cyberaudit-skill 3.0.0

package/skills/cyberaudit/mobile/vulnerabilities/BINARY-ANALYSIS.md

@@ -0,0 +1,193 @@
+# 🔬 BINARY ANALYSIS — MOBILE VULNERABILITY GUIDE
+# Binary security and reverse engineering protection
+
+═══════════════════════════════════════════════════════════════
+              WHAT IS BINARY ANALYSIS?
+═══════════════════════════════════════════════════════════════
+
+YOUR APK/IPA IS PUBLIC
+─────────────────────────
+  Any user can:
+  → Download the APK from the Play Store
+  → Extract the IPA from a jailbroken device
+  → Download from third-party stores
+  
+  With the APK/IPA, an attacker can:
+  → Extract all strings from the binary
+  → Reconstruct code logic
+  → Find hidden API endpoints
+  → Find hardcoded secrets
+  → Modify the code and repackage the app
+  → Bypass client-side security controls
+
+COMMON BINARY ANALYSIS TOOLS
+────────────────────────────────────
+  apktool         → Decompiles APK (resources + smali)
+  jadx            → Decompiles to readable Java/Kotlin
+  ghidra          → Analyses native code (NDK)
+  frida           → Runtime hooking (modify behavior)
+  objection       → Mobile pentest framework based on Frida
+  radare2         → Advanced static analysis
+  strings         → Extract strings from binary
+  class-dump      → Extract iOS interfaces
+  Hopper          → iOS/macOS disassembler
+
+REACT NATIVE — THE SPECIAL CASE
+────────────────────────────────────
+  React Native JavaScript code is in:
+  Android: assets/index.android.bundle
+  iOS    : main.jsbundle
+  
+  It is directly readable:
+  strings index.android.bundle | grep -i "api\|key\|secret"
+  
+  Even "minified", the code remains readable JavaScript
+  and can be reformatted with tools.
+
+═══════════════════════════════════════════════════════════════
+              BINARY VULNERABILITIES
+═══════════════════════════════════════════════════════════════
+
+VULN-BIN-001 — Hardcoded Secrets in Binary
+  Severity: CRITICAL (CVSS 9.1)
+  MASVS    : MASVS-CRYPTO-5
+  
+  What is found in binaries in practice:
+  → Third-party API keys (Stripe, Twilio, AWS)
+  → Internal environment URLs (staging, admin)
+  → Encryption keys
+  → Test tokens left in production
+  → Undocumented API endpoints
+  → Database credentials (rare but documented error)
+  
+  Detection commands:
+    # Extract strings from a React Native APK
+    unzip app.apk
+    strings assets/index.android.bundle | \
+      grep -iE "(api_key|secret|password|token|bearer|sk-|pk_live)"
+    
+    # With jadx (Kotlin/Java code)
+    jadx app.apk -d output/
+    grep -r "apiKey\|secret\|password" output/sources/
+    
+    # iOS
+    strings App.app/App | grep -iE "(key|secret|token)"
+  
+  Fix:
+    → No secrets in source code (frontend or mobile)
+    → Use environment variables injected at build time
+    → Real secret keys remain server-side
+    → The mobile app authenticates and receives
+      temporary tokens from the server which has the real secrets
+
+VULN-BIN-002 — No Obfuscation (Android)
+  Severity: MEDIUM (CVSS 4.0)
+  MASVS    : MASVS-CODE-4
+  
+  Explanation:
+    Without obfuscation, code decompiled with jadx
+    is nearly identical to the original source code.
