cyberaudit-skill 3.0.0

package/skills/cyberaudit/mobile/vulnerabilities/STORAGE.md

@@ -0,0 +1,197 @@
+# 💾 STORAGE — MOBILE VULNERABILITY GUIDE
+# Mobile local storage vulnerabilities
+
+═══════════════════════════════════════════════════════════════
+              UNDERSTANDING MOBILE STORAGE
+═══════════════════════════════════════════════════════════════
+
+STORAGE SECURITY HIERARCHY
+────────────────────────────
+
+  LEVEL 1 — MOST SECURE (Hardware-backed)
+    iOS  : Keychain with Secure Enclave
+    Android: Keystore with StrongBox (if available)
+    → Protected by dedicated hardware
+    → Impossible to extract even with root
+    → Bound to physical device
+
+  LEVEL 2 — SECURE (Software-backed)
+    iOS  : Standard Keychain
+    Android: Software Keystore
+    → Encrypted by the operating system
+    → Hard to extract, requires advanced exploitation
+    → Recommended for auth tokens
+
+  LEVEL 3 — ACCEPTABLE (with app-level encryption)
+    MMKV encrypted, Hive encrypted, SQLCipher
+    → Encrypted by the application itself
+    → Safe if key is in Level 1 or 2
+    → Risky if key is in code
+
+  LEVEL 4 — DANGEROUS (unencrypted)
+    AsyncStorage, SharedPreferences, UserDefaults,
+    localStorage, sessionStorage, unencrypted SQLite
+    → Readable directly on rooted/jailbroken device
+    → Extractable via ADB backup (Android)
+    → Never use for sensitive data
+
+DATA CONSIDERED SENSITIVE
+───────────────────────────────
+  → Authentication tokens (JWT, session tokens)
+  → Refresh tokens
+  → Passwords (even hashed client-side)
+  → Cryptographic keys
+  → Credit card numbers
+  → Health data (HIPAA)
+  → Personally identifiable information (GDPR)
+  → PIN codes / secret codes
+
+═══════════════════════════════════════════════════════════════
+              DETAILED VULNERABILITIES
+═══════════════════════════════════════════════════════════════
+
+VULN-STORAGE-001 — Sensitive data in AsyncStorage
+  Severity: HIGH (CVSS 6.8)
+  MASVS    : MASVS-STORAGE-1
+  
+  Explanation:
+    AsyncStorage stores data in unencrypted files
+    in the application directory.
+    On rooted Android:
+      /data/data/com.yourapp/databases/AsyncStorage
+    On jailbroken iOS:
+      NSLibraryDirectory/RCTAsyncLocalStorage_V1/
+    
+    These files are readable in seconds
+    with the appropriate tools.
+  
+  Detection:
+    AsyncStorage.setItem(key, value) where value contains
+    a token, password, or sensitive data.
+  
+  Exploitation:
+    1. Rooted device
+    2. adb shell
+    3. cat /data/data/com.app/databases/AsyncStorage*
+    4. Read cleartext token
+  
+  Fix: See REM-MOB-001
+
+VULN-STORAGE-002 — Unprotected Android Backup
+  Severity: HIGH (CVSS 6.2)
+  MASVS    : MASVS-STORAGE-3
+  
+  Explanation:
+    By default: android:allowBackup="true"
+    An ADB backup can be performed without root
+    if USB debugging is enabled.
+    
+    Even without USB debugging, cloud backups (Google)
+    may include app data.
+  
+  Detection:
+    android:allowBackup="true" in AndroidManifest.xml
+    OR absence of backup_rules.xml
+  
+  Exploitation:
+    adb backup -apk com.yourapp -f backup.ab
+    java -jar abe.jar unpack backup.ab backup.tar
+    tar xf backup.tar
+    ls apps/com.yourapp/
+    # All app data is there
+  
+  Fix:
+    <application android:allowBackup="false" />
+    <!-- OR with selective backup rules -->
+    <application
+      android:fullBackupContent="@xml/backup_rules"
+      android:dataExtractionRules="@xml/data_extraction_rules">
+    
+    <!-- backup_rules.xml -->
+    <full-backup-content>
+      <exclude domain="sharedpref" path="." />
+      <exclude domain="database" path="." />
+      <exclude domain="file" path="sensitive/" />
+    </full-backup-content>
+
+VULN-STORAGE-003 — Screenshots in Task Switcher
+  Severity: MEDIUM (CVSS 4.0)
+  MASVS    : MASVS-STORAGE-4
+  
+  Explanation:
+    When the user puts the app in background,
+    Android and iOS capture a screenshot for
+    display in the task switcher.
