cyberaudit-skill 3.0.0

package/skills/cyberaudit/mobile/vulnerabilities/NETWORK-MOBILE.md

@@ -0,0 +1,165 @@
+# 🌐 NETWORK MOBILE — VULNERABILITY GUIDE
+# Network security for mobile applications
+
+═══════════════════════════════════════════════════════════════
+              MOBILE NETWORK THREAT MODEL
+═══════════════════════════════════════════════════════════════
+
+THE MOBILE NETWORK ENVIRONMENT IS HOSTILE BY DEFINITION
+─────────────────────────────────────────────────────────
+  Mobile users connect via:
+  → Public WiFi (cafés, hotels, airports) → trivial MitM
+  → Corporate networks with TLS inspection → MitM by design
+  → 4G/5G mobile networks → harder interception
+  → Personal hotspots → lower risk
+
+  AN ATTACKER ON THE SAME NETWORK CAN:
+  → See all cleartext HTTP traffic
+  → Decrypt HTTPS traffic without certificate pinning
+    (via malicious CA installation + proxy)
+  → Inject content into HTTP responses
+  → Redirect traffic to a malicious server
+
+═══════════════════════════════════════════════════════════════
+              DETAILED NETWORK VULNERABILITIES
+═══════════════════════════════════════════════════════════════
+
+VULN-NET-001 — Cleartext HTTP traffic
+  Severity: CRITICAL (CVSS 8.1)
+  MASVS    : MASVS-NETWORK-1
+  
+  Detection:
+    → http:// in hardcoded URLs
+    → android:usesCleartextTraffic="true"
+    → NSExceptionAllowsInsecureHTTPLoads = true (iOS)
+    → No Network Security Config (Android)
+  
+  Fix:
+    Android — Network Security Config:
+      <network-security-config>
+        <base-config cleartextTrafficPermitted="false" />
+      </network-security-config>
+    
+    iOS — App Transport Security:
+      (Enabled by default since iOS 9, do not disable)
+      Remove any NSAllowsArbitraryLoads exception
+
+VULN-NET-002 — No Certificate Pinning
+  Severity: HIGH (CVSS 7.4)
+  MASVS    : MASVS-NETWORK-2
+  
+  Explanation:
+    Without pinning, the app accepts any certificate
+    signed by a trusted system CA.
+    
+    An attacker can:
+    1. Convince the user to install a custom CA
+       (social engineering, corporate MDM)
+    2. Compromise a legitimate CA (rare but documented)
+    3. Use a preinstalled malicious CA (rare)
+    
+    With a proxy (mitmproxy, Burp Suite):
+    HTTPS traffic intercepted in minutes.
+  
+  Exploitation scenario:
+    1. Attacker on same WiFi network
+    2. ARP spoofing to redirect traffic
+    3. mitmproxy with generated CA
+    4. If no pinning: traffic decrypted in cleartext
+    5. Extraction of Bearer tokens from headers
+
+VULN-NET-003 — Certificate validation disabled
+  Severity: CRITICAL (CVSS 9.1)
+  MASVS    : MASVS-NETWORK-1
+  
+  Detection:
+    // React Native — ignore SSL errors
+    // (often left by mistake from development)
+    fetch(url, { 
+      // Some configs allow SSL bypass
+    })
+    
+    // Flutter — badCertificateCallback always returns true
+    client.badCertificateCallback = (cert, host, port) => true
+    
+    // Android — TrustManager that accepts everything
+    TrustManager {
+      override fun checkServerTrusted(...) {} // EMPTY = accepts all
+    }
+    
+    // iOS — URLSessionDelegate
+    func urlSession(..., didReceive challenge: ...) {
+      completionHandler(.useCredential, ...) // Accepts all
+    }
+  
+  Fix:
+    Never disable SSL validation.
+    Use certificate pinning instead.
+    In development: use a properly configured
+    self-signed certificate, not total bypass.
+
+VULN-NET-004 — Sensitive data in Query Parameters
+  Severity: HIGH (CVSS 7.5)
+  MASVS    : MASVS-NETWORK-1
+  
+  Explanation:
+    Query parameters appear in:
+    → Server logs (access.log)
+    → Proxy logs
+    → Browser history (if WebView)
+    → Referer headers sent to third-party services
+    → Analytics and monitoring
+  
+  Detection:
+    GET /api/users?token=eyJhbGc...
+    GET /api/data?password=secret
+    GET /api/reset?key=abc123
+  
+  Fix:
+    Tokens and secrets → HTTP Authorization headers
+    Sensitive data → Request body (POST)
+    
+    // ❌ Vulnerable
+    fetch(`/api/data?token=${token}`)
+    
+    // ✅ Correct
+    fetch('/api/data', {
+      headers: {
+        Authorization: `Bearer ${token}`,
+      },
+    })
+
+VULN-NET-005 — No network timeout
+  Severity: MEDIUM (CVSS 5.3)
+  MASVS    : MASVS-NETWORK-1
+  
+  Explanation:
+    Without timeout, a request can block indefinitely.
