diff --git a/best-practices/MASTG-BEST-0007.md b/best-practices/MASTG-BEST-0007.md index 208eab4d6eb..78ef1992b97 100644 --- a/best-practices/MASTG-BEST-0007.md +++ b/best-practices/MASTG-BEST-0007.md @@ -8,4 +8,4 @@ knowledge: [MASTG-KNOW-0007] Ensure the debuggable flag in the AndroidManifest.xml is set to `false` for all release builds. -**Note:** Disabling debugging via the `debuggable` flag is an important first step but does not fully protect the app from advanced attacks. Skilled attackers can enable debugging through various means, such as binary patching (see @MASTG-TECH-0038) to allow attachment of a debugger or the use of binary instrumentation tools like @MASTG-TOOL-0001 to achieve similar capabilities. For apps requiring a higher level of security, consider implementing anti-debugging techniques as an additional layer of defense. Refer to @MASWE-0101 for detailed guidance. +**Note:** Disabling debugging via the `debuggable` flag is an important first step but does not fully protect the app from advanced attacks. Skilled attackers can enable debugging through various means, such as binary patching (see @MASTG-TECH-0038) to allow attachment of a debugger or the use of binary instrumentation tools like @MASTG-TOOL-0001 to achieve similar capabilities. For apps requiring a higher level of security, consider implementing anti-debugging techniques as an additional layer of defense. Refer to @MASWE-0064 for detailed guidance. diff --git a/knowledge/android/MASVS-NETWORK/MASTG-KNOW-0015.md b/knowledge/android/MASVS-NETWORK/MASTG-KNOW-0015.md index 8305af0e627..66b3d312bf9 100644 --- a/knowledge/android/MASVS-NETWORK/MASTG-KNOW-0015.md +++ b/knowledge/android/MASVS-NETWORK/MASTG-KNOW-0015.md @@ -6,7 +6,7 @@ title: Certificate Pinning [Certificate pinning](../../../Document/0x04f-Testing-Network-Communication.md#restricting-trust-identity-pinning) can be employed in Android apps to safeguard against Machine-in-the-Middle (MITM) attacks by ensuring that the app communicates exclusively with remote endpoints possessing specific identities. -While effective when implemented correctly, insecure implementations potentially enable attackers to read and modify all communication. For more general details on pinning, refer to @MASWE-0047. +While effective when implemented correctly, insecure implementations potentially enable attackers to read and modify all communication. For more general details on pinning, refer to @MASWE-0028. Several approaches to certificate pinning exist, depending on the app's API level and the libraries used. Below, we highlight the most common methods. For a deeper dive into the specific implementations, see ["Deep Dive into Certificate Pinning on Android"](https://securevale.blog/articles/deep-dive-into-certificate-pinning-on-android/). diff --git a/knowledge/ios/MASVS-NETWORK/MASTG-KNOW-0072.md b/knowledge/ios/MASVS-NETWORK/MASTG-KNOW-0072.md index c09807a2037..2bbe6c77ce6 100644 --- a/knowledge/ios/MASVS-NETWORK/MASTG-KNOW-0072.md +++ b/knowledge/ios/MASVS-NETWORK/MASTG-KNOW-0072.md @@ -27,7 +27,7 @@ References: [Certificate pinning](../../../Document/0x04f-Testing-Network-Communication.md#restricting-trust-identity-pinning) allows an iOS app to reject certificates that don't match a specific expected identity, guarding against Machine-in-the-Middle (MITM) attacks even when an attacker controls a CA that is trusted by the system. -Because pinning is layered on top of standard HTTPS, it does not weaken the underlying TLS connection. The risk lies in misconfiguration rather than in the mechanism itself. If pins are not maintained correctly, for example pinning a public key without providing a backup pin, or failing to update the pinned values before the server's certificate or key is rotated, the app will reject otherwise valid connections and break communication with the affected endpoints. This makes pinning misconfiguration an availability risk for the APIs the app depends on. For more general details on pinning, refer to @MASWE-0047. +Because pinning is layered on top of standard HTTPS, it does not weaken the underlying TLS connection. The risk lies in misconfiguration rather than in the mechanism itself. If pins are not maintained correctly, for example pinning a public key without providing a backup pin, or failing to update the pinned values before the server's certificate or key is rotated, the app will reject otherwise valid connections and break communication with the affected endpoints. This makes pinning misconfiguration an availability risk for the APIs the app depends on. For more general details on pinning, refer to @MASWE-0028. **Important Considerations:** diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0326.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0326.md index 8ea0ad130e8..38dbf37b44b 100644 --- a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0326.md +++ b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0326.md @@ -4,7 +4,7 @@ title: References to APIs Allowing Fallback to Non-Biometric Authentication id: MASTG-TEST-0326 apis: [BiometricPrompt, BiometricManager.Authenticators, setAllowedAuthenticators] type: [static, code] -weakness: MASWE-0045 +weakness: MASWE-0021 profiles: [L2] knowledge: [MASTG-KNOW-0001] best-practices: [MASTG-BEST-0031] diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0327.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0327.md index 7812f6d94f2..033a2df3c30 100644 --- a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0327.md +++ b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0327.md @@ -4,7 +4,7 @@ title: References to APIs for Event-Bound Biometric Authentication id: MASTG-TEST-0327 apis: [BiometricPrompt, BiometricPrompt.CryptoObject, authenticate] type: [static, code] -weakness: MASWE-0044 +weakness: MASWE-0020 profiles: [L2] knowledge: [MASTG-KNOW-0001, MASTG-KNOW-0043, MASTG-KNOW-0047, MASTG-KNOW-0012] best-practices: [MASTG-BEST-0036] diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0328.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0328.md index add7b1f1987..5a9ffcd0817 100644 --- a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0328.md +++ b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0328.md @@ -4,7 +4,7 @@ title: References to APIs Detecting Biometric Enrollment Changes id: MASTG-TEST-0328 apis: [KeyGenParameterSpec.Builder, setInvalidatedByBiometricEnrollment] type: [static, code] -weakness: MASWE-0046 +weakness: MASWE-0022 profiles: [L2] knowledge: [MASTG-KNOW-0001] best-practices: [MASTG-BEST-0037] diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0329.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0329.md index 6294d18b6ef..9fd45340afe 100644 --- a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0329.md +++ b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0329.md @@ -4,7 +4,7 @@ title: References to APIs Enforcing Authentication without Explicit User Action id: MASTG-TEST-0329 apis: [BiometricPrompt.PromptInfo.Builder, setConfirmationRequired] type: [static, code] -weakness: MASWE-0044 +weakness: MASWE-0020 profiles: [L2] knowledge: [MASTG-KNOW-0001] best-practices: [MASTG-BEST-0038] diff --git a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0330.md b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0330.md index 92a76122e7c..75769b80169 100644 --- a/tests-beta/android/MASVS-AUTH/MASTG-TEST-0330.md +++ b/tests-beta/android/MASVS-AUTH/MASTG-TEST-0330.md @@ -4,7 +4,7 @@ title: References to APIs for Keys used in Biometric Authentication with Extende id: MASTG-TEST-0330 apis: [KeyGenParameterSpec.Builder, setUserAuthenticationParameters, setUserAuthenticationValidityDurationSeconds] type: [static, code] -weakness: MASWE-0044 +weakness: MASWE-0020 profiles: [L2] knowledge: [MASTG-KNOW-0001, MASTG-KNOW-0043, MASTG-KNOW-0047, MASTG-KNOW-0012] best-practices: [MASTG-BEST-0036] diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0222.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0222.md index e9f31604e33..3a1f1933b34 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0222.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0222.md @@ -4,7 +4,7 @@ platform: android id: MASTG-TEST-0222 deprecated_since: 21 type: [static, code] -weakness: MASWE-0116 +weakness: MASWE-0045 profiles: [L2] knowledge: [MASTG-KNOW-0006] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0223.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0223.md index c229f53ec2c..13927453f1f 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0223.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0223.md @@ -3,7 +3,7 @@ title: Stack Canaries Not Enabled platform: android id: MASTG-TEST-0223 type: [static, code] -weakness: MASWE-0116 +weakness: MASWE-0045 profiles: [L2] knowledge: [MASTG-KNOW-0006] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0245.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0245.md index c29097f6098..ceba0c488fe 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0245.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0245.md @@ -4,7 +4,7 @@ title: References to Platform Version APIs id: MASTG-TEST-0245 apis: [Build] type: [static, code] -weakness: MASWE-0077 +weakness: MASWE-0041 best-practices: [] profiles: [L2] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0272.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0272.md index cede3936056..676d12e1e35 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0272.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0272.md @@ -3,7 +3,7 @@ platform: android title: Identify Dependencies with Known Vulnerabilities in the Android Project id: MASTG-TEST-0272 type: [static, code] -weakness: MASWE-0076 +weakness: MASWE-0044 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0274.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0274.md index f1f93696822..0403b68d450 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0274.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0274.md @@ -3,7 +3,7 @@ platform: android title: Dependencies with Known Vulnerabilities in the App's SBOM id: MASTG-TEST-0274 type: [static, developer] -weakness: MASWE-0076 +weakness: MASWE-0044 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md index 9e63a757ed1..a520322b099 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0337.md @@ -3,7 +3,7 @@ title: References to Object Deserialization of Untrusted Data platform: android id: MASTG-TEST-0337 type: [static, code] -weakness: MASWE-0088 +weakness: MASWE-0050 profiles: [L1, L2] knowledge: [MASTG-KNOW-0021] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md index a6dc24c5977..c6dd7bfd98b 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0339.md @@ -3,7 +3,7 @@ title: SQL Injection in Content Providers platform: android id: MASTG-TEST-0339 type: [static, code] -weakness: MASWE-0086 +weakness: MASWE-0050 best-practices: [MASTG-BEST-0039] profiles: [L1, L2] knowledge: [MASTG-KNOW-0117] diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0372.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0372.md index 65d211b6182..139a5efe494 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0372.