/definitions/Mapping" }
-            ]
-          }
-        }
-      },
-      "required": ["methodology", "children"],
-      "additionalProperties": false
-    }
-  },
-  "type": "object",
-  "required": ["metadata", "content"],
-  "properties": {
-    "metadata": {
-      "$ref": "#/definitions/MappingMetadata"
-    },
-    "content": {
-      "type": "array",
-      "items" : {
-        "anyOf": [
-          { "$ref": "#/definitions/MappingParent" },
-          { "$ref": "#/definitions/Mapping" }
-        ]
-      }
-    }
-  }
-}

data/lib/data/0.1/methodologies/binaries.json

@@ -1,252 +0,0 @@
-{
-  "metadata": {
-    "title": "Binary",
-    "release_date": "2022-01-10T00:00:00+00:00",
-    "description": "Bugcrowd Binary testing methodology",
-    "vrt_version": "10.0.1"
-  },
-  "content": {
-    "steps": [
-      {
-        "key": "insufficient_authentication_authorization",
-        "title": "Insufficient Authentication/Authorization",
-        "description": "",
-        "type": "checklist",
-        "items": [
-          {
-            "description": "",
-            "key": "multi_user_environment",
-            "caption": "",
-            "title": "Assess the application for multi-user environments and ensure it includes functionality for role separation."
-          },
-          {
-            "description": "",
-            "key": "password_recovery_mechanism",
-            "caption": "",
-            "title": "Assess password recovery mechanisms and ensure session management is properly maintained/terminated at the remote endpoint."
-          }
-        ]
-      },
-      {
-        "key": "insecure_network_services",
-        "title": "Insecure Network Services",
-        "description": "",
-        "type": "checklist",
-        "items": [
-          {
-            "description": "",
-            "key": "ensure_network_services",
-            "caption": "",
-            "title": "Assess the application to ensure network services for potentially interesting crashes or denial-of-service conditions that might indicate the presence of a memory corruption issue."
-          },
-          {
-            "description": "",
-            "key": "ensure_debugging_services",
-            "caption": "",
-            "title": "Assess the application to ensure debugging services are not present (and if present, test those services for access controls/default credentials)."
-          }
-        ]
-      },
-      {
-        "key": "lack_of_transport_encryption",
-        "title": "Lack of Transport Encryption",
-        "description": "",
-        "type": "checklist",
-        "items": [
-          {
-            "description": "",
-            "key": "assess_encrypted_communication",
-            "caption": "",
-            "title": "Assess the application to determine the use of modern encrypted communication between endpoints."
-          },
-          {
-            "description": "",
-            "key": "assess_encrypted_practice",
-            "caption": "",
-            "title": "Assess the application to determine if accepted encryption practices are used."
-          }
-        ]
-      },
-      {
-        "key": "privacy_concerns",
-        "title": "Privacy Concerns",
-        "description": "",
-        "type": "checklist",
-        "items": [
-          {
-            "description": "",
-            "key": "assess_personal_information_collected",
-            "caption": "",
-            "title": "Assess the application to determine the amount of personal information collected."
-          },
-          {
-            "description": "",
-            "key": "assess_personal_data_encryption",
-            "caption": "",
-            "title": "Assess the application to determine if collected personal data is properly protected using encryption at rest and in transit."
-          },
-          {
-            "description": "",
-            "key": "assess_data_de_identified_or_anonymized",
-            "caption": "",
-            "title": "Assess the application to determine if data is de-identified or anonymized."
-          },
-          {
-            "description": "",
-            "key": "no_sesitive_data",
-            "caption": "",
-            "title": "No sensitive data, such as passwords or pins, are exposed through the user interface."
-          },
-          {
-            "description": "",
-            "key": "no_sensitive_log_info",
-            "caption": "",
-            "title": "No sensitive information is contained in logs generated by the application."
-          },
-          {
-            "description": "",
-            "key": "assess_personal_info_sending_to_remote_location",
-            "caption": "",
-            "title": "Assess whether the application sends personal/identifying information to a remote location even though it is only required for local use."
-          }
-        ]
-      },
-      {
-        "key": "insecure_cloud_interface",
-        "title": "Insecure Cloud Interface (where applicable)",
-        "description": "",
-        "type": "checklist",
-        "items": [
-          {
-            "description": "",
-            "key": "assess_cloud_for_security_vulnerability",
-            "caption": "",
-            "title": "Assess the cloud interfaces for security vulnerabilities (e.g.testing  both API interfaces and cloud-based web interfaces for common (and uncommon) web application issues)."