+    An attacker can:
+    → Make requests to a slow-responding server
+    → Exhaust app resources (threads, memory)
+    → Cause degraded experience
+  
+  Fix:
+    // React Native fetch
+    const controller = new AbortController()
+    const timeoutId = setTimeout(() => controller.abort(), 10000)
+    
+    try {
+      const response = await fetch(url, {
+        signal: controller.signal,
+      })
+    } finally {
+      clearTimeout(timeoutId)
+    }
+    
+    // Axios
+    axios.create({
+      timeout: 10000, // 10 seconds
+    })
+    
+    // Dio (Flutter)
+    Dio(BaseOptions(
+      connectTimeout: Duration(seconds: 5),
+      receiveTimeout: Duration(seconds: 30),
+    ))

package/skills/cyberaudit/mobile/vulnerabilities/PERMISSIONS.md

@@ -0,0 +1,180 @@
+# 🔐 PERMISSIONS — MOBILE VULNERABILITY GUIDE
+# Mobile permissions audit
+
+═══════════════════════════════════════════════════════════════
+              PERMISSIONS PHILOSOPHY
+═══════════════════════════════════════════════════════════════
+
+EVERY PERMISSION IS A PROMISE TO THE USER
+────────────────────────────────────────────────────
+  By requesting a permission, you promise:
+  → I will use this capability ONLY for what I told you
+  → I will access your data ONLY when necessary
+  → I will not share your data without your consent
+  
+  An unnecessary permission = a promise you won't keep.
+  
+SENSITIVE PERMISSIONS AND THEIR RISKS
+────────────────────────────────────────
+  CAMERA
+    Risk: Camera access at any time
+    Legitimate use: QR scan, profile photo
+    Possible abuse: Non-consensual surveillance
+  
+  MICROPHONE
+    Risk: Audio recording in background
+    Legitimate use: Voice calls, audio notes
+    Possible abuse: Conversation eavesdropping
+  
+  LOCATION
+    Risk: Real-time movement tracking
+    Legitimate use: Navigation, delivery
+    Possible abuse: Surveillance, profiling
+    Fine vs Coarse: Choose the least precise possible
+  
+  CONTACTS
+    Risk: Access to entire address book
+    Legitimate use: Invite friends
+    Possible abuse: Email harvesting, spam
+  
+  STORAGE / FILES
+    Risk: Access to all device files
+    Legitimate use: Select a photo
+    Possible abuse: Document theft, private photos
+    Android 13+: Photo Picker without storage permission
+  
+  BACKGROUND LOCATION
+    Risk: Permanent tracking even app closed
+    Legitimate use: GPS navigation in background
+    Possible abuse: 24/7 surveillance
+  
+  READ_CALL_LOG / SEND_SMS
+    Risk: Access to communications
+    Legitimate use: Very rare
+    Possible abuse: OTP SMS theft, surveillance
+
+═══════════════════════════════════════════════════════════════
+              VULNERABLE PERMISSIONS PATTERNS
+═══════════════════════════════════════════════════════════════
+
+VULN-PERM-001 — Excessive declared permissions
+  Severity: MEDIUM (CVSS 4.3)
+  MASVS    : MASVS-PLATFORM-7
+  
+  Detection:
+    AndroidManifest.xml:
+    <uses-permission android:name="android.permission.READ_CONTACTS"/>
+    <uses-permission android:name="android.permission.SEND_SMS"/>
+    <uses-permission android:name="android.permission.CAMERA"/>
+    → Verify if each is ACTUALLY used in the code
+  
+  Fix:
+    1. List all declared permissions
+    2. For each permission:
+       - Search for its usage in code
+       - If not found → remove
+    3. Use less invasive alternatives:
+       - Storage → SAF (Storage Access Framework) Android
+       - Photo → Photo Picker (Android 13+, iOS 14+)
+       - Location → Coarse if Fine not needed
+
+VULN-PERM-002 — Permission requested at startup (UX and security)
+  Severity: LOW (CVSS 2.0)
+  MASVS    : MASVS-PLATFORM-7
+  
+  Explanation:
+    Asking all permissions at startup:
+    → Poor UX (user reflexively refuses)
+    → Impossible to justify contextually
+    → User doesn't understand why
+    → High refusal rate = broken features
+  
+  Fix:
+    // Request at time of need with explanation
+    
+    const requestCameraPermission = async () => {
+      // 1. Explain why BEFORE asking
+      const shouldRequest = await showExplanationDialog({
+        title: 'Camera access',
+        message: 'To scan your ticket QR code, '
+               + 'we need access to your camera.',
+        confirmText: 'Allow',
+        cancelText: 'Not now',
+      })
+      
+      if (!shouldRequest) return false
+      
+      // 2. Request permission
+      const { status } = await Camera.requestCameraPermissionsAsync()
+      
+      // 3. Handle refusal gracefully
+      if (status !== 'granted') {
+        showAlternativeOptions() // Offer an alternative
+        return false
+      }
+      
+      return true
+    }
+
+VULN-PERM-003 — App crash if permission denied
+  Severity: MEDIUM (CVSS 4.0)
+  MASVS    : MASVS-PLATFORM-7
+  
+  Detection:
+    // No handling for "permission denied" case
+    const { status } = await requestPermission()
+    // Direct usage without checking status
+    const photo = await takePicture() // Crash if denied