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0372.md @@ -3,7 +3,7 @@ title: Implicit Intents Used for Internal App Communication platform: android id: MASTG-TEST-0372 type: [static, code, manual] -weakness: MASWE-0066 +weakness: MASWE-0032 best-practices: [MASTG-BEST-0056] knowledge: [MASTG-KNOW-0025] profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0374.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0374.md index 2eb2039380b..729f620222f 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0374.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0374.md @@ -3,7 +3,7 @@ title: References to Implicit Intents Carrying Sensitive Extras platform: android id: MASTG-TEST-0374 type: [static, code, manual] -weakness: MASWE-0066 +weakness: MASWE-0032 best-practices: [MASTG-BEST-0056] knowledge: [MASTG-KNOW-0025] profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md index 3c90ef602a0..62cd2eb8489 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0375.md @@ -3,7 +3,7 @@ title: Missing Validation of Data Returned from Implicit Intents platform: android id: MASTG-TEST-0375 type: [dynamic, hooks, manual] -weakness: MASWE-0083 +weakness: MASWE-0050 best-practices: [MASTG-BEST-0057] knowledge: [MASTG-KNOW-0025, MASTG-KNOW-0138] profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0382.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0382.md index a20649b9d2b..7967f80fc3d 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0382.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0382.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Enforced Updating APIs id: MASTG-TEST-0382 type: [dynamic, network, hooks, manual] -weakness: MASWE-0075 +weakness: MASWE-0043 profiles: [L2] knowledge: [MASTG-KNOW-0023] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0392.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0392.md index 27129bd79ca..e1baf5cfb5f 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0392.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0392.md @@ -3,7 +3,7 @@ platform: android title: References to Enforced Updating APIs id: MASTG-TEST-0392 type: [static, code, manual] -weakness: MASWE-0075 +weakness: MASWE-0043 profiles: [L2] knowledge: [MASTG-KNOW-0023] --- diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0398.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0398.md index 6dca166a41a..b96a1c5dde0 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0398.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0398.md @@ -4,7 +4,7 @@ title: References to WebViewClient URL Loading Handlers id: MASTG-TEST-0398 apis: [WebView, WebViewClient, shouldOverrideUrlLoading, shouldInterceptRequest, setWebViewClient] type: [static, code, manual] -weakness: MASWE-0071 +weakness: MASWE-0035 best-practices: [] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0399.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0399.md index 20540462cd3..d8c26c5d0ff 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0399.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0399.md @@ -4,7 +4,7 @@ title: SafeBrowsing Disabled id: MASTG-TEST-0399 apis: [WebView, WebSettings, EnableSafeBrowsing, setSafeBrowsingEnabled] type: [static, config, code] -weakness: MASWE-0071 +weakness: MASWE-0035 best-practices: [] knowledge: [MASTG-KNOW-0018] available_since: 27 diff --git a/tests-beta/android/MASVS-CODE/MASTG-TEST-0400.md b/tests-beta/android/MASVS-CODE/MASTG-TEST-0400.md index 784e8fbc821..f41241dddc9 100644 --- a/tests-beta/android/MASVS-CODE/MASTG-TEST-0400.md +++ b/tests-beta/android/MASVS-CODE/MASTG-TEST-0400.md @@ -4,7 +4,7 @@ title: Runtime Use of WebViewClient URL Loading Handlers id: MASTG-TEST-0400 apis: [WebView, WebViewClient, shouldOverrideUrlLoading, shouldInterceptRequest, Uri, getHost, getScheme, getPath] type: [dynamic, hooks, manual] -weakness: MASWE-0071 +weakness: MASWE-0035 best-practices: [] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0204.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0204.md index b46bbf87ff8..6ab93b3affd 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0204.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0204.md @@ -7,7 +7,7 @@ best-practices: [MASTG-BEST-0001] prerequisites: - identify-sensitive-data - identify-security-relevant-contexts -weakness: MASWE-0027 +weakness: MASWE-0012 profiles: [L1, L2] knowledge: [MASTG-KNOW-0013] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0205.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0205.md index 31441e0f5aa..ff5ab5393bf 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0205.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0205.md @@ -7,7 +7,7 @@ best-practices: [MASTG-BEST-0001] prerequisites: - identify-sensitive-data - identify-security-relevant-contexts -weakness: MASWE-0027 +weakness: MASWE-0012 profiles: [L1, L2] knowledge: [MASTG-KNOW-0013] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0208.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0208.md index 2c57c40b747..faff0edea0b 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0208.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0208.md @@ -3,7 +3,7 @@ platform: android title: Insufficient Key Sizes id: MASTG-TEST-0208 type: [static, code] -weakness: MASWE-0009 +weakness: MASWE-0013 profiles: [L1, L2] knowledge: [MASTG-KNOW-0012] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0212.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0212.md index b7e012cf5bb..b72e64b7ae3 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0212.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0212.md @@ -3,7 +3,7 @@ title: Use of Hardcoded Cryptographic Keys in Code platform: android id: MASTG-TEST-0212 type: [static, code] -weakness: MASWE-0014 +weakness: MASWE-0003 profiles: [L1, L2] knowledge: [MASTG-KNOW-0012] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0221.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0221.md index 21139bd89d8..95730f4b1cf 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0221.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0221.md @@ -3,7 +3,7 @@ title: Broken Symmetric Encryption Algorithms platform: android id: MASTG-TEST-0221 type: [static, code, manual] -weakness: MASWE-0020 +weakness: MASWE-0007 best-practices: [MASTG-BEST-0009] profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0232.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0232.md index 941bc4749e0..354a9ff1099 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0232.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0232.md @@ -3,7 +3,7 @@ title: Broken Symmetric Encryption Modes platform: android id: MASTG-TEST-0232 type: [static, code, manual] -weakness: MASWE-0020 +weakness: MASWE-0007 best-practices: [MASTG-BEST-0005] profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0307.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0307.md index 5fccfa8e423..a7dab7611bc 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0307.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0307.md @@ -3,7 +3,7 @@ platform: android title: References to Asymmetric Key Pairs Used For Multiple Purposes id: MASTG-TEST-0307 type: [static, code] -weakness: MASWE-0012 +weakness: MASWE-0007 profiles: [L2] knowledge: [MASTG-KNOW-0012] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0308.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0308.md index e1bd7c84b96..e60df01669e 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0308.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0308.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Asymmetric Key Pairs Used For Multiple Purposes id: MASTG-TEST-0308 type: [dynamic, hooks] -weakness: MASWE-0012 +weakness: MASWE-0007 profiles: [L2] knowledge: [MASTG-KNOW-0012] --- diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0309.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0309.md index 080d4cd13c1..4c96f3b2f76 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0309.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0309.md @@ -3,7 +3,7 @@ platform: android title: References to Reused Initialization Vectors in Symmetric Encryption id: MASTG-TEST-0309 type: [static, code] -weakness: MASWE-0022 +weakness: MASWE-0007 status: placeholder profiles: [L2] note: Reusing a symmetric key is acceptable when IVs or nonces follow the rules defined for the mode. NIST SP 800 38A states that CBC requires a fresh or unpredictable IV for every encryption. NIST SP 800 38D states that counter based modes require a nonce that never repeats under the same key. Repeating a key and IV or nonce pair defeats confidentiality and can also undermine integrity. diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0310.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0310.md index a81ec237f27..ca3d145374e 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0310.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0310.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Reused Initialization Vectors in Symmetric Encryption id: MASTG-TEST-0310 type: [dynamic, hooks] -weakness: MASWE-0022 +weakness: MASWE-0007 status: placeholder profiles: [L2] note: Reusing a symmetric key is acceptable when IVs or nonces follow the rules defined for the mode. NIST SP 800 38A states that CBC requires a fresh or unpredictable IV for every encryption. NIST SP 800 38D states that counter based modes require a nonce that never repeats under the same key. Repeating a key and IV or nonce pair defeats confidentiality and can also undermine integrity. diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0312.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0312.md index 4509c97aa82..8f63cd16c99 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0312.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0312.md @@ -3,7 +3,7 @@ title: References to Explicit Security Provider in Cryptographic APIs platform: android id: MASTG-TEST-0312 type: [static, code] -weakness: MASWE-0020 +weakness: MASWE-0007 best-practices: [MASTG-BEST-0020] profiles: [L1, L2] knowledge: [MASTG-KNOW-0011] diff --git a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0350.md b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0350.md index 002a6dc1bda..ae44c331518 100644 --- a/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0350.md +++ b/tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0350.md @@ -3,7 +3,7 @@ title: Runtime Use of Broken Symmetric Encryption Modes platform: android id: MASTG-TEST-0350 type: [dynamic, hooks, manual] -weakness: MASWE-0020 +weakness: MASWE-0007 best-practices: [MASTG-BEST-0005] profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md index bb10d789427..3dca210d261 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md @@ -3,7 +3,7 @@ title: Insecure TLS Protocols Explicitly Allowed in Code platform: android id: MASTG-TEST-0217 type: [static, code] -weakness: MASWE-0050 +weakness: MASWE-0026 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0218.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0218.md index aafa8f6cc11..bcb5394854d 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0218.