supplier-meesho.webflow 1.0.0

package/MobSF/mobsf/StaticAnalyzer/views/ios/permission_analysis.py

@@ -0,0 +1,90 @@
+import logging
+
+logger = logging.getLogger(__name__)
+
+# List taken from
+# https://developer.apple.com/library/archive/documentation/
+# General/Reference/InfoPlistKeyReference/Articles/CocoaKeys.html
+
+COCOA_KEYS = {
+    'NETestAppMapping': (
+        ('Enables testing of per-app VPN app extensions '
+         'without using an MDM server.'),
+        'normal'),
+    'NFCReaderUsageDescription': (
+        'Access device’s NFC reader.',
+        'dangerous'),
+    'NSAppleMusicUsageDescription': (
+        'Access Apple Media Library.',
+        'dangerous'),
+    'NSBluetoothPeripheralUsageDescription': (
+        'Access Bluetooth Interface.',
+        'dangerous'),
+    'NSCalendarsUsageDescription': (
+        'Access Calendars.',
+        'dangerous'),
+    'NSCameraUsageDescription': (
+        'Access the Camera.',
+        'dangerous'),
+    'NSContactsUsageDescription': (
+        'Access Contacts.',
+        'dangerous'),
+    'NSFaceIDUsageDescription': (
+        'Access the ability to authenticate with Face ID.',
+        'normal'),
+    'NSHealthClinicalHealthRecordsShareUsageDescription': (
+        'Access user’s clinical health records.',
+        'dangerous'),
+    'NSHealthShareUsageDescription': (
+        'Read Health Data.',
+        'dangerous'),
+    'NSHealthUpdateUsageDescription': (
+        'Write Health Data.',
+        'dangerous'),
+    'NSHomeKitUsageDescription': (
+        'Access HomeKit configuration data.',
+        'dangerous'),
+    'NSLocationAlwaysUsageDescription': (
+        'Access location information at all times.',
+        'dangerous'),
+    'NSLocationUsageDescription': (
+        'Access location information at all times (< iOS 8).',
+        'dangerous'),
+    'NSLocationWhenInUseUsageDescription': (
+        'Access location information when app is in the foreground.',
+        'dangerous'),
+    'NSMicrophoneUsageDescription': (
+        'Access microphone.',
+        'dangerous'),
+    'NSMotionUsageDescription': (
+        'Access the device’s accelerometer.',
+        'dangerous'),
+    'NSPhotoLibraryUsageDescription': (
+        'Access the user’s photo library.',
+        'dangerous'),
+    'NSRemindersUsageDescription': (
+        'Access the user’s reminders.',
+        'dangerous'),
+    'NSSiriUsageDescription': (
+        'Allow app to send user data to Siri',
+        'dangerous'),
+    'NSSpeechRecognitionUsageDescription': (
+        'Allow app to send user data to Apple’s speech recognition servers.',
+        'normal'),
+    'NSVideoSubscriberAccountUsageDescription': (
+        'Access the user’s TV provider account.',
+        'normal'),
+}
+
+
+def check_permissions(p_list):
+    """Check the permissions the app requests."""
+    permissions = {}
+    for perm, desc in COCOA_KEYS.items():
+        if perm in p_list:
+            permissions[perm] = {
+                'description': desc[0],
+                'status': desc[1],
+                'reason': p_list.get(perm, ''),
+            }
+    return permissions

package/MobSF/mobsf/StaticAnalyzer/views/ios/plist_analysis.py

@@ -0,0 +1,150 @@
+# -*- coding: utf_8 -*-
+"""Module for iOS App Plist Analysis."""
+
+import logging
+import os
+from plistlib import (
+    dumps,
+    load,
+)
+from re import sub
+
+from biplist import (
+    InvalidPlistException,
+    readPlist,
+    writePlistToString,
+)
+
+from mobsf.MobSF.utils import is_file_exists
+from mobsf.StaticAnalyzer.views.ios.permission_analysis import (
+    check_permissions,
+)
+from mobsf.StaticAnalyzer.views.ios.app_transport_security import (
+    check_transport_security,
+)
+from mobsf.StaticAnalyzer.views.shared_func import (
+    is_secret,
+)
+
+logger = logging.getLogger(__name__)
+
+
+def convert_bin_xml(bin_xml_file):
+    """Convert Binary XML to Readable XML."""