+    
+    This screenshot may contain:
+    → Bank balance
+    → Private messages
+    → Medical data
+    → Personal information
+    
+    On a shared or stolen device, these screenshots
+    are accessible.
+  
+  Fix:
+    Android — FLAG_SECURE in MainActivity:
+      getWindow().setFlags(
+        WindowManager.LayoutParams.FLAG_SECURE,
+        WindowManager.LayoutParams.FLAG_SECURE
+      )
+    
+    iOS — Overlay when backgrounding:
+      NotificationCenter.default.addObserver(
+        self,
+        selector: #selector(appDidBecomeInactive),
+        name: UIApplication.willResignActiveNotification,
+        object: nil
+      )
+    
+    React Native — See REM-MOB-003
+
+VULN-STORAGE-004 — Sensitive data in logs
+  Severity: MEDIUM (CVSS 5.5)
+  MASVS    : MASVS-STORAGE-2
+  
+  Explanation:
+    System logs on Android are accessible via:
+      adb logcat
+    Without root, only your own app logs.
+    With root, all system logs.
+    
+    Tools like LogCat Reader can read
+    other apps' logs on some older devices.
+  
+  Detection:
+    console.log, print, NSLog with tokens, passwords,
+    user data, complete API responses.
+  
+  Fix: See REM-MOB-004
+
+VULN-STORAGE-005 — Unencrypted SQLite Database
+  Severity: HIGH (CVSS 6.8)
+  MASVS    : MASVS-STORAGE-1
+  
+  Explanation:
+    An unencrypted SQLite DB is an ordinary file.
+    On rooted device, directly readable:
+      adb shell
+      sqlite3 /data/data/com.app/databases/app.db
+      .dump
+    
+    Or extracted via backup and opened with DB Browser for SQLite.
+  
+  Fix:
+    React Native: react-native-sqlite-storage + SQLCipher
+    Flutter      : sqflite_sqlcipher
+    Ionic        : Ionic Secure Storage
+    
+    // React Native with SQLCipher
+    import SQLite from 'react-native-sqlite-storage'
+    SQLite.enablePromise(true)
+    
+    const db = await SQLite.openDatabase({
+      name: 'app.db',
+      key: await getEncryptionKeyFromKeychain(),
+      // The key comes from Keychain, not code!
+    })

package/skills/cyberaudit/reports/EXECUTIVE-SUMMARY-TEMPLATE.md

@@ -0,0 +1,188 @@
+# 📊 EXECUTIVE SUMMARY — CYBERAUDIT SKILL
+# Executive summary — For decision-makers and management
+
+═══════════════════════════════════════════════════════════════
+  USAGE: This template is used ALONE when the recipient
+  is non-technical (CTO, CEO, CISO, client).
+  It summarises a full report in 1-2 pages.
+  Business language, zero technical jargon.
+═══════════════════════════════════════════════════════════════
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+                    SECURITY EXECUTIVE SUMMARY
+                    ════════════════════════════
+
+  Application   : [NAME]
+  Type          : [Web / Mobile / Web + Mobile]
+  Date          : [DATE]
+  Reference     : [FULL REPORT ID]
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+ONE-LINE VERDICT
+─────────────────────
+
+  "[The application has critical vulnerabilities
+    that expose user data to an immediate
+    risk of compromise and block its deployment
+    to production as-is.]"
+
+  OR
+
+  "[The application has a satisfactory security level
+    with a few improvement points to plan, and can
+    be deployed to production after fixing the 2
+    high-severity items identified.]"
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+KEY INDICATORS
+────────────────
+
+  SECURITY SCORE        : [XX]/100
+  RISK LEVEL            : [🔴 CRITICAL / 🟠 HIGH / 🟡 MODERATE / 🟢 GOOD]
+  PRODUCTION DEPLOYMENT : [🔴 BLOCKED / 🟠 CONDITIONAL / 🟢 AUTHORISED]
+  GDPR COMPLIANCE       : [✅ Compliant / ❌ Non-compliant / ⚠️ Partial]
+  PCI-DSS COMPLIANCE    : [✅ / ❌ / ⚠️ / N/A]
+
+  VULNERABILITIES FOUND:
+  ┌──────────────────────────────────────────────┐
+  │  🔴 Critical  : [N]  →  Immediate risk       │
+  │  🟠 High      : [N]  →  Significant risk     │
+  │  🟡 Medium    : [N]  →  Moderate risk        │
+  │  🟢 Low       : [N]  →  Minor risk           │
+  │                                              │
+  │  TOTAL        : [N]  vulnerabilities         │
+  └──────────────────────────────────────────────┘
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+WHAT THIS MEANS IN PRACTICE
+────────────────────────────────────
+
+  Agent instructions:
+  Translate technical findings into business risks
+  understandable by a non-technical person.