+    → Business logic exposed
+    → Proprietary algorithms copiable
+    → Logical vulnerabilities easier to find
+  
+  Fix for Android (build.gradle):
+    android {
+      buildTypes {
+        release {
+          minifyEnabled true
+          shrinkResources true
+          proguardFiles getDefaultProguardFile(
+            'proguard-android-optimize.txt'
+          ), 'proguard-rules.pro'
+        }
+      }
+    }
+    
+    // proguard-rules.pro — Protect sensitive logic
+    -keep class com.yourapp.models.** { *; }
+    -keepclassmembers class * {
+      @com.google.gson.annotations.SerializedName <fields>;
+    }
+    // Obfuscate the rest
+
+VULN-BIN-003 — Debug Code in Production
+  Severity: HIGH (CVSS 7.5)
+  MASVS    : MASVS-CODE-2
+  
+  Detection:
+    BuildConfig.DEBUG = true in release
+    android:debuggable="true" in manifest
+    /debug, /test, /dev endpoints accessible
+    Verbose logs enabled in prod
+    Expo developer mode active
+  
+  Fix:
+    // Android — automatically false in release build
+    // Verify in build.gradle:
+    buildTypes {
+      release {
+        debuggable false // Explicit
+        minifyEnabled true
+      }
+    }
+    
+    // React Native — use __DEV__
+    if (__DEV__) {
+      // Debug code only
+    }
+    
+    // Verify app is in release mode:
+    // npx react-native run-android --mode=release
+    // npx react-native run-ios --configuration Release
+
+VULN-BIN-004 — Source Maps in Production
+  Severity: HIGH (CVSS 6.5)
+  MASVS    : MASVS-CODE-4
+  
+  Explanation:
+    Source maps allow reconstructing the exact
+    source code from the minified bundle.
+    If included in production build:
+    → 100% readable source code
+    → Original variable/function names
+    → Project structure exposed
+  
+  Fix:
+    // React Native — metro.config.js
+    module.exports = {
+      transformer: {
+        // In production: no source maps
+        enableBabelRCLookup: false,
+      },
+    }
+    
+    // EAS Build — eas.json
+    // Source maps can be uploaded to Sentry
+    // WITHOUT being included in the app
+    {
+      "build": {
+        "production": {
+          "env": {
+            "SENTRY_ORG": "...",
+            "SENTRY_PROJECT": "..."
+          }
+        }
+      }
+    }
+    
+    // sentry.properties — Separate upload
+    // Source maps go to Sentry, not in the APK
+
+═══════════════════════════════════════════════════════════════
+              BINARY ANALYSIS CHECKLIST
+═══════════════════════════════════════════════════════════════
+
+  □ No secrets in index.android.bundle / main.jsbundle ?
+  □ No secrets in compiled Kotlin/Swift files ?
+  □ No internal URLs in the binary ?
+  □ ProGuard/R8 enabled for Android release ?
+  □ android:debuggable="false" in release manifest ?
+  □ Source maps not included in production build ?
+  □ Binary strings analysed before each release ?
+  □ Release build tested different from dev build ?

package/skills/cyberaudit/mobile/vulnerabilities/CRYPTO-MOBILE.md

@@ -0,0 +1,192 @@
+# 🔒 CRYPTO MOBILE — VULNERABILITY GUIDE
+# Cryptography in mobile applications
+
+═══════════════════════════════════════════════════════════════
+              MOBILE CRYPTOGRAPHY — PRINCIPLES
+═══════════════════════════════════════════════════════════════
+
+GOLDEN RULES OF MOBILE CRYPTOGRAPHY
+────────────────────────────────────────
+  1. Use platform cryptographic APIs
+     → iOS: CryptoKit, CommonCrypto, Security Framework
+     → Android: Keystore System, javax.crypto
+     → Never implement your own crypto
+
+  2. Store keys in cryptographic hardware
+     → iOS: Secure Enclave (A7+)
+     → Android: StrongBox Keymaster (if available)
+     → Otherwise: Software Keystore
+
+  3. Approved algorithms only
+     → Symmetric: AES-256-GCM (authenticated)
+     → Asymmetric: RSA-2048+, ECDSA P-256+
+     → Hashing: SHA-256+
+     → KDF: PBKDF2, bcrypt, argon2
+     → NEVER: DES, 3DES, RC4, MD5, SHA1
+
+  4. Secure random generation