+    try:
+        plist_obj = readPlist(bin_xml_file)
+        data = writePlistToString(plist_obj)
+        return data
+    except InvalidPlistException:
+        logger.warning('Failed to convert plist')
+
+
+def plist_analysis(src, is_source):
+    """Plist Analysis."""
+    try:
+        logger.info('iOS Info.plist Analysis Started')
+        plist_info = {
+            'bin_name': '',
+            'bin': '',
+            'id': '',
+            'version': '',
+            'build': '',
+            'sdk': '',
+            'pltfm': '',
+            'min': '',
+            'plist_xml': '',
+            'permissions': {},
+            'inseccon': [],
+            'bundle_name': '',
+            'build_version_name': '',
+            'bundle_url_types': [],
+            'bundle_supported_platforms': [],
+            'bundle_version_name': '',
+        }
+        plist_file = None
+        plist_files = []
+        if is_source:
+            logger.info('Finding Info.plist in iOS Source')
+            for dirpath, _dirnames, files in os.walk(src):
+                for name in files:
+                    if (not any(x in dirpath for x in ['__MACOSX', 'Pods'])
+                            and name.endswith('.plist')):
+                        plist_files.append(os.path.join(dirpath, name))
+                        if name == 'Info.plist':
+                            plist_file = os.path.join(dirpath, name)
+        else:
+            logger.info('Finding Info.plist in iOS Binary')
+            dirs = os.listdir(src)
+            dot_app_dir = ''
+            for dir_ in dirs:
+                if dir_.endswith('.app'):
+                    dot_app_dir = dir_
+                    break
+            bin_dir = os.path.join(src, dot_app_dir)  # Full Dir/Payload/x.app
+            plist_file = os.path.join(bin_dir, 'Info.plist')
+            plist_files = [plist_file]
+
+        # Skip Plist Analysis if there is no Info.plist
+        if not plist_file or not is_file_exists(plist_file):
+            logger.warning(
+                'Cannot find Info.plist file. Skipping Plist Analysis.')
+            return plist_info
+
+        # Generic Plist Analysis
+        plist_obj = {}
+        with open(plist_file, 'rb') as fp:
+            plist_obj = load(fp)
+        plist_info['plist_xml'] = dumps(
+            plist_obj).decode('utf-8', 'ignore')
+        plist_info['bin_name'] = (plist_obj.get('CFBundleDisplayName', '')
+                                  or plist_obj.get('CFBundleName', ''))
+        if not plist_info['bin_name'] and not is_source:
+            # For iOS IPA
+            plist_info['bin_name'] = dot_app_dir.replace('.app', '')
+        plist_info['bin'] = plist_obj.get('CFBundleExecutable', '')
+        plist_info['id'] = plist_obj.get('CFBundleIdentifier', '')
+        plist_info['build'] = plist_obj.get('CFBundleVersion', '')
+        plist_info['sdk'] = plist_obj.get('DTSDKName', '')
+        plist_info['pltfm'] = plist_obj.get('DTPlatformVersion', '')
+        plist_info['min'] = plist_obj.get('MinimumOSVersion', '')
+        plist_info['bundle_name'] = plist_obj.get('CFBundleName', '')
+        plist_info['bundle_version_name'] = plist_obj.get(
+            'CFBundleShortVersionString', '')
+        plist_info['bundle_url_types'] = plist_obj.get(
+            'CFBundleURLTypes', [])
+        plist_info['bundle_supported_platforms'] = plist_obj.get(
+            'CFBundleSupportedPlatforms', [])
+        logger.info('Checking Permissions')
+        logger.info('Checking for Insecure Connections')
+        for plist_file_ in plist_files:
+            plist_obj_ = {}
+            with open(plist_file_, 'rb') as fp:
+                plist_obj_ = load(fp)
+            # Check for app-permissions
+            plist_info['permissions'].update(check_permissions(plist_obj_))
+            # Check for ats misconfigurations
+            plist_info['inseccon'] += check_transport_security(plist_obj_)
+        return plist_info
+    except Exception:
+        logger.exception('Reading from Info.plist')
+
+
+def get_plist_secrets(xml_string):
+    """Get possible hardcoded secrets from plist."""