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0218.md @@ -3,7 +3,7 @@ title: Insecure TLS Protocols in Network Traffic platform: android id: MASTG-TEST-0218 type: [dynamic, network] -weakness: MASWE-0050 +weakness: MASWE-0026 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0233.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0233.md index dfa2aa94f5d..e5a11a79f18 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0233.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0233.md @@ -3,7 +3,7 @@ title: Hardcoded HTTP URLs platform: android id: MASTG-TEST-0233 type: [static, code] -weakness: MASWE-0050 +weakness: MASWE-0026 related-tests: [MASTG-TEST-0235, MASTG-TEST-0236, MASTG-TEST-0238] profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0234.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0234.md index f95a73d6de8..ea0ae3daf18 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0234.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0234.md @@ -3,7 +3,7 @@ title: Missing Implementation of Server Hostname Verification with SSLSockets platform: android id: MASTG-TEST-0234 type: [static, code] -weakness: MASWE-0052 +weakness: MASWE-0027 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0235.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0235.md index 0fe10dfacac..885e2b171ca 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0235.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0235.md @@ -3,7 +3,7 @@ title: Android App Configurations Allowing Cleartext Traffic platform: android id: MASTG-TEST-0235 type: [static, code] -weakness: MASWE-0050 +weakness: MASWE-0026 profiles: [L1, L2] knowledge: [MASTG-KNOW-0014] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0236.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0236.md index 4003ded3287..c86e67bdfcf 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0236.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0236.md @@ -3,7 +3,7 @@ title: Cleartext Traffic Observed on the Network platform: network id: MASTG-TEST-0236 type: [dynamic, network] -weakness: MASWE-0050 +weakness: MASWE-0026 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0237.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0237.md index 70eb2fd825a..daeeb3e3459 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0237.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0237.md @@ -3,7 +3,7 @@ title: Cross-Platform Framework Configurations Allowing Cleartext Traffic platform: android id: MASTG-TEST-0237 type: [static, code] -weakness: MASWE-0050 +weakness: MASWE-0026 status: placeholder note: Cross-platform frameworks (e.g. Flutter, React native, ...), typically have their own implementations for HTTP libraries, where cleartext traffic can be allowed. profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0238.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0238.md index b3933168441..f04f3d9ed80 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0238.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0238.md @@ -3,7 +3,7 @@ title: Runtime Use of Network APIs Transmitting Cleartext Traffic platform: android id: MASTG-TEST-0238 type: [dynamic, hooks] -weakness: MASWE-0050 +weakness: MASWE-0026 status: placeholder note: Using Frida, you can trace all traffic of the app, mitigating the limitation of the dynamic analysis that you do not know which app, or which location is responsible for the traffic. Using Frida (and `.backtrace()`), you can be sure this is from the analyzed app, and know the exact location. A new limitation is then that all relevant networking APIs need to be instrumented. profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0239.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0239.md index 90a470194ae..93d1df25b81 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0239.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0239.md @@ -3,8 +3,8 @@ title: Using low-level APIs (e.g. Socket) to set up a custom HTTP connection platform: android id: MASTG-TEST-0239 type: [static, code] -weakness: MASWE-0050 +weakness: MASWE-0026 status: placeholder -note: This test could also be for MASWE-0049 but we'd need to support multiple weaknesses. +note: This test could also be for MASWE-0047 but we'd need to support multiple weaknesses. profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0242.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0242.md index 50950c6a4ca..19b44131665 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0242.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0242.md @@ -3,7 +3,7 @@ title: Missing Certificate Pinning in Network Security Configuration platform: android id: MASTG-TEST-0242 type: [static, code] -weakness: MASWE-0047 +weakness: MASWE-0028 profiles: [L2] knowledge: [MASTG-KNOW-0014, MASTG-KNOW-0015] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0243.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0243.md index 85db7f45a6e..67f273dd41b 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0243.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0243.md @@ -3,7 +3,7 @@ title: Expired Certificate Pins in the Network Security Configuration platform: android id: MASTG-TEST-0243 type: [static, code] -weakness: MASWE-0047 +weakness: MASWE-0028 profiles: [L2] knowledge: [MASTG-KNOW-0014, MASTG-KNOW-0015] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0244.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0244.md index bd76a802000..4e5512c0374 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0244.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0244.md @@ -3,7 +3,7 @@ title: Missing Certificate Pinning in Network Traffic platform: network id: MASTG-TEST-0244 type: [dynamic, network] -weakness: MASWE-0047 +weakness: MASWE-0028 profiles: [L2] knowledge: [MASTG-KNOW-0015] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0282.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0282.md index 8d8bd772dc0..340f56807b4 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0282.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0282.md @@ -3,7 +3,7 @@ title: Unsafe Custom Trust Evaluation platform: android id: MASTG-TEST-0282 type: [static, code, manual] -weakness: MASWE-0052 +weakness: MASWE-0027 best-practices: [MASTG-BEST-0021] profiles: [L1, L2] knowledge: [MASTG-KNOW-0010] diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0283.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0283.md index 3bd72a57a1f..9d584a323a3 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0283.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0283.md @@ -3,7 +3,7 @@ title: Incorrect Implementation of Server Hostname Verification platform: android id: MASTG-TEST-0283 type: [static, code, manual] -weakness: MASWE-0052 +weakness: MASWE-0027 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0284.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0284.md index a9affe6e23c..60cf48547fb 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0284.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0284.md @@ -3,7 +3,7 @@ title: Incorrect SSL Error Handling in WebViews platform: android id: MASTG-TEST-0284 type: [static, code, manual] -weakness: MASWE-0052 +weakness: MASWE-0027 best-practices: [MASTG-BEST-0021] profiles: [L1, L2] knowledge: [MASTG-KNOW-0010] diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0285.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0285.md index 2f7c9f46cce..7a6deb7c1dc 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0285.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0285.md @@ -4,7 +4,7 @@ platform: android id: MASTG-TEST-0285 type: [static, code] deprecated_since: 24 -weakness: MASWE-0052 +weakness: MASWE-0027 profiles: [L1, L2] knowledge: [MASTG-KNOW-0014] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0286.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0286.md index 9a053b885e6..b90d7b99db7 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0286.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0286.md @@ -3,7 +3,7 @@ title: Network Security Configuration Allowing Trust in User-Provided CAs platform: android id: MASTG-TEST-0286 type: [static, code] -weakness: MASWE-0052 +weakness: MASWE-0027 profiles: [L1, L2] knowledge: [MASTG-KNOW-0014] --- diff --git a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0295.md b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0295.md index b1613175f90..b05ce463b4c 100644 --- a/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0295.md +++ b/tests-beta/android/MASVS-NETWORK/MASTG-TEST-0295.md @@ -3,7 +3,7 @@ title: GMS Security Provider Not Updated platform: android id: MASTG-TEST-0295 type: [static, code] -weakness: MASWE-0052 +weakness: MASWE-0027 profiles: [L2] best-practices: [MASTG-BEST-0020] knowledge: [MASTG-KNOW-0011, MASTG-KNOW-0010] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0250.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0250.md index c8cde57a228..d1b50a1c10c 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0250.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0250.md @@ -5,7 +5,7 @@ alias: references-to-content-provider-access-in-webviews id: MASTG-TEST-0250 apis: [WebView, WebSettings, getSettings, ContentProvider, setAllowContentAccess, setAllowUniversalAccessFromFileURLs, setJavaScriptEnabled] type: [static, code] -weakness: MASWE-0069 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0011, MASTG-BEST-0012, MASTG-BEST-0013, MASTG-BEST-0049] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0251.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0251.md index 5343a070cb8..c22930464a9 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0251.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0251.md @@ -5,7 +5,7 @@ alias: references-to-content-provider-access-in-webviews id: MASTG-TEST-0251 apis: [WebView, WebSettings, getSettings, ContentProvider, setAllowContentAccess, setAllowUniversalAccessFromFileURLs, setJavaScriptEnabled] type: [dynamic, hooks, manual] -weakness: MASWE-0069 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0011, MASTG-BEST-0012, MASTG-BEST-0013, MASTG-BEST-0049] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0252.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0252.md index d00abd02478..7dbad1a7fbc 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0252.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0252.md @@ -5,7 +5,7 @@ alias: references-to-local-file-access-in-webviews id: MASTG-TEST-0252 apis: [WebView, WebSettings, getSettings, setAllowFileAccess, setAllowFileAccessFromFileURLs, setAllowUniversalAccessFromFileURLs] type: [static, code] -weakness: MASWE-0069 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0010, MASTG-BEST-0011, MASTG-BEST-0012] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0253.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0253.md index 511026dd1df..cc012c96345 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0253.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0253.md @@ -5,7 +5,7 @@ alias: references-to-local-file-access-in-webviews id: MASTG-TEST-0253 apis: [WebView, WebSettings, getSettings, setAllowFileAccess, setAllowFileAccessFromFileURLs, setAllowUniversalAccessFromFileURLs] type: [dynamic, hooks, manual] -weakness: MASWE-0069 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0010, MASTG-BEST-0011, MASTG-BEST-0012] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0258.