MobSF/Mobile-Security-Framework-MobSF
1
0
Fork 0
mirror of https://github.com/MobSF/Mobile-Security-Framework-MobSF.git synced 2026-10-12 02:06:59 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
3eadf6cc0af53eb327ab4ddd5dcb8ecd8f403850
Mobile-Security-Framework-M…/mobsf/StaticAnalyzer/views/android/rules/android_rules.yaml
T
EljeesandAjin Abraham 3eadf6cc0a fix(rules): match the literal mode argument in getSharedPreferences (#2638) 
The world readable/writable patterns matched any argument list ending with 1 or 2, so decompiled identifiers such as var1, var2 or mode2 were reported as world permissions.

Signed-off-by: Eljees <[email protected]>
Co-authored-by: Ajin Abraham <[email protected]>
2026-08-09 16:57:21 -07:00

787 lines
25 KiB
YAML
Raw Blame History

- id: android_ip_disclosure
message: IP Address disclosure
type: Regex
pattern: '(?<![.\d])(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])(?![.\d])'
severity: warning
input_case: exact
metadata:
cvss: 4.3
cwe: cwe-200
owasp-mobile: ''
masvs: code-2
- id: android_hiddenui
message: >-
Hidden elements in view can be used to hide data from user. But this data
can be leaked
type: Regex
pattern: setVisibility\(View\.GONE\)|setVisibility\(View\.INVISIBLE\)
severity: high
input_case: exact
metadata:
cvss: 4.3
cwe: cwe-919
owasp-mobile: m1
masvs: storage-7
- id: android_insecure_ssl
message: >-
Insecure Implementation of SSL. Trusting all the certificates or accepting
self signed certificates is a critical Security Hole. This application is
vulnerable to MITM attacks
type: RegexAnd
pattern:
- javax\.net\.ssl
- >-
TrustAllSSLSocket-Factory|AllTrustSSLSocketFactory|NonValidatingSSLSocketFactory|net\.SSLCertificateSocketFactory|ALLOW_ALL_HOSTNAME_VERIFIER|\.setDefaultHostnameVerifier\(|NullHostnameVerifier\(
severity: high
input_case: exact
metadata:
cvss: 7.4
cwe: cwe-295
owasp-mobile: m3
masvs: network-3
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#android-network-apis
- id: android_webview_external
message: >-
WebView load files from external storage. Files in external storage can be
modified by any application.
type: RegexAnd
pattern:
- \.loadUrl\(.{0,48}getExternalStorageDirectory\(
- webkit\.WebView
severity: high
input_case: exact
metadata:
cvss: 5
cwe: cwe-919
owasp-mobile: m1
masvs: platform-6
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-7
- id: android_write_app_dir
message: App can write to App Directory. Sensitive Information should be encrypted.
type: RegexOr
pattern:
- MODE_PRIVATE
- Context\.MODE_PRIVATE
severity: info
input_case: exact
metadata:
cvss: 3.9
cwe: cwe-276
owasp-mobile: ''
masvs: storage-14
- id: android_insecure_random
message: The App uses an insecure Random Number Generator.
type: Regex
pattern: java\.util\.Random(?!Access)
severity: warning
input_case: exact
metadata:
cvss: 7.5
cwe: cwe-330
owasp-mobile: m5
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-random-number-generators
masvs: crypto-6
- id: android_logging
message: The App logs information. Sensitive information should never be logged.
type: Regex
pattern: Log\.(v|d|i|w|e|f|s)|System\.out\.print|System\.err\.print
severity: info
input_case: exact
metadata:
cvss: 7.5
cwe: cwe-532
owasp-mobile: ''
masvs: storage-3
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#logs
- id: android_sql_cipher
message: This App uses SQL Cipher. Ensure that secrets are not hardcoded in code.
type: Regex
pattern: SQLiteOpenHelper\.getWritableDatabase\(
severity: info
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
masvs: crypto-1
- id: android_tapjacking
message: This app has capabilities to prevent tapjacking attacks.