+     → iOS: SecRandomCopyBytes
+     → Android: SecureRandom (via Keystore)
+     → Never Math.random() for crypto
+
+═══════════════════════════════════════════════════════════════
+              MOBILE CRYPTO VULNERABILITIES
+═══════════════════════════════════════════════════════════════
+
+VULN-CRYPTO-001 — Weak Cryptographic Algorithms
+  Severity: CRITICAL (CVSS 9.1)
+  MASVS    : MASVS-CRYPTO-1
+  
+  Detection:
+    // React Native / JS
+    const hash = CryptoJS.MD5(password)      // CRITICAL
+    const hash = CryptoJS.SHA1(data)         // CRITICAL
+    const cipher = CryptoJS.DES.encrypt()    // CRITICAL
+    const cipher = CryptoJS.RC4.encrypt()    // CRITICAL
+    
+    // Dart / Flutter
+    import 'package:crypto/crypto.dart';
+    final hash = md5.convert(bytes)          // CRITICAL
+    final hash = sha1.convert(bytes)         // Weak
+    
+    // Java / Kotlin (Android)
+    MessageDigest.getInstance("MD5")         // CRITICAL
+    Cipher.getInstance("DES")               // CRITICAL
+    Cipher.getInstance("AES/ECB/PKCS5Padding") // ECB = vulnerable
+  
+  Fix:
+    // React Native — Use expo-crypto or react-native-quick-crypto
+    import * as Crypto from 'expo-crypto'
+    
+    const hash = await Crypto.digestStringAsync(
+      Crypto.CryptoDigestAlgorithm.SHA256, // SHA-256 minimum
+      data
+    )
+    
+    // For encryption: AES-GCM via react-native-quick-crypto
+    import { createCipheriv, randomBytes } from
+      'react-native-quick-crypto'
+    
+    const encrypt = (plaintext: string, key: Buffer): Buffer => {
+      const iv = randomBytes(12) // 96 bits for GCM
+      const cipher = createCipheriv('aes-256-gcm', key, iv)
+      
+      const encrypted = Buffer.concat([
+        cipher.update(plaintext, 'utf8'),
+        cipher.final(),
+      ])
+      
+      const tag = cipher.getAuthTag() // GCM authentication tag
+      
+      // Store: iv (12) + tag (16) + encrypted
+      return Buffer.concat([iv, tag, encrypted])
+    }
+
+VULN-CRYPTO-002 — Hardcoded Cryptographic Key
+  Severity: CRITICAL (CVSS 9.1)
+  MASVS    : MASVS-CRYPTO-5
+  
+  Detection:
+    const ENCRYPTION_KEY = 'MySecretKey12345'         // CRITICAL
+    const KEY = Buffer.from('aabbccdd...', 'hex')     // CRITICAL
+    static final byte[] KEY = {0x41, 0x42, ...}       // CRITICAL
+    
+    // Flutter
+    const encryptionKey = 'hardcoded-secret-key'      // CRITICAL
+  
+  Fix:
+    // The key must be:
+    // 1. Randomly generated (not hardcoded)
+    // 2. Stored in Keychain/Keystore
+    // 3. Never in source code
+    
+    // React Native — Secure generation and storage
+    import * as Keychain from 'react-native-keychain'
+    import { randomBytes } from 'react-native-quick-crypto'
+    
+    const getOrCreateEncryptionKey = async (): Promise<Buffer> => {
+      const KEY_SERVICE = 'com.yourapp.encryption-key'
+      
+      // Try to retrieve existing key
+      const existing = await Keychain.getGenericPassword({
+        service: KEY_SERVICE,
+      })
+      
+      if (existing) {
+        return Buffer.from(existing.password, 'hex')
+      }
+      
+      // Generate new key (first use)
+      const newKey = randomBytes(32) // 256 bits for AES-256
+      
+      await Keychain.setGenericPassword(
+        'encryption-key',
+        newKey.toString('hex'),
+        {
+          service: KEY_SERVICE,
+          accessible: Keychain.ACCESSIBLE.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
+        }
+      )
+      
+      return newKey
+    }
+
+VULN-CRYPTO-003 — Static or Predictable IV/Nonce
+  Severity: HIGH (CVSS 7.5)
+  MASVS    : MASVS-CRYPTO-3
+  
+  Explanation:
+    The IV (Initialization Vector) or Nonce must be:
+    → Random and unique for EACH encryption operation
+    → Never reused with the same key (especially in GCM)
+    
+    A static IV allows:
+    → Pattern analysis in encrypted data
+    → Birthday attacks
+    → In GCM: key recovery if IV reused!