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0258.md index ad7f15b1f8d..116d44a5a14 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0258.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0258.md @@ -3,7 +3,7 @@ platform: android title: References to Keyboard Caching Attributes in UI Elements id: MASTG-TEST-0258 type: [static, code] -weakness: MASWE-0053 +weakness: MASWE-0036 best-practices: [MASTG-BEST-0019] profiles: [L2] knowledge: [MASTG-KNOW-0055] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0289.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0289.md index e6bb4aeb77e..71acfe9552f 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0289.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0289.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0289 type: [dynamic, filesystem, manual] profiles: [L2] best-practices: [MASTG-BEST-0014] -weakness: MASWE-0055 +weakness: MASWE-0038 prerequisites: - identify-sensitive-screens knowledge: [MASTG-KNOW-0053] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0291.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0291.md index 4b31108a66a..0ba0f84055a 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0291.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0291.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0291 type: [static, code] profiles: [L2] best-practices: [MASTG-BEST-0014] -weakness: MASWE-0055 +weakness: MASWE-0038 knowledge: [MASTG-KNOW-0053] --- diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0292.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0292.md index 123efb47c39..eba586d9a51 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0292.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0292.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0292 type: [static, code] profiles: [L2] best-practices: [MASTG-BEST-0014, MASTG-BEST-0015] -weakness: MASWE-0055 +weakness: MASWE-0038 knowledge: [MASTG-KNOW-0053] status: placeholder note: This test verifies whether an app prevents sensitive data from being captured in the Recents screen when backgrounded. diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0293.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0293.md index f6ed6a579eb..bbd9a3bac20 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0293.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0293.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0293 type: [static, code] profiles: [L2] best-practices: [MASTG-BEST-0014, MASTG-BEST-0017] -weakness: MASWE-0055 +weakness: MASWE-0038 knowledge: [MASTG-KNOW-0053] status: placeholder note: This test verifies whether an app prevents sensitive data from being captured in screenshots and screen recordings of `SurfaceView` components. diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0294.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0294.md index d02ff83c04a..90f6591d301 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0294.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0294.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0294 type: [static, code] profiles: [L2] best-practices: [MASTG-BEST-0014, MASTG-BEST-0018] -weakness: MASWE-0055 +weakness: MASWE-0038 knowledge: [MASTG-KNOW-0053] status: placeholder note: This test verifies whether an app prevents sensitive data from being captured in screenshots and screen recordings of Jetpack Compose dialogs. diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0315.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0315.md index a3d08767af3..a4fbf0eb8b1 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0315.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0315.md @@ -4,7 +4,7 @@ title: Sensitive Data Exposed via Notifications id: MASTG-TEST-0315 apis: [NotificationManager] type: [static, code] -weakness: MASWE-0054 +weakness: MASWE-0037 prerequisites: - identify-sensitive-data profiles: [L2] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0316.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0316.md index 6d86f53fa02..ae88d57875d 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0316.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0316.md @@ -3,7 +3,7 @@ platform: android title: App Exposing User Authentication Data in Text Input Fields id: MASTG-TEST-0316 type: [static, code, manual] -weakness: MASWE-0053 +weakness: MASWE-0036 profiles: [L2] --- diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0320.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0320.md index 7766a246817..20155334477 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0320.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0320.md @@ -3,7 +3,7 @@ platform: android title: WebViews Not Cleaning Up Sensitive Data id: MASTG-TEST-0320 type: [dynamic, hooks] -weakness: MASWE-0118 +weakness: MASWE-0001 profiles: [L1, L2] best-practices: [MASTG-BEST-0028] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0334.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0334.md index 08f916deb9a..619371d6477 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0334.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0334.md @@ -3,7 +3,7 @@ platform: android title: Native Code Exposed Through WebViews id: MASTG-TEST-0334 type: [static, code, manual] -weakness: MASWE-0069 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0011, MASTG-BEST-0012, MASTG-BEST-0013, MASTG-BEST-0035] profiles: [L1, L2] knowledge: [MASTG-KNOW-0018] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0340.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0340.md index 188b32eded3..b10d0dbf1a7 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0340.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0340.md @@ -4,7 +4,7 @@ title: References to Overlay Attack Protections id: MASTG-TEST-0340 apis: [onFilterTouchEventForSecurity, setFilterTouchesWhenObscured, FLAG_WINDOW_IS_OBSCURED, FLAG_WINDOW_IS_PARTIALLY_OBSCURED] type: [static, code] -weakness: MASWE-0053 +weakness: MASWE-0036 best-practices: [MASTG-BEST-0040] profiles: [L2] knowledge: [MASTG-KNOW-0022] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0355.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0355.md index 6d623791e69..b2defd57e06 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0355.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0355.md @@ -3,7 +3,7 @@ platform: android title: References to Unauthorized Database Access through Content Providers id: MASTG-TEST-0355 type: [static, config, manual] -weakness: MASWE-0064 +weakness: MASWE-0018 profiles: [L1, L2] best-practices: [MASTG-BEST-0049] knowledge: [MASTG-KNOW-0020, MASTG-KNOW-0117] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0356.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0356.md index a43db855f8a..eba97f8f4a0 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0356.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0356.md @@ -3,7 +3,7 @@ platform: android title: Runtime Verification of Unauthorized Database Access through Content Providers id: MASTG-TEST-0356 type: [dynamic, filesystem, manual] -weakness: MASWE-0064 +weakness: MASWE-0018 profiles: [L1, L2] best-practices: [MASTG-BEST-0049] knowledge: [MASTG-KNOW-0020, MASTG-KNOW-0117] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0357.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0357.md index 71e2b4d166d..ba5fd56662e 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0357.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0357.md @@ -2,7 +2,7 @@ title: References to Oversharing of File-Based Content Providers platform: android id: MASTG-TEST-0357 -weakness: MASWE-0064 +weakness: MASWE-0018 type: [static, config, code, manual] best-practices: [MASTG-BEST-0049] profiles: [L1, L2] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0364.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0364.md index 147baef4e62..5449e49b1e5 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0364.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0364.md @@ -3,7 +3,7 @@ platform: android title: Exported And Unprotected Activities That Expose Sensitive Functionality id: MASTG-TEST-0364 type: [static, config, code, manual] -weakness: MASWE-0119 +weakness: MASWE-0018 best-practices: [MASTG-BEST-0052] profiles: [L1, L2] knowledge: [MASTG-KNOW-0132, MASTG-KNOW-0017, MASTG-KNOW-0020] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0365.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0365.md index 5b945c9cbbf..8877a504d18 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0365.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0365.md @@ -3,7 +3,7 @@ platform: android title: Exported And Unprotected Services That Expose Sensitive Functionality id: MASTG-TEST-0365 type: [static, config, code, manual] -weakness: MASWE-0062 +weakness: MASWE-0018 best-practices: [MASTG-BEST-0052] profiles: [L1, L2] knowledge: [MASTG-KNOW-0133, MASTG-KNOW-0017, MASTG-KNOW-0020] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0366.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0366.md index 3af5177e6f1..a439da046d2 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0366.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0366.md @@ -3,7 +3,7 @@ platform: android title: Exported And Unprotected Broadcast Receivers That Expose Sensitive Functionality id: MASTG-TEST-0366 type: [static, config, code, manual] -weakness: MASWE-0063 +weakness: MASWE-0018 best-practices: [MASTG-BEST-0052] profiles: [L1, L2] knowledge: [MASTG-KNOW-0134, MASTG-KNOW-0017, MASTG-KNOW-0020] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0381.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0381.md index b798d37de84..7a3bcc249de 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0381.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0381.md @@ -3,7 +3,7 @@ title: References to Insecure PendingIntent Creation platform: android id: MASTG-TEST-0381 type: [static] -weakness: MASWE-0066 +weakness: MASWE-0032 best-practices: [MASTG-BEST-0063] profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0393.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0393.md index 18b78aa97f4..f7e26df9299 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0393.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0393.md @@ -3,7 +3,7 @@ title: Use of Unverified App Links platform: android id: MASTG-TEST-0393 type: [static, config] -weakness: MASWE-0058 +weakness: MASWE-0029 profiles: [L1, L2] knowledge: [MASTG-KNOW-0019] best-practices: [MASTG-BEST-0070] diff --git a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0394.md b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0394.md index e44ae7d6296..2d112f6fef9 100644 --- a/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0394.md +++ b/tests-beta/android/MASVS-PLATFORM/MASTG-TEST-0394.md @@ -4,7 +4,7 @@ platform: android id: MASTG-TEST-0394 type: [static, code, manual] profiles: [L1, L2] -weakness: MASWE-0058 +weakness: MASWE-0029 knowledge: [MASTG-KNOW-0019] best-practices: [MASTG-BEST-0071] apis: [getData, getQueryParameter] diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md index b9c57c4a646..66e172df37d 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0206.md @@ -3,7 +3,7 @@ platform: android title: Undeclared PII in Network Traffic Capture id: MASTG-TEST-0206 type: [dynamic, network] -weakness: MASWE-0108 +weakness: MASWE-0073 prerequisites: - identify-sensitive-data - privacy-policy diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md index 04fc4f71f44..c443f431cdc 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md @@ -3,7 +3,7 @@ title: Dangerous App Permissions platform: android id: MASTG-TEST-0254 type: [static, code] -weakness: MASWE-0117 +weakness: MASWE-0066 profiles: [P] knowledge: [MASTG-KNOW-0017] --- diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0255.