type: Regex
pattern: setFilterTouchesWhenObscured\(true\)
severity: good
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
masvs: platform-9
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#testing-for-overlay-attacks-mstg-platform-9
- id: android_read_write_external
message: >-
App can read/write to External Storage. Any App can read data written to
External Storage.
type: RegexOr
pattern:
- \.getExternalStorage
- \.getExternalFilesDir\(
severity: warning
input_case: exact
metadata:
cvss: 5.5
cwe: cwe-276
owasp-mobile: m2
masvs: storage-2
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#external-storage
- id: android_temp_file
message: >-
App creates temp file. Sensitive information should never be written into a
temp file.
type: Regex
pattern: \.createTempFile\(
severity: warning
input_case: exact
metadata:
cvss: 5.5
cwe: cwe-276
owasp-mobile: m2
masvs: storage-2
- id: android_webview
message: >-
Insecure WebView Implementation. Execution of user controlled code in
WebView is a critical Security Hole.
type: RegexAnd
pattern:
- setJavaScriptEnabled\(true\)
- addJavascriptInterface\(
severity: warning
input_case: exact
metadata:
cvss: 8.8
cwe: cwe-749
owasp-mobile: m1
masvs: platform-7
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#testing-javascript-execution-in-webviews-mstg-platform-5
- id: android_webview_allow_file_from_url
message: >-
Ensure that user controlled URLs never reaches the Webview. Enabling file access
from URLs in WebView can leak sensitive information from the file system.
type: RegexAndOr
pattern:
- setJavaScriptEnabled\(true\)
- - \.setAllowFileAccessFromFileURLs\(true\)
- \.setAllowUniversalAccessFromFileURLs\(true\)
severity: warning
input_case: exact
metadata:
cvss: 6.1
cwe: cwe-200
owasp-mobile: m1
masvs: platform-7
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05h-Testing-Platform-Interaction.md#static-analysis-6
- id: android_sql_cipher_aes256
message: >-
This App uses SQL Cipher. SQLCipher provides 256-bit AES encryption to
sqlite database files.
type: RegexAnd
pattern:
- SQLiteDatabase\.loadLibs\(
- net\.sqlcipher\.
severity: info
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
masvs: crypto-1
- id: android_download_manager
message: This App download files using Android Download Manager
type: RegexAnd
pattern:
- android\.app\.DownloadManager
- getSystemService\(DOWNLOAD_SERVICE\)
severity: info
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
masvs: ''
- id: android_db_encryption
message: This App use Realm Database with encryption.
type: RegexAnd
pattern:
- io\.realm\.Realm
- \.encryptionKey\(
severity: good
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
masvs: crypto-1
- id: android_webview_debug
message: Remote WebView debugging is enabled.
type: RegexAnd
pattern:
- \.setWebContentsDebuggingEnabled\(true\)
- WebView
severity: high
input_case: exact
metadata:
cvss: 5.4
cwe: cwe-919
owasp-mobile: m1
masvs: resilience-2
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04c-Tampering-and-Reverse-Engineering.md#debugging-and-tracing
- id: android_aar_jar_debug_enabled
message: Debug configuration enabled. Production builds must not be debuggable.
type: RegexAnd
pattern:
- ' class BuildConfig'
- DEBUG.{1,25}?true
severity: high
input_case: exact
metadata:
cvss: 5.4
cwe: cwe-919
owasp-mobile: m1
masvs: resilience-2
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04c-Tampering-and-Reverse-Engineering.md#debugging-and-tracing
- id: android_clipboard_listen
message: >-
This app listens to Clipboard changes. Some malware also listen to
Clipboard changes.
type: RegexAnd
pattern:
- content\.ClipboardManager
- OnPrimaryClipChangedListener
severity: info
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04b-Mobile-App-Security-Testing.md#clipboard
masvs: platform-4
- id: android_clipboard_copy
message: >-
This App copies data to clipboard. Sensitive data should not be copied to
clipboard as other applications can access it.