+    result_list = []
+
+    def _remove_tags(data):
+        """Remove tags from input."""
+        return sub('<[^<]+>', '', data).strip()
+
+    xml_list = xml_string.split('\n')
+
+    for index, line in enumerate(xml_list):
+        if '<key>' in line and is_secret(_remove_tags(line)):
+            nxt = index + 1
+            value = (
+                _remove_tags(xml_list[nxt])if nxt < len(xml_list) else False)
+            if value:
+                result_list.append(
+                    f'{_remove_tags(line)} : {_remove_tags(value)}')
+    return result_list

package/MobSF/mobsf/StaticAnalyzer/views/ios/rules/ios_apis.yaml

@@ -0,0 +1,85 @@
+- id: api_network_calls
+  description: Network Calls
+  input_case: exact
+  pattern: URLSession|CFStream|NSStream
+  type: Regex
+  severity: info
+- id: api_keychain_access
+  description: Keychain Access.
+  input_case: exact
+  pattern: Keychain|SecItemAdd|SecItemUpdateSecItemCopy|kSecAttr
+  type: Regex
+  severity: info
+- id: api_webview
+  description: WebView Component
+  input_case: exact
+  pattern: UIWebView|WKWebView
+  type: Regex
+  severity: info
+- id: api_safari_view
+  description: SFSafariViewController Componaent
+  input_case: exact
+  pattern: SFSafariViewController
+  type: Regex
+  severity: info
+- id: api_encryption
+  description: Encryption API
+  input_case: exact
+  severity: info
+  pattern: CommonCrypto|CryptoKit
+  type: Regex
+  severity: info
+- id: api_webview_load
+  description: WebView Load Request
+  input_case: exact
+  pattern:
+    - loadRequest
+    - webView
+  type: RegexAnd
+  severity: info
+- id: api_webview_load_string
+  description: WebView Load HTML String
+  input_case: exact
+  pattern:
+    - loadHTMLString
+    - webView
+  type: RegexAnd
+  severity: info
+- id: api_cookie
+  description: Cookie Storage
+  input_case: exact
+  pattern:
+    - HTTPCookieStorage
+    - shared|sharedHTTPCookieStorage
+  type: RegexAnd
+  severity: info
+- id: api_ui_pasteboard
+  description: UIPasteboard
+  input_case: exact
+  pattern: UIPasteboard
+  type: Regex
+  severity: info
+- id: api_userdefaults
+  description: UserDefaults
+  input_case: exact
+  pattern: UserDefaults
+  type: Regex
+  severity: info
+- id: api_core_data
+  description: CoreData
+  input_case: exact
+  pattern: CoreData
+  type: Regex
+  severity: info
+- id: api_local_auth
+  description: Local Authentication Framework
+  input_case: exact
+  pattern: LAContext
+  type: Regex
+  severity: info
+- id: api_uiactivity_share
+  description: UIActivity Sharing
+  input_case: exact
+  pattern: UIActivity
+  type: Regex
+  severity: info

package/MobSF/mobsf/StaticAnalyzer/views/ios/rules/ipa_rules.py

@@ -0,0 +1,226 @@
+# -*- coding: utf_8 -*-
+"""IPA Binary Analysis Rules."""