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0255.md index 515ad48d5c3..38b77738291 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0255.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0255.md @@ -2,7 +2,7 @@ platform: android title: Permission Requests Not Minimized id: MASTG-TEST-0255 -weakness: MASWE-0117 +weakness: MASWE-0066 status: placeholder note: This test checks if the app requests permissions that have privacy-preserving alternatives. profiles: [P] diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0256.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0256.md index b5356a2593d..e44fca7d88c 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0256.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0256.md @@ -2,7 +2,7 @@ platform: android title: Missing Permission Rationale id: MASTG-TEST-0256 -weakness: MASWE-0117 +weakness: MASWE-0066 status: placeholder note: This test checks if the app does not provide a rationale for requesting permissions. See https://developer.android.com/training/permissions/requesting#explain and https://developer.android.com/training/permissions/explaining-access#privacy-dashboard-show-rationale profiles: [P] diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0257.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0257.md index 299b317632f..cca29a5ecfa 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0257.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0257.md @@ -2,7 +2,7 @@ platform: android title: Not Resetting Unused Permissions id: MASTG-TEST-0257 -weakness: MASWE-0117 +weakness: MASWE-0066 status: placeholder note: This test checks if the app does not remove unnecessary access to granted permissions. See https://developer.android.com/training/permissions/requesting#remove-access profiles: [P] diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0318.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0318.md index 0e2a2b2d3c8..a28ace42d7d 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0318.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0318.md @@ -3,7 +3,7 @@ platform: android title: References to SDK APIs Known to Handle Sensitive User Data id: MASTG-TEST-0318 type: [static, code] -weakness: MASWE-0112 +weakness: MASWE-0073 profiles: [P] --- diff --git a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0319.md b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0319.md index 763f3ca5534..705d9de1233 100644 --- a/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0319.md +++ b/tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0319.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of SDK APIs Known to Handle Sensitive User Data id: MASTG-TEST-0319 type: [dynamic, hooks] -weakness: MASWE-0112 +weakness: MASWE-0073 prerequisites: - identify-sensitive-data profiles: [P] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0224.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0224.md index 70bad7e7074..071f2a073ea 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0224.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0224.md @@ -4,7 +4,7 @@ platform: android id: MASTG-TEST-0224 type: [static, code] available_since: 24 -weakness: MASWE-0104 +weakness: MASWE-0056 best-practices: [MASTG-BEST-0006] profiles: [R] knowledge: [MASTG-KNOW-0003] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0225.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0225.md index 34d58b39ba2..0e7a334b546 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0225.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0225.md @@ -3,7 +3,7 @@ title: Usage of Insecure APK Signature Key Size platform: android id: MASTG-TEST-0225 type: [static, code] -weakness: MASWE-0104 +weakness: MASWE-0056 profiles: [R] knowledge: [MASTG-KNOW-0003] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md index a31004598aa..05e7ffe05d9 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0226.md @@ -3,7 +3,7 @@ title: Debuggable Flag Enabled in the AndroidManifest platform: android id: MASTG-TEST-0226 type: [static, code] -weakness: MASWE-0067 +weakness: MASWE-0063 best-practices: [MASTG-BEST-0007] profiles: [R] knowledge: [MASTG-KNOW-0007] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md index beb2fb2307e..111e33ebc5c 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0227.md @@ -3,7 +3,7 @@ title: Debugging Enabled for WebViews platform: android id: MASTG-TEST-0227 type: [static, code] -weakness: MASWE-0067 +weakness: MASWE-0063 best-practices: [MASTG-BEST-0008] profiles: [R] knowledge: [MASTG-KNOW-0028] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0247.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0247.md index f5b91a76b81..86a10f402ee 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0247.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0247.md @@ -4,7 +4,7 @@ title: References to APIs for Detecting Secure Screen Lock id: MASTG-TEST-0247 apis: [KeyguardManager, BiometricManager#canAuthenticate] type: [static, code] -weakness: MASWE-0008 +weakness: MASWE-0017 best-practices: [] profiles: [L2] knowledge: [MASTG-KNOW-0001] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0249.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0249.md index 892483286dc..6e124072fff 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0249.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0249.md @@ -4,7 +4,7 @@ title: Runtime Use of Secure Screen Lock Detection APIs id: MASTG-TEST-0249 apis: [KeyguardManager, BiometricManager#canAuthenticate] type: [dynamic, hooks] -weakness: MASWE-0008 +weakness: MASWE-0017 best-practices: [] profiles: [L2] knowledge: [MASTG-KNOW-0001] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0263.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0263.md index 8a632079bb4..364fd9f58f7 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0263.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0263.md @@ -4,7 +4,7 @@ title: Logging of StrictMode Violations id: MASTG-TEST-0263 apis: [StrictMode] type: [dynamic, logs] -weakness: MASWE-0094 +weakness: MASWE-0061 profiles: [R] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0264.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0264.md index 36dd2f4307e..6a884274405 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0264.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0264.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of StrictMode APIs id: MASTG-TEST-0264 type: [dynamic, hooks] -weakness: MASWE-0094 +weakness: MASWE-0061 best-practices: [] profiles: [R] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0265.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0265.md index 514f6f326da..6e3055806e4 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0265.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0265.md @@ -3,7 +3,7 @@ platform: android title: References to StrictMode APIs id: MASTG-TEST-0265 type: [static, code] -weakness: MASWE-0094 +weakness: MASWE-0061 best-practices: [] profiles: [R] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0288.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0288.md index 4fc81d4f9cb..0cb364f2cff 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0288.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0288.md @@ -4,7 +4,7 @@ title: Debugging Symbols in Native Binaries alias: debugging-symbols-in-native-binaries id: MASTG-TEST-0288 type: [static, code] -weakness: MASWE-0093 +weakness: MASWE-0061 best-practices: [] profiles: [R] --- diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md index 0e8880b885d..fbfd794fb1b 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md @@ -3,7 +3,7 @@ platform: android title: References to Root Detection Mechanisms id: MASTG-TEST-0324 type: [static, code] -weakness: MASWE-0097 +weakness: MASWE-0051 best-practices: [MASTG-BEST-0029, MASTG-BEST-0030] profiles: [R] knowledge: [MASTG-KNOW-0027] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0325.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0325.md index 92216ec41ee..5cc3c1008ec 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0325.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0325.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Root Detection Techniques id: MASTG-TEST-0325 type: [dynamic, hooks] -weakness: MASWE-0097 +weakness: MASWE-0051 best-practices: [MASTG-BEST-0029, MASTG-BEST-0030] profiles: [R] knowledge: [MASTG-KNOW-0027] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0338.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0338.md index 1b5c43e9b7e..106095d4b48 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0338.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0338.md @@ -4,7 +4,7 @@ platform: android id: MASTG-TEST-0338 apis: [javax.crypto.Mac, java.security.Signature, java.security.MessageDigest] type: [static, code, manual] -weakness: MASWE-0105 +weakness: MASWE-0057 false_negative_prone: true profiles: [R] knowledge: [MASTG-KNOW-0036] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0341.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0341.md index 9ce630f8e40..ef366cdefbe 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0341.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0341.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Hook Detection Techniques id: MASTG-TEST-0341 type: [dynamic, hooks] -weakness: MASWE-0107 +weakness: MASWE-0058 best-practices: [MASTG-BEST-0041] profiles: [R] knowledge: [MASTG-KNOW-0030, MASTG-KNOW-0032, MASTG-KNOW-0118] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0351.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0351.md index 7f254135a3d..2f8f1592fb8 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0351.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0351.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Emulator Detection Techniques id: MASTG-TEST-0351 type: [dynamic, hooks] -weakness: MASWE-0099 +weakness: MASWE-0053 best-practices: [MASTG-BEST-0046] profiles: [R] knowledge: [MASTG-KNOW-0031] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0352.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0352.md index e9d9f7f62ea..67b5922dd17 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0352.