type: RegexAnd
pattern:
- content\.ClipboardManager
- setPrimaryClip\(
severity: info
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
masvs: storage-10
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04b-Mobile-App-Security-Testing.md#clipboard
- id: android_webview_ignore_ssl
message: >-
Insecure WebView Implementation. WebView ignores SSL Certificate errors and
accept any SSL Certificate. This application is vulnerable to MITM attacks
type: RegexAnd
pattern:
- onReceivedSslError\(WebView
- \.proceed\(\);
severity: high
input_case: exact
metadata:
cvss: 7.4
cwe: cwe-295
owasp-mobile: m3
masvs: network-3
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#webview-server-certificate-verification
- id: android_webview_mixed_content
message: >-
Insecure WebView Implementation. WebView is configured with
MIXED_CONTENT_ALWAYS_ALLOW, allowing a page loaded over HTTPS to load
content from insecure HTTP origins. This exposes the application to
man-in-the-middle content injection.
type: Regex
pattern: setMixedContentMode\(.{0,48}MIXED_CONTENT_ALWAYS_ALLOW
severity: high
input_case: exact
metadata:
cvss: 7.4
cwe: cwe-319
owasp-mobile: m3
masvs: network-1
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md
- id: android_sql_raw_query
message: >-
App uses SQLite Database and execute raw SQL query. Untrusted user input in
raw SQL queries can cause SQL Injection. Also sensitive information should
be encrypted and written to the database.
type: RegexAndOr
pattern:
- android\.database\.sqlite
- - rawQuery\(
- execSQL\(
severity: warning
input_case: exact
metadata:
cvss: 5.9
cwe: cwe-89
owasp-mobile: m7
masvs: ''
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04h-Testing-Code-Quality.md#injection-flaws-mstg-arch-2-and-mstg-platform-2
- id: android_detect_frida
message: This App detects frida server.
type: RegexAndOr
pattern:
- fridaserver
- - '27047'
- REJECT
- LIBFRIDA
severity: good
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
masvs: resilience-4
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05j-Testing-Resiliency-Against-Reverse-Engineering.md#testing-reverse-engineering-tools-detection-mstg-resilience-4
- id: android_ssl_pinning
message: >-
This App uses SSL certificate pinning to detect or
prevent MITM attacks in secure communication channel.
type: RegexAndOr
pattern:
- org\.thoughtcrime\.ssl\.pinning|\.getTrustManagers\(|TrustManagerFactory\.|CertificatePinner\.Builder\(|Retrofit\.Builder\(|Picasso\.Builder\(|\.setHostnameVerifier\(
- - PinningHelper\.getPinnedHttpsURLConnection|PinningHelper\.getPinnedHttpClient|PinningSSLSocketFactory\(
- \.setCertificateEntry\(|trustedChain|\.init\(
- \.add\(
- \.baseUrl\(
- \.downloader\(
- PinningHostnameVerifier\(|\.verify\(|DynamicPinningHostnameVerifier\(
severity: good
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
masvs: network-4
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-4
- id: android_certificate_transparency
message: >-
This App enforce TLS Certificate Transparency which helps to
detect SSL certificates that have been mistakenly issued by a
certificate authority or maliciously acquired from an otherwise
unimpeachable certificate authority.
type: RegexAnd
pattern:
- CTHostnameVerifierBuilder\(
- CTInterceptorBuilder\(
severity: good
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
masvs: network-4
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md#testing-custom-certificate-stores-and-certificate-pinning-mstg-network-4
- id: android_prevent_screenshot
message: >-
This App has capabilities to prevent against Screenshots from Recent Task
History/ Now On Tap etc.