+from libsast.standards import get_standards
+
+
+STDS = get_standards()
+IPA_RULES = [
+    {
+        'description': 'Binary makes use of insecure API(s)',
+        'detailed_desc': (
+            'The binary may contain'
+            ' the following insecure API(s) {}.'),
+        'type': 'Regex',
+        'pattern': (
+            rb'\b_alloca\n\b|\b_gets\n\b|\b_memcpy\n\b|\b_printf\n\b|'
+            rb'\b_scanf\n\b|\b_sprintf\n\b|\b_sscanf\n\b|\b_strcat\n\b|'
+            rb'\bStrCat\n\b|\b_strcpy\n\b|\bStrCpy\n\b|\b_strlen\n\b|'
+            rb'\bStrLen\n\b|\b_strncat\n\b|\bStrNCat\n\b|\b_strncpy\n\b|'
+            rb'\bStrNCpy\n\b|\b_strtok\n\b|\b_swprintf\n\b|\b_vsnprintf\n\b|'
+            rb'\b_vsprintf\b|\b_vswprintf\b|\b_wcscat\b|\b_wcscpy\b|'
+            rb'\b_wcslen\n\b|\b_wcsncat\n\b|\b_wcsncpy\n\b|\b_wcstok\n\b|'
+            rb'\b_wmemcpy\n\b|\b_fopen\n\b|\b_chmod\n\b|\b_chown\n\b|'
+            rb'\b_stat\n\b|\b_mktemp\n\b'),
+        'severity': 'high',
+        'input_case': 'exact',
+        'cvss': 6,
+        'cwe': STDS['cwe']['cwe-676'],
+        'owasp-mobile': STDS['owasp-mobile']['m7'],
+        'masvs': STDS['masvs']['code-8'],
+    },
+    {
+        'description': 'Binary makes use of some weak Crypto API(s)',
+        'detailed_desc': (
+            'The binary may use the'
+            ' following weak crypto API(s) {}.'),
+        'type': 'Regex',
+        'pattern': (
+            rb'\bkCCAlgorithmDES\b|'
+            rb'\bkCCAlgorithm3DES\b|'
+            rb'\bkCCAlgorithmRC2\b|'
+            rb'\bkCCAlgorithmRC4\b|'
+            rb'\bkCCOptionECBMode\b|'
+            rb'\bkCCOptionCBCMode\b'),
+        'severity': 'high',
+        'input_case': 'exact',
+        'cvss': 3,
+        'cwe': STDS['cwe']['cwe-327'],
+        'owasp-mobile': STDS['owasp-mobile']['m5'],
+        'masvs': STDS['masvs']['crypto-3'],
+    },
+    {
+        'description': 'Binary makes use of the following Crypto API(s)',
+        'detailed_desc': (
+            'The binary may use '
+            'the following crypto API(s) {}.'),
+        'type': 'Regex',
+        'pattern': (
+            rb'\bCCKeyDerivationPBKDF\b|\bCCCryptorCreate\b|\b'
+            rb'CCCryptorCreateFromData\b|\b'
+            rb'CCCryptorRelease\b|\bCCCryptorUpdate\b|\bCCCryptorFinal\b|\b'
+            rb'CCCryptorGetOutputLength\b|\bCCCryptorReset\b|\b'
+            rb'CCCryptorRef\b|\bkCCEncrypt\b|\b'
+            rb'kCCDecrypt\b|\bkCCAlgorithmAES128\b|\bkCCKeySizeAES128\b|\b'
+            rb'kCCKeySizeAES192\b|\b'
+            rb'kCCKeySizeAES256\b|\bkCCAlgorithmCAST\b|\b'
+            rb'SecCertificateGetTypeID\b|\b'
+            rb'SecIdentityGetTypeID\b|\bSecKeyGetTypeID\b|\b'
+            rb'SecPolicyGetTypeID\b|\b'
+            rb'SecTrustGetTypeID\b|\bSecCertificateCreateWithData\b|\b'
+            rb'SecCertificateCreateFromData\b|\bSecCertificateCopyData\b|\b'
+            rb'SecCertificateAddToKeychain\b|\bSecCertificateGetData\b|\b'
+            rb'SecCertificateCopySubjectSummary\b|\b'