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0352.md @@ -3,7 +3,7 @@ platform: android title: References to Debugging Detection APIs id: MASTG-TEST-0352 type: [static, code, manual] -weakness: MASWE-0101 +weakness: MASWE-0064 best-practices: [MASTG-BEST-0007, MASTG-BEST-0029, MASTG-BEST-0047] profiles: [R] knowledge: [MASTG-KNOW-0007, MASTG-KNOW-0028] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0353.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0353.md index 2419dcab71e..4875743fd6c 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0353.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0353.md @@ -3,7 +3,7 @@ platform: android title: Runtime Use of Debugging Detection APIs id: MASTG-TEST-0353 type: [dynamic, hooks, manual] -weakness: MASWE-0101 +weakness: MASWE-0064 best-practices: [MASTG-BEST-0007, MASTG-BEST-0029, MASTG-BEST-0047] profiles: [R] knowledge: [MASTG-KNOW-0007, MASTG-KNOW-0028] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0368.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0368.md index 7a5482962e6..a13cd7e3eac 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0368.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0368.md @@ -3,7 +3,7 @@ platform: android title: Insufficient Obfuscation of Security-Relevant Java/Kotlin Code id: MASTG-TEST-0368 type: [static, code, manual] -weakness: MASWE-0089 +weakness: MASWE-0059 best-practices: [MASTG-BEST-0029] profiles: [R] knowledge: [MASTG-KNOW-0033] diff --git a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0369.md b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0369.md index 711d8a7d495..72d3b08ee94 100644 --- a/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0369.md +++ b/tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0369.md @@ -3,7 +3,7 @@ platform: android title: Insufficient Obfuscation of Security-Relevant Native Code id: MASTG-TEST-0369 type: [static, package, manual] -weakness: MASWE-0089 +weakness: MASWE-0059 best-practices: [MASTG-BEST-0029] profiles: [R] knowledge: [MASTG-KNOW-0033] diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0200.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0200.md index e3bf8ad5eed..280bf8413e9 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0200.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0200.md @@ -3,7 +3,7 @@ platform: android title: Files Written to External Storage id: MASTG-TEST-0200 type: [dynamic, filesystem, manual] -weakness: MASWE-0007 +weakness: MASWE-0002 profiles: [L1, L2] --- diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0201.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0201.md index ddf2ed8b1d4..1ac9b6fb7d9 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0201.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0201.md @@ -4,7 +4,7 @@ title: Runtime Use of APIs to Access External Storage id: MASTG-TEST-0201 apis: [Environment#getExternalStorageDirectory, Environment#getExternalStorageDirectory, Environment#getExternalFilesDir, Environment#getExternalCacheDir, FileOutputStream] type: [dynamic, hooks, manual] -weakness: MASWE-0007 +weakness: MASWE-0002 profiles: [L1, L2] knowledge: [MASTG-KNOW-0042] --- diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0202.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0202.md index 2367341145e..77a223a313f 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0202.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0202.md @@ -4,7 +4,7 @@ title: References to APIs and Permissions for Accessing External Storage id: MASTG-TEST-0202 apis: [Environment#getExternalStoragePublicDirectory, Environment#getExternalStorageDirectory, Environment#getExternalFilesDir, Environment#getExternalCacheDir, MediaStore, WRITE_EXTERNAL_STORAGE, MANAGE_EXTERNAL_STORAGE] type: [static, code, manual] -weakness: MASWE-0007 +weakness: MASWE-0002 profiles: [L1, L2] knowledge: [MASTG-KNOW-0042] --- diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0203.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0203.md index 4d13c11384e..4992b40dfae 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0203.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0203.md @@ -4,7 +4,7 @@ title: Runtime Use of Logging APIs id: MASTG-TEST-0203 apis: [Log, Logger, System.out.print, System.err.print, java.lang.Throwable#printStackTrace] type: [dynamic, hooks] -weakness: MASWE-0001 +weakness: MASWE-0005 best-practices: [MASTG-BEST-0002] profiles: [L1, L2, P] knowledge: [MASTG-KNOW-0049] diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0207.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0207.md index 44f826b893a..fd5c9810f59 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0207.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0207.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0207 type: [dynamic, filesystem] prerequisites: - identify-sensitive-data -weakness: MASWE-0006 +weakness: MASWE-0001 profiles: [L2] best-practices: [MASTG-BEST-0050] knowledge: [MASTG-KNOW-0041] diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0216.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0216.md index 9ec37b1764b..2baccf49d31 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0216.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0216.md @@ -3,7 +3,7 @@ platform: android title: Sensitive Data Not Excluded From Backup id: MASTG-TEST-0216 type: [dynamic, filesystem] -weakness: MASWE-0004 +weakness: MASWE-0006 best-practices: [MASTG-BEST-0004] profiles: [L1, L2, P] knowledge: [MASTG-KNOW-0050] diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0231.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0231.md index eb469c93c0a..777ed756ce4 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0231.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0231.md @@ -4,7 +4,7 @@ title: References to Logging APIs id: MASTG-TEST-0231 apis: [Log, Logger, System.out.print, System.err.print, java.lang.Throwable#printStackTrace, android.util.Log] type: [static, code] -weakness: MASWE-0001 +weakness: MASWE-0005 best-practices: [MASTG-BEST-0002] profiles: [L1, L2, P] knowledge: [MASTG-KNOW-0049] diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0262.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0262.md index 50d8a4213f9..f5bdc3c0c16 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0262.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0262.md @@ -3,7 +3,7 @@ platform: android title: References to Backup Configurations Not Excluding Sensitive Data id: MASTG-TEST-0262 type: [static, code] -weakness: MASWE-0004 +weakness: MASWE-0006 best-practices: [MASTG-BEST-0004] profiles: [L1, L2, P] knowledge: [MASTG-KNOW-0050] diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0287.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0287.md index a3078e55c20..508bfe110ba 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0287.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0287.md @@ -3,7 +3,7 @@ title: Runtime Storage of Unencrypted Data via the SharedPreferences API platform: android id: MASTG-TEST-0287 type: [dynamic, hooks, manual] -weakness: MASWE-0006 +weakness: MASWE-0001 best-practices: [MASTG-BEST-0050] profiles: [L1, L2] prerequisites: diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0304.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0304.md index d813cc82371..a02e5d5ec30 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0304.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0304.md @@ -3,7 +3,7 @@ title: References to Sensitive Data Unencrypted via Android Room Database platform: android id: MASTG-TEST-0304 type: [static, code] -weakness: MASWE-0006 +weakness: MASWE-0001 best-practices: [] profiles: [L1, L2] knowledge: [MASTG-KNOW-0037] diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0305.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0305.md index 27216f0ee10..09dedefa937 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0305.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0305.md @@ -3,7 +3,7 @@ title: Sensitive Data Stored Unencrypted via DataStore platform: android id: MASTG-TEST-0305 type: [static, dynamic] -weakness: MASWE-0006 +weakness: MASWE-0001 best-practices: [] profiles: [L1, L2] status: placeholder diff --git a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0306.md b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0306.md index fe554fd1a44..d02afed5425 100644 --- a/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0306.md +++ b/tests-beta/android/MASVS-STORAGE/MASTG-TEST-0306.md @@ -3,7 +3,7 @@ title: References to Sensitive Data Stored Unencrypted via Android Room DB platform: android id: MASTG-TEST-0306 type: [static, code] -weakness: MASWE-0006 +weakness: MASWE-0001 best-practices: [] profiles: [L1, L2] status: placeholder diff --git a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0266.md b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0266.md index 823249cf7eb..f7b3620a04e 100644 --- a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0266.md +++ b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0266.md @@ -4,7 +4,7 @@ title: References to APIs for Event-Bound Biometric Authentication id: MASTG-TEST-0266 apis: [LAContext.evaluatePolicy] type: [static, code] -weakness: MASWE-0044 +weakness: MASWE-0020 profiles: [L2] knowledge: [MASTG-KNOW-0056, MASTG-KNOW-0057] --- diff --git a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0267.md b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0267.md index 8a0bdc4d158..e434e79dce4 100644 --- a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0267.md +++ b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0267.md @@ -4,7 +4,7 @@ title: Runtime Use Of Event-Bound Biometric Authentication id: MASTG-TEST-0267 apis: [LAContext.evaluatePolicy] type: [dynamic, hooks] -weakness: MASWE-0044 +weakness: MASWE-0020 best-practices: [] profiles: [L2] knowledge: [MASTG-KNOW-0056] diff --git a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0268.md b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0268.md index 658c2d9b4a0..9d1ad575ae9 100644 --- a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0268.md +++ b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0268.md @@ -4,7 +4,7 @@ title: References to APIs Allowing Fallback to Non-Biometric Authentication id: MASTG-TEST-0268 apis: [kSecAccessControlUserPresence, kSecAccessControlDevicePasscode, SecAccessControlCreateWithFlags] type: [static, code] -weakness: MASWE-0045 +weakness: MASWE-0021 profiles: [L2] knowledge: [MASTG-KNOW-0056] --- diff --git a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0269.md b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0269.md index f27f38621e0..8f89ce0cb01 100644 --- a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0269.md +++ b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0269.md @@ -4,7 +4,7 @@ title: Runtime Use Of APIs Allowing Fallback to Non-Biometric Authentication id: MASTG-TEST-0269 apis: [kSecAccessControlUserPresence, kSecAccessControlDevicePasscode, SecAccessControlCreateWithFlags] type: [dynamic, hooks] -weakness: MASWE-0045 +weakness: MASWE-0021 profiles: [L2] knowledge: [MASTG-KNOW-0056] --- diff --git a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0270.md b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0270.md index 6c4f04deb1c..b2e1a513e6d 100644 --- a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0270.md +++ b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0270.md @@ -4,7 +4,7 @@ title: References to APIs Detecting Biometric Enrollment Changes id: MASTG-TEST-0270 apis: [kSecAccessControlBiometryCurrentSet,SecAccessControlCreateWithFlags] type: [static, code] -weakness: MASWE-0046 +weakness: MASWE-0022 profiles: [L2] knowledge: [MASTG-KNOW-0056] --- diff --git a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0271.md b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0271.md index c0044fbca85..b104e394e1d 100644 --- a/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0271.md +++ b/tests-beta/ios/MASVS-AUTH/MASTG-TEST-0271.md @@ -4,7 +4,7 @@ title: Runtime Use Of APIs Detecting Biometric Enrollment Changes id: MASTG-TEST-0271 apis: [kSecAccessControlBiometryCurrentSet,SecAccessControlCreateWithFlags] type: [dynamic, hooks] -weakness: MASWE-0046 +weakness: MASWE-0022 profiles: [L2] knowledge: [MASTG-KNOW-0056] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0228.