type: RegexAndOr
pattern:
- \.FLAG_SECURE
- - getWindow\(\)\.setFlags\(
- getWindow\(\)\.addFlags\(
severity: good
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
masvs: storage-9
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#finding-sensitive-information-in-auto-generated-screenshots-mstg-storage-9
- id: android_debuggable
message: >-
DexGuard Debug Detection code to detect whether an App is debuggable or not
is identified.
type: RegexAnd
pattern:
- import dexguard\.util
- DebugDetector\.isDebuggable
severity: good
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
masvs: resilience-2
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04c-Tampering-and-Reverse-Engineering.md#debugging-and-tracing
- id: android_debugger_detect
message: DexGuard Debugger Detection code is identified.
type: RegexAnd
pattern:
- import dexguard\.util
- DebugDetector\.isDebuggerConnected
severity: good
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
masvs: resilience-2
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04c-Tampering-and-Reverse-Engineering.md#debugging-and-tracing
- id: android_emulator_detect
message: DexGuard Emulator Detection code is identified.
type: RegexAnd
pattern:
- import dexguard\.util
- EmulatorDetector\.isRunningInEmulator
severity: good
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
masvs: resilience-5
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04c-Tampering-and-Reverse-Engineering.md#debugging-and-tracing
- id: android_debug_sign
message: >-
DexGuard code to detect whether the App is signed with a debug key or not is
identified.
type: RegexAnd
pattern:
- import dexguard\.util
- DebugDetector\.isSignedWithDebugKey
severity: good
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
masvs: code-2
- id: android_dexguard_root_detection
message: DexGuard Root Detection code is identified.
type: RegexAnd
pattern:
- import dexguard\.util
- RootDetector\.isDeviceRooted
severity: good
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
masvs: resilience-1
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05j-Testing-Resiliency-Against-Reverse-Engineering.md#testing-root-detection-mstg-resilience-1
- id: android_tamper_detect
message: DexGuard App Tamper Detection code is identified.
type: RegexAnd
pattern:
- import dexguard\.util
- TamperDetector\.checkApk
severity: good
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
masvs: resilience-3
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04c-Tampering-and-Reverse-Engineering.md#mobile-app-tampering-and-reverse-engineering
- id: android_certificate_tamper
message: DexGuard Signer Certificate Tamper Detection code is identified.
type: RegexAnd
pattern:
- import dexguard\.util
- CertificateChecker\.checkCertificate
severity: good
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
masvs: resilience-3
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04c-Tampering-and-Reverse-Engineering.md#mobile-app-tampering-and-reverse-engineering
- id: android_package_tamper
message: The App may use package signature for tamper detection.
type: RegexAnd
pattern:
- PackageManager\.GET_SIGNATURES
- getPackageName\(
severity: good
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
masvs: resilience-3
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04c-Tampering-and-Reverse-Engineering.md#mobile-app-tampering-and-reverse-engineering
- id: android_safetynet
message: This App uses SafetyNet API.
type: Regex
pattern: com.google\.android\.gms\.safetynet\.SafetyNetApi
severity: good
input_case: exact
metadata:
cvss: 0
cwe: ''
owasp-mobile: ''
masvs: resilience-7
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05j-Testing-Resiliency-Against-Reverse-Engineering.md#safetynet
- id: android_su_detect
message: This App may request root (Super User) privileges.
type: RegexOr
pattern:
- com\.noshufou\.android\.su
- com\.thirdparty\.superuser
- eu\.chainfire\.supersu
- com\.koushikdutta\.superuser
- eu\.chainfire\.