+  
+  Detection:
+    const iv = Buffer.from('1234567890123456') // CRITICAL: static
+    const iv = Buffer.alloc(16, 0)             // CRITICAL: zeros
+    const iv = Buffer.from(userId, 'hex')      // HIGH: predictable
+  
+  Fix:
+    // ALWAYS generate a random IV
+    const iv = randomBytes(12) // 12 bytes for AES-GCM
+    
+    // Store IV with encrypted data
+    // IV is NOT secret but must be unique
+    const stored = Buffer.concat([iv, encrypted, authTag])
+
+VULN-CRYPTO-004 — Insecure Random Generation
+  Severity: HIGH (CVSS 7.5)
+  MASVS    : MASVS-CRYPTO-3
+  
+  Detection:
+    Math.random()                    // NEVER for crypto
+    Math.floor(Math.random() * ...)  // NEVER
+    new Date().getTime()             // NEVER as seed
+    
+    // Java
+    new Random()                     // NEVER
+    new Random(System.currentTimeMillis()) // NEVER
+  
+  Fix:
+    // JavaScript / React Native
+    import { randomBytes } from 'react-native-quick-crypto'
+    // OR
+    import * as Crypto from 'expo-crypto'
+    const randomValue = Crypto.getRandomBytes(32)
+    
+    // Dart / Flutter
+    import 'dart:math';
+    final random = Random.secure() // .secure() = CSPRNG
+    final bytes = List<int>.generate(
+      32, (_) => random.nextInt(256)
+    )
+    
+    // Java / Kotlin (Android)
+    import java.security.SecureRandom
+    val random = SecureRandom()
+    val bytes = ByteArray(32)
+    random.nextBytes(bytes)

package/skills/cyberaudit/mobile/vulnerabilities/IPC-DEEPLINKS.md

@@ -0,0 +1,231 @@
+# 🔗 IPC & DEEP LINKS — MOBILE VULNERABILITY GUIDE
+# Inter-process communication and mobile deep links
+
+═══════════════════════════════════════════════════════════════
+              IPC MOBILE — UNDERSTANDING THE RISKS
+═══════════════════════════════════════════════════════════════
+
+IPC (Inter-Process Communication) on mobile:
+
+  ANDROID                    iOS
+  ──────────                 ───
+  Intents (explicit/implicit)  URL Schemes
+  Content Providers            Universal Links
+  Broadcast Receivers          App Extensions
+  Bound Services               XPC (system apps)
+  Deep Links / App Links       Pasteboard
+
+  EACH IPC MECHANISM = EXTERNAL ENTRY SURFACE
+  → Data coming from OUTSIDE the app
+  → Potentially controlled by an attacker
+  → Must be treated as HOSTILE
+
+═══════════════════════════════════════════════════════════════
+              IPC AND DEEP LINK VULNERABILITIES
+═══════════════════════════════════════════════════════════════
+
+VULN-IPC-001 — Exported Android Activity Unprotected
+  Severity: HIGH (CVSS 7.5)
+  MASVS    : MASVS-PLATFORM-1
+  
+  Explanation:
+    An Activity with android:exported="true"
+    without permission protection can be launched
+    by any other application.
+    
+    A malicious app can thus:
+    → Launch sensitive Activities directly
+    → Bypass the login screen
+    → Access restricted features
+  
+  Detection:
+    <activity
+      android:name=".AdminActivity"
+      android:exported="true"> <!-- Accessible to all apps! -->
+      <intent-filter>...</intent-filter>
+    </activity>
+  
+  Exploitation:
+    // From a malicious app:
+    Intent intent = new Intent()
+    intent.setComponent(new ComponentName(
+      "com.targetapp",
+      "com.targetapp.AdminActivity"
+    ))
+    startActivity(intent)
+  
+  Fix:
+    <!-- Option A: Don't export if unnecessary -->
+    <activity
+      android:name=".InternalActivity"
+      android:exported="false" />
+    
+    <!-- Option B: Protect with a permission -->
+    <activity
+      android:name=".SensitiveActivity"
+      android:exported="true"
+      android:permission="com.yourapp.INTERNAL">
+    </activity>
+    
+    <!-- Declare signature-level permission -->
+    <permission
+      android:name="com.yourapp.INTERNAL"
+      android:protectionLevel="signature" />
+    <!-- protectionLevel="signature" = only apps signed
+         with the same key can send the intent -->
+
+VULN-IPC-002 — Implicit Intent for Sensitive Data
+  Severity: HIGH (CVSS 6.8)
+  MASVS    : MASVS-PLATFORM-1
+  
+  Explanation:
+    Implicit intents (without a specific target component)
+    can be intercepted by other applications.
+    
+    If an implicit intent contains sensitive data
+    (token, user data), a malicious app
+    with the same intent-filter can intercept it.
+  
+  Detection:
+    Intent intent = new Intent("com.yourapp.ACTION_SHARE_TOKEN")
+    intent.putExtra("token", authToken) // Interceptable!