-          },
-          {
-            "description": "",
-            "key": "assess_secure_transport_in_cloud",
-            "caption": "",
-            "title": "Assess all cloud interfaces to ensure secure transport encryption is used."
-          }
-        ]
-      },
-      {
-        "key": "insecure_software_firmware",
-        "title": "Insecure Software/Firmware",
-        "description": "",
-        "type": "checklist",
-        "items": [
-          {
-            "description": "",
-            "key": "assess_application_update_capability",
-            "caption": "",
-            "title": "Assess the application to ensure it includes update capability and can be updated quickly when vulnerabilities are discovered."
-          },
-          {
-            "description": "",
-            "key": "assess_encrypted_file_transfer",
-            "caption": "",
-            "title": "Assess the application to ensure it uses encrypted update files and that the files are transmitted using encryption."
-          },
-          {
-            "description": "",
-            "key": "assess_signed_files",
-            "caption": "",
-            "title": "Assess the application to ensure it uses signed files and then validates those files before installation."
-          },
-          {
-            "description": "",
-            "key": "assess_insecure_function_calls",
-            "caption": "",
-            "title": "Assess the application for insecure/dangerous function calls."
-          },
-          {
-            "description": "",
-            "key": "assess_user_input_sanitization",
-            "caption": "",
-            "title": "Assess the application to ensure ensure all user-controllable input data is sanitized prior to use."
-          },
-          {
-            "description": "",
-            "key": "ensure_all_third_party_components",
-            "caption": "",
-            "title": "Ensure all third party components used by the application, such as libraries and frameworks, are identified, and checked for known vulnerabilities."
-          },
-          {
-            "description": "",
-            "key": "assess_hardcoded_sensitive_info",
-            "caption": "",
-            "title": "Assess the application for signs of hardcoded sensitive information - e.g. credentials, URLs, API keys, etc."
-          },
-          {
-            "description": "",
-            "key": "assess_secure_random_number_generator",
-            "caption": "",
-            "title": "Assess the application to ensure all random values are generated using a sufficiently secure random number generator."
-          },
-          {
-            "description": "",
-            "key": "assess_input_via_dynamic_testing",
-            "caption": "",
-            "title": "Assess inputs on the application via dynamic testing (e.g. fuzzing) to identify potentially interesting crashes or denial-of-service conditions that might suggest the presence of a memory corruption or command injection issue."
-          },
-          {
-            "description": "",
-            "key": "assess_misconfigured_permission",
-            "caption": "",
-            "title": "Assess the application for misconfigured permissions, allowing for the escalation of privileges (e.g. DLL spoofing/hijacking, etc)."
-          },
-          {
-            "description": "",
-            "key": "assess_minimal_permissions",
-            "caption": "",
-            "title": "Assess the application to ensure it only uses the minimum set of permissions necessary."
-          },
-          {
-            "description": "",
-            "key": "assess_object_deserialization",
-            "caption": "",
-            "title": "Assess the application for unsafe object deserialization behavior that might lead to command injection."
-          },
-          {
-            "description": "",
-            "key": "assess_compiler_os_exploit_mitigation",
-            "caption": "",
-            "title": "Assess the application to ensure Basic OS/compiler exploit mitigation features, such stack protection/exploit mitigation (DEP, ASLR, stack canaries, etc) are activated."
-          },
-          {
-            "description": "",
-            "key": "assess_authentication_bypass",
-            "caption": "",
-            "title": "Assess the application for authentication bypasses and backdoors, allowing for access to functions/features outside of intended-use flows."
-          },
-          {
-            "description": "",
-            "key": "assess_application_for_internal_use",
-            "caption": "",
-            "title": "Assess the application for ability to access/use components meant for internal or administrative use (e.g. leftover debugging functionality not intended to exist in production)."
-          },
-          {
-            "description": "",
-            "key": "assess_for_undocumented_api_endpoints",
-            "caption": "",
-            "title": "Assess the application for undocumented API endpoints, and assess those for common vulnerabilities, as well as authentication bypasses."
-          }
-        ]
-      },
-      {
-        "key": "upload_logs",
-        "title": "Upload logs",
-        "description": "This should include all associated traffic associated to the in-scope targets.",
-        "type": "large_upload"
-      },
-      {
-        "key": "executive_summary",
-        "title": "Executive summary",
-        "description": "The executive summary should be written with a high-level view of both risk and business impact. It should be concise and clear, therefore it is important to use plain English. This ensures that non-technical readers can gain insight into security concerns outlined in your report.",
-        "type": "executive_summary"
-      }
-    ]
-  }
-}