- com\.saurik\.substrate
- de\.robv\.android\.xposed\.installer
severity: warning
input_case: exact
metadata:
cvss: 0
cwe: cwe-250
owasp-mobile: ''
masvs: resilience-1
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05j-Testing-Resiliency-Against-Reverse-Engineering.md#testing-root-detection-mstg-resilience-1
- id: android_jackson_deserialize
message: >-
The app uses jackson deserialization library. Deserialization of untrusted
input can result in arbitrary code execution.
type: RegexAnd
pattern:
- com\.fasterxml\.jackson\.databind\.ObjectMapper
- \.enableDefaultTyping\(
severity: high
input_case: exact
metadata:
cvss: 7.5
cwe: cwe-502
owasp-mobile: m7
masvs: platform-8
- id: android_aes_ecb
message: >-
The App uses ECB mode in Cryptographic encryption algorithm. ECB mode is
known to be weak as it results in the same ciphertext for identical blocks
of plaintext.
type: Regex
pattern: Cipher\.getInstance\(\s*"\s*AES\/ECB
severity: high
input_case: exact
metadata:
cvss: 5.9
cwe: cwe-327
owasp-mobile: m5
masvs: crypto-2
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-block-cipher-mode
- id: android_aws_ecb_default
message: >-
Calling Cipher.getInstance("AES") will return AES ECB mode by default. ECB mode is
known to be weak as it results in the same ciphertext for identical blocks
of plaintext.
type: Regex
pattern: Cipher\.getInstance\("AES"\)
severity: high
input_case: exact
metadata:
cvss: 5.9
cwe: cwe-327
owasp-mobile: m5
masvs: crypto-2
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#weak-block-cipher-mode
- id: android_rsa_no_oaep
message: >-
This App uses RSA Crypto without OAEP padding. The purpose of the padding
scheme is to prevent a number of attacks on RSA that only work when the
encryption is performed without padding.
type: Regex
pattern: Cipher\.getinstance\(\"rsa/.{1,48}/nopadding
severity: high
input_case: lower
metadata:
cvss: 5.9
cwe: cwe-780
owasp-mobile: m5
masvs: crypto-3
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#mobile-app-cryptography
- id: android_world_writable
message: The file or SharedPreference is World Writable. Any App can write to the file
type: RegexOr
pattern:
- MODE_WORLD_WRITABLE
- \.getSharedPreferences\([^)]{0,50}?,\s*2\s*\)
- 'openFileOutput\(\s*".{1,48}"\s*,\s*2\s*\)'
severity: high
input_case: exact
metadata:
cvss: 6
cwe: cwe-276
owasp-mobile: m2
masvs: storage-2
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#testing-local-storage-for-sensitive-data-mstg-storage-1-and-mstg-storage-2
- id: android_world_readable
message: The file or SharedPreference is World Readable. Any App can read from the file
type: RegexOr
pattern:
- MODE_WORLD_READABLE
- \.getSharedPreferences\([^)]{0,50}?,\s*1\s*\)
- 'openFileOutput\(\s*".{1,48}"\s*,\s*1\s*\)'
severity: high
input_case: exact
metadata:
cvss: 4
cwe: cwe-276
owasp-mobile: m2
masvs: storage-2
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#testing-local-storage-for-sensitive-data-mstg-storage-1-and-mstg-storage-2
- id: android_world_read_write
message: The file is World Readable and Writable. Any App can read/write to the file
type: Regex
pattern: 'openFileOutput\(\s*".{1,48}"\s*,\s*3\s*\)'
severity: high
input_case: exact
metadata:
cvss: 6
cwe: cwe-276
owasp-mobile: m2
masvs: storage-2
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#testing-local-storage-for-sensitive-data-mstg-storage-1-and-mstg-storage-2
- id: android_weak_hash
message: Weak Hash algorithm used
type: RegexOr
input_case: exact
pattern:
- \.getInstance\(.{0,48}md4
- \.getInstance\(.{0,48}MD4
severity: high
metadata:
cvss: 7.4
cwe: cwe-327
masvs: crypto-4
owasp-mobile: m5
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4
- id: android_weak_ciphers
message: Weak Encryption algorithm used
input_case: exact
pattern:
- \.getInstance\(.{0,48}rc2
- \.getInstance\(.{0,48}RC2
- \.getInstance\(.{0,48}rc4
- \.getInstance\(.{0,48}RC4
- \.getInstance\(.{0,48}blowfish
- \.getInstance\(.{0,48}BLOWFISH
- Cipher\.getInstance\(.{0,48}DES
- Cipher\.getInstance\(.{0,48}des
severity: high
type: RegexOr
metadata:
cvss: 7.4
cwe: cwe-327
masvs: crypto-4
owasp-mobile: m5
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4
- id: cbc_padding_oracle
message: The App uses the encryption mode CBC with PKCS5/PKCS7 padding. This configuration is vulnerable to padding oracle attacks.