+  
+  Fix:
+    const handleCameraPermission = async () => {
+      const { status, canAskAgain } =
+        await Camera.requestCameraPermissionsAsync()
+      
+      switch (status) {
+        case 'granted':
+          // Continue normally
+          openCamera()
+          break
+          
+        case 'denied':
+          if (canAskAgain) {
+            // Explain and offer to re-request
+            showPermissionRationale()
+          } else {
+            // Direct to settings
+            showGoToSettingsDialog()
+          }
+          break
+          
+        case 'undetermined':
+          // Don't force, wait for user action
+          break
+      }
+    }
+
+VULN-PERM-004 — Background Location without justification
+  Severity: HIGH (CVSS 6.5)
+  MASVS    : MASVS-PLATFORM-7
+  
+  Detection:
+    AndroidManifest.xml:
+    <uses-permission
+      android:name="android.permission.ACCESS_BACKGROUND_LOCATION"/>
+    
+    Info.plist:
+    NSLocationAlwaysAndWhenInUseUsageDescription
+    NSLocationAlwaysUsageDescription
+  
+  Questions to ask:
+    → Does the app REALLY need background location?
+    → An active delivery app: YES
+    → An e-commerce app: NO
+    → A fitness tracking app: YES but with explicit consent
+  
+  Fix:
+    → If background location unnecessary: remove
+    → If necessary: clear justification in privacy policy
+    → Request only when user activates tracking
+    → Provide a way to easily disable
+    → Visible indicator when location is active

package/skills/cyberaudit/mobile/vulnerabilities/RUNTIME-MOBILE.md

@@ -0,0 +1,214 @@
+# ⚡ RUNTIME MOBILE — VULNERABILITY GUIDE
+# Runtime security for mobile applications
+
+═══════════════════════════════════════════════════════════════
+              RUNTIME SECURITY — CONCEPT
+═══════════════════════════════════════════════════════════════
+
+RUNTIME SECURITY PROTECTS THE APP DURING EXECUTION
+────────────────────────────────────────────────────────
+  Unlike static security (code, config),
+  runtime security protects against:
+  → App behavior modifications (Frida, hooking)
+  → Execution in a compromised environment (root, jailbreak)
+  → Unauthorised debugging
+  → Binary modification (repackaging)
+  → Emulation (for apps requiring a real device)
+
+RUNTIME PROTECTION LEVELS
+───────────────────────────────
+  LEVEL 1 — Detection and information
+    → Detect root/jailbreak
+    → Inform the user of the risk
+    → Limit sensitive features
+    (Appropriate for most apps)
+  
+  LEVEL 2 — Detection and restriction
+    → Detect root/jailbreak + Frida
+    → Refuse to run in degraded mode
+    → Delete sensitive data from device
+    (Banking, health apps)
+  
+  LEVEL 3 — Active protection
+    → All of level 2
+    → Advanced anti-debug
+    → Detection code obfuscation
+    → Binary integrity verification
+    (Government, defence apps)
+
+═══════════════════════════════════════════════════════════════
+              RUNTIME VULNERABILITIES
+═══════════════════════════════════════════════════════════════
+
+VULN-RUNTIME-001 — No Root/Jailbreak Detection
+  Severity: MEDIUM to HIGH depending on context
+  MASVS    : MASVS-RESILIENCE-1
+  
+  Impact by app type:
+  Banking app   : HIGH (financial data at risk)
+  Health app    : HIGH (medical data at risk)
+  General public app: MEDIUM (reduce attack surface)
+  Gaming app    : LOW (anti-cheat primarily)
+  
+  React Native fix:
+    // npm install react-native-device-info
+    import DeviceInfo from 'react-native-device-info'
+    
+    // npm install jail-monkey
+    import JailMonkey from 'jail-monkey'
+    
+    export const checkDeviceSecurity = async () => {
+      const isJailBroken = JailMonkey.isJailBroken()
+      const isOnExternalStorage = JailMonkey.isOnExternalStorage()
+      const canMockLocation = JailMonkey.canMockLocation()
+      const hasHooks = JailMonkey.hookDetected()
+      
+      const isCompromised =
+        isJailBroken ||
+        isOnExternalStorage ||
+        hasHooks
+      
+      return {
+        isCompromised,
+        reasons: {
+          isJailBroken,
+          isOnExternalStorage,
+          canMockLocation,
+          hasHooks,
+        }
+      }
+    }
+    
+    // Usage at app startup
+    const { isCompromised, reasons } = await checkDeviceSecurity()
+    
+    if (isCompromised) {
+      // For non-critical apps: warning
+      Alert.alert(
+        'Security',
+        'Your device appears to be modified. '
+        + 'Your data security may be reduced.',
+        [{ text: 'Continue', style: 'destructive' }]
+      )
+      
+      // For critical apps: block
+      Alert.alert(
+        'Access denied',
+        'The application cannot run '
+        + 'on a rooted/jailbroken device.',
+        [{
+          text: 'Exit',
+          onPress: () => RNExitApp.exitApp(),
+        }]
+      )
+    }
+
+VULN-RUNTIME-002 — No Frida Detection
+  Severity: HIGH for critical apps
+  MASVS    : MASVS-RESILIENCE-3
+  
+  What is Frida?