+            rb'SecIdentityCopyCertificate\b|\b'
+            rb'SecIdentityCopyPrivateKey\b|\bSecPKCS12Import\b|\b'
+            rb'SecKeyGeneratePair\b|\b'
+            rb'SecKeyEncrypt\b|\bSecKeyDecrypt\b|\bSecKeyRawSign\b|\b'
+            rb'SecKeyRawVerify\b|\b'
+            rb'SecKeyGetBlockSize\b|\bSecPolicyCopyProperties\b|\b'
+            rb'SecPolicyCreateBasicX509\b|\bSecPolicyCreateSSL\b|\b'
+            rb'SecTrustCopyCustomAnchorCertificates\b|\b'
+            rb'SecTrustCopyExceptions\b|\b'
+            rb'SecTrustCopyProperties\b|\bSecTrustCopyPolicies\b|\b'
+            rb'SecTrustCopyPublicKey\b|\bSecTrustCreateWithCertificates\b|\b'
+            rb'SecTrustEvaluate\b|\bSecTrustEvaluateAsync\b|\b'
+            rb'SecTrustGetCertificateCount\b|\b'
+            rb'SecTrustGetCertificateAtIndex\b|\b'
+            rb'SecTrustGetTrustResult\b|\bSecTrustGetVerifyTime\b|\b'
+            rb'SecTrustSetAnchorCertificates\b|\b'
+            rb'SecTrustSetAnchorCertificatesOnly\b|\b'
+            rb'SecTrustSetExceptions\b|\bSecTrustSetPolicies\b|\b'
+            rb'SecTrustSetVerifyDate\b|\bSecCertificateRef\b|\b'
+            rb'SecIdentityRef\b|\bSecKeyRef\b|\bSecPolicyRef\b|\b'
+            rb'SecTrustRef\b'),
+        'severity': 'info',
+        'input_case': 'exact',
+        'cvss': 0,
+        'cwe': '',
+        'owasp-mobile': '',
+        'masvs': '',
+    },
+    {
+        'description': 'Binary makes use of some weak Hashing API(s)',
+        'detailed_desc': (
+            'The binary may use the '
+            'following weak hash API(s) {}.'),
+        'type': 'Regex',
+        'pattern': (
+            rb'\bCC_MD2_Init\b|\bCC_MD2_Update\b|\b'
+            rb'CC_MD2_Final\b|\bCC_MD2\b|\bMD2_Init\b|\b'
+            rb'MD2_Update\b|\bMD2_Final\b|\bCC_MD4_Init\b|\b'
+            rb'CC_MD4_Update\b|\bCC_MD4_Final\b|\b'
+            rb'CC_MD4\b|\bMD4_Init\b|\bMD4_Update\b|\b'
+            rb'MD4_Final\b|\bCC_MD5_Init\b|\bCC_MD5_Update'
+            rb'\b|\bCC_MD5_Final\b|\bCC_MD5\b|\bMD5_Init\b|\b'
+            rb'MD5_Update\b|\bMD5_Final\b|\bMD5Init\b|\b'
+            rb'MD5Update\b|\bMD5Final\b|\bCC_SHA1_Init\b|\b'
+            rb'CC_SHA1_Update\b|\b'
+            rb'CC_SHA1_Final\b|\bCC_SHA1\b|\bSHA1_Init\b|\b'
+            rb'SHA1_Update\b|\bSHA1_Final\b'),
+        'severity': 'high',
+        'input_case': 'exact',
+        'cvss': 3,
+        'cwe': STDS['cwe']['cwe-327'],
+        'owasp-mobile': STDS['owasp-mobile']['m5'],
+        'masvs': STDS['masvs']['crypto-4'],
+    },
+    {
+        'description': 'Binary makes use of the following Hash API(s)',
+        'detailed_desc': (
+            'The binary may use the'
+            ' following hash API(s) {}.'),
+        'type': 'Regex',
+        'pattern': (
+            rb'\bCC_SHA224_Init\b|\bCC_SHA224_Update\b|\b'
+            rb'CC_SHA224_Final\b|\bCC_SHA224\b|\b'
+            rb'SHA224_Init\b|\bSHA224_Update\b|\b'
+            rb'SHA224_Final\b|\bCC_SHA256_Init\b|\b'
+            rb'CC_SHA256_Update\b|\bCC_SHA256_Final\b|\b'
+            rb'CC_SHA256\b|\bSHA256_Init\b|\b'