input_case: exact
pattern:
- \.getInstance\(.{0,48}\/CBC\/PKCS5Padding
- \.getInstance\(.{0,48}\/CBC\/PKCS7Padding
severity: high
type: RegexOr
metadata:
cvss: 7.4
cwe: cwe-649
masvs: crypto-3
owasp-mobile: m5
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4
- id: android_md5
message: MD5 is a weak hash known to have hash collisions.
input_case: exact
pattern:
- \.getInstance\(.{0,48}MD5
- \.getInstance\(.{0,48}md5
- DigestUtils\.md5\(
severity: warning
type: RegexOr
metadata:
cvss: 7.4
cwe: cwe-327
masvs: crypto-4
owasp-mobile: m5
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4
- id: android_sha1
message: SHA-1 is a weak hash known to have hash collisions.
input_case: exact
pattern:
- \.getInstance\(.{0,48}SHA-1
- \.getInstance\(.{0,48}sha-1
- \.getInstance\(.{0,48}SHA1
- \.getInstance\(.{0,48}sha1
- DigestUtils\.sha\(
severity: warning
type: RegexOr
metadata:
cvss: 5.9
cwe: cwe-327
masvs: crypto-4
owasp-mobile: m5
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4
- id: android_weak_iv
message: >-
The App may use weak IVs like "0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00" or
"0x01,0x02,0x03,0x04,0x05,0x06,0x07". Not using a random IV makes the
resulting ciphertext much more predictable and susceptible to a dictionary
attack.
input_case: exact
pattern:
- '0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00'
- '0x01,0x02,0x03,0x04,0x05,0x06,0x07'
severity: high
type: RegexOr
metadata:
cvss: 9.8
cwe: cwe-329
masvs: crypto-3
owasp-mobile: m5
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#mobile-app-cryptography
- id: android_detect_root
message: This App may have root detection capabilities.
input_case: exact
pattern:
- \.contains\("test-keys"\)
- \/system\/app\/Superuser.apk
- isDeviceRooted\(\)
- \/system\/bin\/failsafe\/su
- \/system\/bin\/su
- \/system\/xbin\/su
- \/sbin\/su
- \/system\/sd\/xbin\/su
- '"\/system\/xbin\/which", "su"'
- RootTools\.isAccessGiven\(\)
severity: good
type: RegexOr
metadata:
cvss: 0
cwe: ''
masvs: resilience-1
owasp-mobile: ''
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05j-Testing-Resiliency-Against-Reverse-Engineering.md#testing-root-detection-mstg-resilience-1
- id: android_hardcoded
message: >-
Files may contain hardcoded sensitive information like usernames,
passwords, keys etc.
input_case: lower
pattern: >-
(password\s*=\s*[\'|\"].{1,100}[\'|\"]\s{0,5})|(pass\s*=\s*[\'|\"].{1,100}[\'|\"]\s{0,5})|(username\s*=\s*[\'|\"].{1,100}[\'|\"]\s{0,5})|(secret\s*=\s*[\'|\"].{1,100}[\'|\"]\s{0,5})|(key\s*=\s*[\'|\"].{1,100}[\'|\"]\s{0,5})
severity: warning
type: Regex
metadata:
cvss: 7.4
cwe: cwe-312
masvs: storage-14
owasp-mobile: m9
ref: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#checking-memory-for-sensitive-data-mstg-storage-10
Reference in New Issue View Git Blame Copy Permalink