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0228.md index 21837108e4c..b09b75c6979 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0228.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0228.md @@ -3,7 +3,7 @@ title: Position Independent Code (PIC) not Enabled platform: ios id: MASTG-TEST-0228 type: [static, code] -weakness: MASWE-0116 +weakness: MASWE-0045 profiles: [L2] knowledge: [MASTG-KNOW-0061] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0229.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0229.md index 89fa4d10495..31456b4edc2 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0229.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0229.md @@ -3,7 +3,7 @@ title: Stack Canaries Not enabled platform: ios id: MASTG-TEST-0229 type: [static, code] -weakness: MASWE-0116 +weakness: MASWE-0045 profiles: [L2] knowledge: [MASTG-KNOW-0061] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0230.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0230.md index dd19d25c7cf..ef89c3439d2 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0230.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0230.md @@ -3,7 +3,7 @@ title: Automatic Reference Counting (ARC) not enabled platform: ios id: MASTG-TEST-0230 type: [static, code] -weakness: MASWE-0116 +weakness: MASWE-0045 profiles: [L2] knowledge: [MASTG-KNOW-0061] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0273.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0273.md index f2b350755c3..8b06b1a469d 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0273.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0273.md @@ -3,7 +3,7 @@ platform: ios title: Identify Dependencies with Known Vulnerabilities by Scanning Dependency Managers Artifacts id: MASTG-TEST-0273 type: [static, code] -weakness: MASWE-0076 +weakness: MASWE-0044 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0275.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0275.md index 177b48b134a..86ca73ab87b 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0275.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0275.md @@ -3,7 +3,7 @@ platform: ios title: Dependencies with Known Vulnerabilities in the App's SBOM id: MASTG-TEST-0275 type: [static, developer] -weakness: MASWE-0076 +weakness: MASWE-0044 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0383.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0383.md index aed71c73a77..8217a33b1be 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0383.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0383.md @@ -3,7 +3,7 @@ platform: ios title: References to Enforced Updating APIs id: MASTG-TEST-0383 type: [static, code, manual] -weakness: MASWE-0075 +weakness: MASWE-0043 profiles: [L2] knowledge: [MASTG-KNOW-0074] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0384.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0384.md index 34a06d04b6e..9f527e63629 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0384.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0384.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of Enforced Updating APIs id: MASTG-TEST-0384 type: [dynamic, network, hooks, manual] -weakness: MASWE-0075 +weakness: MASWE-0043 profiles: [L2] knowledge: [MASTG-KNOW-0074] --- diff --git a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0386.md b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0386.md index 6c1cc60d255..4fbaee91b59 100644 --- a/tests-beta/ios/MASVS-CODE/MASTG-TEST-0386.md +++ b/tests-beta/ios/MASVS-CODE/MASTG-TEST-0386.md @@ -3,7 +3,7 @@ title: References to Object Deserialization of Untrusted Data platform: ios id: MASTG-TEST-0386 type: [static, code, manual] -weakness: MASWE-0088 +weakness: MASWE-0050 profiles: [L1, L2] knowledge: [MASTG-KNOW-0075] best-practices: [MASTG-BEST-0064] diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0209.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0209.md index 7d103732be7..e580655d10c 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0209.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0209.md @@ -3,7 +3,7 @@ platform: ios title: Insufficient Key Sizes id: MASTG-TEST-0209 type: [static, code] -weakness: MASWE-0009 +weakness: MASWE-0013 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0210.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0210.md index c6adf53f6f9..6b67a82eff5 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0210.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0210.md @@ -3,7 +3,7 @@ platform: ios title: Broken Symmetric Encryption Algorithms id: MASTG-TEST-0210 type: [static, code, manual] -weakness: MASWE-0020 +weakness: MASWE-0007 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0211.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0211.md index a6908b9c12a..7ae007ab586 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0211.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0211.md @@ -3,7 +3,7 @@ platform: ios title: Broken Hashing Algorithms id: MASTG-TEST-0211 type: [static, code, manual] -weakness: MASWE-0021 +weakness: MASWE-0008 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0213.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0213.md index 12f98f77291..d4180368930 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0213.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0213.md @@ -3,7 +3,7 @@ title: Use of Hardcoded Cryptographic Keys in Code platform: ios id: MASTG-TEST-0213 type: [static, code, manual] -weakness: MASWE-0014 +weakness: MASWE-0003 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0214.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0214.md index e081ae458a0..5831bc0c314 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0214.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0214.md @@ -3,7 +3,7 @@ title: Hardcoded Cryptographic Keys in Files platform: ios id: MASTG-TEST-0214 type: [static, code, manual] -weakness: MASWE-0014 +weakness: MASWE-0003 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0311.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0311.md index 6c83c86e2eb..3cfc66abfb6 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0311.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0311.md @@ -3,7 +3,7 @@ platform: ios title: Insecure Random API Usage id: MASTG-TEST-0311 type: [static, code, manual] -weakness: MASWE-0027 +weakness: MASWE-0012 profiles: [L1, L2] best-practices: [MASTG-BEST-0025] knowledge: [MASTG-KNOW-0070] diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0317.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0317.md index 3dea3805409..753a068fc98 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0317.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0317.md @@ -3,7 +3,7 @@ title: Broken Symmetric Encryption Modes platform: ios id: MASTG-TEST-0317 type: [static, code, manual] -weakness: MASWE-0020 +weakness: MASWE-0007 best-practices: [MASTG-BEST-0005] profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0349.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0349.md index 7b40549e1f3..c3291202422 100644 --- a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0349.md +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0349.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of Insecure Random APIs id: MASTG-TEST-0349 type: [dynamic, hooks, manual] -weakness: MASWE-0027 +weakness: MASWE-0012 profiles: [L1, L2] best-practices: [MASTG-BEST-0025] knowledge: [MASTG-KNOW-0070] diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0321.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0321.md index 673cf71f4d6..6d53c614985 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0321.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0321.md @@ -3,7 +3,7 @@ platform: ios title: Hardcoded HTTP URLs id: MASTG-TEST-0321 type: [static, code] -weakness: MASWE-0050 +weakness: MASWE-0026 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0322.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0322.md index 79feb89b4bb..1656d09bf05 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0322.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0322.md @@ -3,7 +3,7 @@ platform: ios title: App Transport Security Configurations Allowing Cleartext Traffic id: MASTG-TEST-0322 type: [static, code, manual] -weakness: MASWE-0050 +weakness: MASWE-0026 profiles: [L1, L2] knowledge: [MASTG-KNOW-0071] --- diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0323.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0323.md index 142dca24f68..88811686c64 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0323.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0323.md @@ -3,7 +3,7 @@ platform: ios title: Uses of Low-Level Networking APIs for Cleartext Traffic id: MASTG-TEST-0323 type: [static, code, manual] -weakness: MASWE-0050 +weakness: MASWE-0026 profiles: [L1, L2] knowledge: [MASTG-KNOW-0073] --- diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0342.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0342.md index 0d47bb2013d..a2991ee60b7 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0342.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0342.md @@ -3,7 +3,7 @@ platform: ios title: References to Weak ATS TLS Policy Exceptions in Info.plist id: MASTG-TEST-0342 type: [static, code] -weakness: MASWE-0050 +weakness: MASWE-0026 profiles: [L1, L2] best-practices: [MASTG-BEST-0042] knowledge: [MASTG-KNOW-0071] diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0343.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0343.md index 9e0fd409b8d..c9c95fbe4c8 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0343.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0343.md @@ -3,7 +3,7 @@ platform: ios title: URLSession TLS Protocol Configuration id: MASTG-TEST-0343 type: [static, code, manual] -weakness: MASWE-0050 +weakness: MASWE-0026 profiles: [L1, L2] best-practices: [MASTG-BEST-0042] knowledge: [MASTG-KNOW-0071, MASTG-KNOW-0073] diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0344.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0344.md index d9a0262c5d9..104276da966 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0344.