+            rb'SHA256_Update\b|\bSHA256_Final\b|\b'
+            rb'CC_SHA384_Init\b|\bCC_SHA384_Update\b|\b'
+            rb'CC_SHA384_Final\b|\bCC_SHA384\b|\b'
+            rb'SHA384_Init\b|\bSHA384_Update\b|\b'
+            rb'SHA384_Final\b|\bCC_SHA512_Init\b|\b'
+            rb'CC_SHA512_Update\b|\bCC_SHA512_Final\b|\b'
+            rb'CC_SHA512\b|\bSHA512_Init\b|\b'
+            rb'SHA512_Update\b|\bSHA512_Final\b'),
+        'severity': 'info',
+        'input_case': 'exact',
+        'cvss': 0,
+        'cwe': '',
+        'owasp-mobile': '',
+        'masvs': '',
+    },
+    {
+        'description': 'Binary makes use of the insecure Random function(s)',
+        'detailed_desc': (
+            'The binary may use the following '
+            'insecure Random function(s) {}.'),
+        'type': 'Regex',
+        'pattern': rb'\b_srand\n\b|\b_random\n\b',
+        'severity': 'high',
+        'input_case': 'exact',
+        'cvss': 3,
+        'cwe': STDS['cwe']['cwe-330'],
+        'owasp-mobile': STDS['owasp-mobile']['m5'],
+        'masvs': STDS['masvs']['crypto-6'],
+    },
+    {
+        'description': 'Binary makes use of Logging function',
+        'detailed_desc': (
+            'The binary may use {}'
+            ' function for logging.'),
+        'type': 'Regex',
+        'pattern': rb'\b_NSLog\n\b',
+        'severity': 'info',
+        'input_case': 'exact',
+        'cvss': 7.5,
+        'cwe': STDS['cwe']['cwe-532'],
+        'owasp-mobile': '',
+        'masvs': STDS['masvs']['storage-3'],
+    },
+    {
+        'description': 'Binary makes use of malloc function',
+        'detailed_desc': (
+            'The binary may use {}'
+            ' function instead of calloc.'),
+        'type': 'Regex',
+        'pattern': rb'_malloc\n',
+        'severity': 'high',
+        'input_case': 'exact',
+        'cvss': 2,
+        'cwe': STDS['cwe']['cwe-789'],
+        'owasp-mobile': STDS['owasp-mobile']['m7'],
+        'masvs': STDS['masvs']['code-8'],
+    },
+    {
+        'description': 'Binary calls ptrace() function for anti-debugging.',
+        'detailed_desc': (
+            'The binary may use ptrace() function. It can be'
+            ' used to detect and prevent debuggers.'
+            ' Ptrace is not a public API and apps that'
+            ' use non-public APIs will be rejected'
+            ' from AppStore.'),
+        'type': 'Regex',
+        'pattern': rb'\b_ptrace\b',
+        'severity': 'warning',
+        'input_case': 'exact',
+        'cvss': 0,
+        'cwe': '',
+        'owasp-mobile': STDS['owasp-mobile']['m7'],
+        'masvs': STDS['masvs']['resilience-2'],
+    },
+    {
+        'description': 'Binary uses WebView Component.',
+        'detailed_desc': 'The binary may use UIWebView Component.',
+        'type': 'Regex',
+        'pattern': b'UIWebView',
+        'severity': 'info',
+        'input_case': 'exact',
+        'cvss': 0,
+        'cwe': '',
+        'owasp-mobile': '',
+        'masvs': STDS['masvs']['code-9'],
+    },
+]