+    Frida is a dynamic instrumentation framework.
+    It can hook app functions at runtime
+    and modify their behavior.
+    
+    Examples of attacks via Frida:
+    → Bypass biometric verification
+    → Key extraction from Keychain
+    → Bypass root detection
+    → Modify transaction amounts
+  
+  Fix:
+    // Basic detection via Frida port (27042)
+    // and characteristic process names
+    
+    // For serious protection:
+    // → Use a commercial protection library
+    //   (Guardsquare DexGuard, Arxan, Appdome)
+    // → Or implement native checks (NDK)
+    //   as JavaScript checks are more easily bypassed
+    
+    // Basic detection (can be bypassed):
+    import JailMonkey from 'jail-monkey'
+    
+    const hasFridaDetected = JailMonkey.hookDetected()
+    
+    // ⚠️ This detection alone is insufficient
+    // for highly critical apps
+    // An advanced attacker can bypass JailMonkey
+
+VULN-RUNTIME-003 — Sensitive Data in Memory
+  Severity: MEDIUM
+  MASVS    : MASVS-STORAGE-1
+  
+  Explanation:
+    On a rooted device, app memory can be dumped.
+    Sensitive data held in memory too long is at risk.
+    
+    Particularly critical for:
+    → Encryption keys
+    → Entered passwords
+    → Biometric data (templates)
+    → Auth tokens
+  
+  Best practices:
+    → Clear sensitive data after use
+    → Use data types that support clearing
+    → Do not cache sensitive data
+    → Cryptographic keys: let Keystore handle them
+      (it never exposes them in application memory)
+    
+    // React Native — Clear sensitive data
+    // Note: JavaScript does not guarantee memory clearing
+    // For real protection → native code (NDK/NDK)
+    
+    let sensitiveData = await getPassword()
+    try {
+      // Use the data
+      await doSensitiveOperation(sensitiveData)
+    } finally {
+      // "Clear" — limited in JS but better than nothing
+      sensitiveData = null
+    }
+
+VULN-RUNTIME-004 — Detectable Debug Mode
+  Severity: MEDIUM
+  MASVS    : MASVS-CODE-2
+  
+  Detection:
+    An attacker can detect if an app is in debug
+    to adapt their attack.
+    
+    BuildConfig.DEBUG = true (Android)
+    → Attacker knows the app is in debug mode
+    → Debug features may be active
+    → Logs are probably verbose
+  
+  Fix:
+    // React Native — Ensure __DEV__ = false in prod
+    // Test with release build
+    
+    console.log('DEV mode:', __DEV__)
+    // Must be false in release
+    
+    // Android — Verify in build.gradle
+    // release { debuggable false }
+    
+    // Runtime check
+    if (__DEV__) {
+      console.warn('Application in development mode')
+    }
+
+═══════════════════════════════════════════════════════════════
+              COMPLETE RUNTIME CHECKLIST
+═══════════════════════════════════════════════════════════════
+
+  □ Root/Jailbreak detection implemented ?
+  □ Defined behavior if compromise detected ?
+  □ Frida detection (if critical app) ?
+  □ Anti-debug implemented (if very critical app) ?
+  □ Sensitive data cleared from memory after use ?
+  □ Debug mode disabled in production build ?
+  □ Binary integrity verification (if critical app) ?
+  □ Emulator behavior defined ?
+  □ Production build tested with active protections ?