+  Use simple analogies. No jargon.
+
+  RISK 1 — [Business title, not technical]
+  ┌──────────────────────────────────────────────────────────┐
+  │ What happens:                                            │
+  │ [Simple explanation — e.g., "An attacker can access     │
+  │  the personal data of all your users                     │
+  │  without having an account on your platform"]            │
+  │                                                          │
+  │ Potential impact:                                        │
+  │ [Business impact — e.g., "Exposure of X customer        │
+  │  data, GDPR fine risk up to 4% of revenue,               │
+  │  reputational damage"]                                   │
+  │                                                          │
+  │ Fix time : [X days]                                      │
+  │ Estimated cost : [Low / Medium / High]                   │
+  └──────────────────────────────────────────────────────────┘
+
+  RISK 2 — [Business title]
+  ┌──────────────────────────────────────────────────────────┐
+  │ What happens:                                            │
+  │ [Simple explanation]                                     │
+  │                                                          │
+  │ Potential impact:                                        │
+  │ [Business impact]                                        │
+  │                                                          │
+  │ Fix time : [X days]                                      │
+  │ Estimated cost : [Low / Medium / High]                   │
+  └──────────────────────────────────────────────────────────┘
+
+  RISK 3 — [Business title]
+  ┌──────────────────────────────────────────────────────────┐
+  │ What happens:                                            │
+  │ [Simple explanation]                                     │
+  │                                                          │
+  │ Potential impact:                                        │
+  │ [Business impact]                                        │
+  │                                                          │
+  │ Fix time : [X days]                                      │
+  │ Estimated cost : [Low / Medium / High]                   │
+  └──────────────────────────────────────────────────────────┘
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+WHAT IS WORKING WELL
+────────────────────────
+
+  [Always mention positive points.
+   A good security report acknowledges what is done well.]
+
+  ✅ [Positive point 1 — e.g., "Authentication is robust
+      with two-factor authentication and protection against
+      brute force attacks"]
+
+  ✅ [Positive point 2 — e.g., "Network communications are
+      encrypted and certificates are correctly verified"]
+
+  ✅ [Positive point 3]
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+RECOMMENDED ACTION PLAN
+────────────────────────
+
+  WEEK 1 — Immediate actions
+  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  Who    : Development team
+  What   : [Critical actions in simple language]
+  Budget : [Estimated in man-days]
+  Deliverable : Validated critical fixes
+
+  MONTH 1 — Priority actions
+  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  Who    : Development team + DevOps
+  What   : [High-severity actions]
+  Budget : [Estimated in man-days]
+  Deliverable : Remediation report
+
+  QUARTER 1 — Structural improvements
+  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  Who    : Extended team
+  What   : [Architecture and process improvements]
+  Budget : [Estimated in man-days]
+  Deliverable : Level [X] certified application
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+INVESTMENT VS RISK
+─────────────────────────
+
+  Fix cost    : [XX] man-days ≈ [XX]€
+
+  Cost of a data breach (estimate):
+  ┌──────────────────────────────────────────────────┐
+  │ Possible GDPR fine       : up to [XX]€           │
+  │ Notification cost        : [XX]€ estimated       │
+  │ Reputational damage      : [Not quantifiable]    │
+  │ Average data breach cost : 4.45M$ (IBM 2023)     │
+  │                                                  │
+  │ ROI of fixes             : Obvious               │
+  └──────────────────────────────────────────────────┘
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+DECISION REQUIRED
+─────────────────
+
+  □ Approve Phase 1 remediation plan (immediate)
+  □ Allocate [N] man-days to the development team
+  □ [If NO-GO] Block deployment until fixes are complete
+  □ Schedule a follow-up audit in [30/60/90] days
+  □ [If applicable] Notify the DPO for GDPR risk
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  Full report available : [Report reference]
+  For any questions     : Use CyberAudit in Q&A mode
+
+  Generated by CyberAudit Skill v3.0 — LUNAIRE EDITION
+  CONFIDENTIAL document — Management level only
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━