+    sendBroadcast(intent)
+  
+  Fix:
+    // Use EXPLICIT intents for sensitive data
+    Intent intent = new Intent(context, TargetService.class)
+    intent.putExtra("action", "doSomething")
+    // No sensitive data in extras if broadcast
+    startService(intent)
+    
+    // For broadcasts: use LocalBroadcastManager
+    // or signature permissions
+    LocalBroadcastManager.getInstance(context)
+      .sendBroadcast(intent)
+
+VULN-IPC-003 — Deep Link Without Parameter Validation
+  Severity: HIGH (CVSS 7.1)
+  MASVS    : MASVS-PLATFORM-2
+  
+  Explanation:
+    Deep links can be triggered by:
+    → An SMS or email received by the user
+    → A web page (if autoVerify not configured)
+    → Another application
+    → A scanned QR code
+    
+    If parameters are not validated:
+    → Route injection (navigation to any screen)
+    → Parameter injection (IDOR, manipulated amounts)
+    → Open redirect (redirection to malicious sites)
+    → Execution of unwanted actions
+  
+  Exploitation:
+    // Forged link sent via SMS:
+    yourapp://transfer?to=attacker_account&amount=9999
+    
+    // If the app doesn't validate:
+    → Transfer executed without additional confirmation
+  
+  Complete fix:
+    // See REM-MOB-005 in MOBILE-REMEDIATION-LIBRARY.md
+
+VULN-IPC-004 — URL Scheme Hijacking (iOS)
+  Severity: HIGH (CVSS 6.5)
+  MASVS    : MASVS-PLATFORM-2
+  
+  Explanation:
+    On iOS, multiple apps can declare the same URL Scheme.
+    Depending on installation order, a malicious app can
+    intercept deep links intended for your app.
+    
+    Example: A fake app declares myapp://
+    It receives deep links with reset tokens,
+    OAuth auth codes, etc.
+  
+  Solution:
+    → Universal Links (HTTPS) cannot be hijacked
+    → They are linked to a domain that only your server
+      can claim (AASA file)
+    
+    // iOS — Prefer Universal Links
+    // 1. Host https://yourapp.com/.well-known/apple-app-site-association
+    {
+      "applinks": {
+        "details": [{
+          "appIDs": ["TEAMID.com.yourapp"],
+          "components": [
+            { "/": "/product/*" },
+            { "/": "/order/*" },
+            { "/": "/reset-password/*" }
+          ]
+        }]
+      }
+    }
+    
+    // 2. Info.plist — Associated Domains
+    com.apple.developer.associated-domains :
+      applinks:yourapp.com
+
+VULN-IPC-005 — Unsecured WebView JavaScript Bridge
+  Severity: CRITICAL (CVSS 8.8)
+  MASVS    : MASVS-PLATFORM-4
+  
+  Explanation:
+    A JavaScript Bridge exposes native functions
+    to the WebView's JavaScript code.
+    
+    If the WebView loads untrusted content AND
+    the bridge is too permissive:
+    XSS in web content = access to native functions
+    
+  Detection:
+    // React Native WebView with exposed bridge
+    <WebView
+      source={{ uri: dynamicUrl }} // Uncontrolled URL
+      onMessage={handleAllMessages} // Accepts everything
+    />
+    
+    // Handler doesn't validate origin
+    const handleAllMessages = (event) => {
+      const { action, data } = JSON.parse(event.nativeEvent.data)
+      if (action === 'readFile') readFile(data.path) // Dangerous
+    }
+  
+  Fix:
+    <WebView
+      // Strictly controlled URLs
+      source={{ uri: 'https://trusted.yourapp.com' }}
+      
+      onShouldStartLoadWithRequest={(request) => {
+        // Strict whitelist
+        return request.url.startsWith(
+          'https://trusted.yourapp.com'
+        )
+      }}
+      
+      onMessage={(event) => {
+        let message
+        try {
+          message = JSON.parse(event.nativeEvent.data)
+        } catch {
+          return // Ignore invalid messages
+        }
+        
+        // Whitelist of allowed actions
+        const allowedActions = ['shareContent', 'goBack']
+        if (!allowedActions.includes(message.action)) return
+        
+        // Validate data by action
+        switch (message.action) {
+          case 'shareContent':
+            // Validate and sanitize content
+            if (typeof message.text !== 'string') return
+            shareContent(message.text.substring(0, 500))
+            break
+          case 'goBack':
+            navigation.goBack()
+            break
+        }
+      }}
+    />