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0344.md @@ -3,7 +3,7 @@ platform: ios title: Network.framework TLS Protocol Configuration id: MASTG-TEST-0344 type: [static, code, manual] -weakness: MASWE-0050 +weakness: MASWE-0026 profiles: [L1, L2] best-practices: [MASTG-BEST-0043] knowledge: [MASTG-KNOW-0073] diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0345.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0345.md index 8ea26d32522..3291f828bd9 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0345.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0345.md @@ -3,7 +3,7 @@ platform: ios title: Embedded or Third-party TLS Stack Configuration id: MASTG-TEST-0345 type: [static, code, manual] -weakness: MASWE-0050 +weakness: MASWE-0026 profiles: [L1, L2] best-practices: [MASTG-BEST-0043] knowledge: [MASTG-KNOW-0073] diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0348.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0348.md index 89a01bded3f..5ec4771709a 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0348.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0348.md @@ -3,7 +3,7 @@ title: Insecure TLS Protocols in Network Traffic platform: ios id: MASTG-TEST-0348 type: [dynamic, network] -weakness: MASWE-0050 +weakness: MASWE-0026 profiles: [L1, L2] --- diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0385.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0385.md index 9f338188980..a1b4a005f8a 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0385.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0385.md @@ -3,7 +3,7 @@ platform: ios title: Missing Certificate Pinning in ATS id: MASTG-TEST-0385 type: [static] -weakness: MASWE-0047 +weakness: MASWE-0028 profiles: [L2] prerequisites: - identify-first-party-domains diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0396.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0396.md index 89b1fa72a08..81854ce47bc 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0396.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0396.md @@ -3,7 +3,7 @@ title: References to URLSessionDelegate Bypassing Certificate Validation platform: ios id: MASTG-TEST-0396 type: [static, code, manual] -weakness: MASWE-0052 +weakness: MASWE-0027 best-practices: [MASTG-BEST-0073] profiles: [L1, L2] knowledge: [MASTG-KNOW-0072] diff --git a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0397.md b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0397.md index 1f866ca96e8..2ceaddc0477 100644 --- a/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0397.md +++ b/tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0397.md @@ -3,7 +3,7 @@ title: References to WKNavigationDelegate Bypassing Certificate Validation platform: ios id: MASTG-TEST-0397 type: [static, code, manual] -weakness: MASWE-0052 +weakness: MASWE-0027 best-practices: [MASTG-BEST-0073] profiles: [L1, L2] knowledge: [MASTG-KNOW-0072] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0276.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0276.md index edb321c50fa..62b06ceac82 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0276.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0276.md @@ -3,7 +3,7 @@ platform: ios title: Use of the iOS General Pasteboard id: MASTG-TEST-0276 type: [static, code, manual] -weakness: MASWE-0053 +weakness: MASWE-0036 threat: [app] prerequisites: - identify-sensitive-data diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0277.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0277.md index b2942275362..650f4557c1e 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0277.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0277.md @@ -3,7 +3,7 @@ platform: ios title: Sensitive Data in the iOS General Pasteboard at Runtime id: MASTG-TEST-0277 type: [dynamic, hooks] -weakness: MASWE-0053 +weakness: MASWE-0036 threat: [app] prerequisites: - identify-sensitive-data diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0278.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0278.md index a4d718981c1..00828380659 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0278.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0278.md @@ -3,7 +3,7 @@ platform: ios title: Pasteboard Contents Not Cleared After Use id: MASTG-TEST-0278 type: [static, code] -weakness: MASWE-0053 +weakness: MASWE-0036 threat: [app] profiles: [L2] knowledge: [MASTG-KNOW-0083] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0279.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0279.md index 77a5e88477c..2193aac7aea 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0279.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0279.md @@ -3,7 +3,7 @@ platform: ios title: Pasteboard Contents Not Expiring id: MASTG-TEST-0279 type: [static, code] -weakness: MASWE-0053 +weakness: MASWE-0036 threat: [app] profiles: [L2] knowledge: [MASTG-KNOW-0083] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0280.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0280.md index 9fbfeaead11..66705b3a075 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0280.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0280.md @@ -3,7 +3,7 @@ platform: ios title: Pasteboard Contents Not Restricted to Local Device id: MASTG-TEST-0280 type: [static, code] -weakness: MASWE-0053 +weakness: MASWE-0036 threat: [app] profiles: [L2] knowledge: [MASTG-KNOW-0083] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0290.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0290.md index ed13255d265..46b05a3cfb4 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0290.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0290.md @@ -4,7 +4,7 @@ platform: ios id: MASTG-TEST-0290 type: [dynamic, filesystem] profiles: [L2] -weakness: MASWE-0055 +weakness: MASWE-0038 prerequisites: - identify-sensitive-screens knowledge: [MASTG-KNOW-0099] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0331.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0331.md index bcf2e5fa499..4b57f9f9958 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0331.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0331.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0331 type: [static, code] available_since: 2.0 deprecated_since: 12.0 -weakness: MASWE-0072 +weakness: MASWE-0035 profiles: [L1, L2] best-practices: [MASTG-BEST-0032] knowledge: [MASTG-KNOW-0076] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0332.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0332.md index 0e14c3d3247..b517f2eb59d 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0332.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0332.md @@ -3,7 +3,7 @@ platform: ios title: Attacker-Controlled URI in WebViews id: MASTG-TEST-0332 type: [static, code, manual] -weakness: MASWE-0071 +weakness: MASWE-0035 best-practices: [MASTG-BEST-0034] profiles: [L1, L2, P] knowledge: [MASTG-KNOW-0076] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0333.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0333.md index 066a1cb41c2..cc8810e1f9d 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0333.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0333.md @@ -3,7 +3,7 @@ platform: ios title: Overly Broad File Read Access in WebViews id: MASTG-TEST-0333 type: [static, code, manual] -weakness: MASWE-0069 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0033] knowledge: [MASTG-KNOW-0076] profiles: [L1, L2] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0335.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0335.md index 745075ca3b1..d74ed20146b 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0335.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0335.md @@ -3,7 +3,7 @@ platform: ios title: WebView File Origin Access Relaxed by Configuration id: MASTG-TEST-0335 type: [static, code, manual] -weakness: MASWE-0069 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0033] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0336.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0336.md index bf760fe6f1a..0efa25f3fd3 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0336.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0336.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Setting of Relaxed WebView File Origin Policies id: MASTG-TEST-0336 type: [dynamic, hooks, manual] -weakness: MASWE-0069 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0033] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0346.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0346.md index c0a021114a3..97d8d07a3d5 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0346.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0346.md @@ -3,7 +3,7 @@ platform: ios title: References to APIs Hiding Sensitive Data in Text Input Fields id: MASTG-TEST-0346 type: [static, code, manual] -weakness: MASWE-0053 +weakness: MASWE-0036 profiles: [L2] best-practices: [MASTG-BEST-0044] knowledge: [MASTG-KNOW-0121, MASTG-KNOW-0141] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0347.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0347.md index 6f73599fbf3..a717f7e11a4 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0347.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0347.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of APIs Hiding Sensitive Data in Text Input Fields id: MASTG-TEST-0347 type: [dynamic, hooks] -weakness: MASWE-0053 +weakness: MASWE-0036 profiles: [L2] best-practices: [MASTG-BEST-0044] knowledge: [MASTG-KNOW-0121, MASTG-KNOW-0141] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0370.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0370.md index e2a47758982..2339cd92c82 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0370.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0370.md @@ -3,7 +3,7 @@ platform: ios title: Missing Input Validation in Custom URL Scheme Handlers id: MASTG-TEST-0370 type: [static, code] -weakness: MASWE-0058 +weakness: MASWE-0029 profiles: [L1, L2] best-practices: [MASTG-BEST-0045, MASTG-BEST-0054] knowledge: [MASTG-KNOW-0079] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0371.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0371.md index 5b53a11aecf..c5f8c5cdd3c 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0371.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0371.md @@ -3,7 +3,7 @@ platform: ios title: Missing Source Validation in Custom URL Scheme Handlers id: MASTG-TEST-0371 type: [static, code] -weakness: MASWE-0058 +weakness: MASWE-0029 profiles: [L1, L2] best-practices: [MASTG-BEST-0045, MASTG-BEST-0055] knowledge: [MASTG-KNOW-0079] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0376.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0376.md index 877e55f2c01..f4300212a36 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0376.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0376.md @@ -3,7 +3,7 @@ platform: ios title: References to Native Bridge APIs in WebViews id: MASTG-TEST-0376 type: [static, code] -weakness: MASWE-0069 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0058] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0377.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0377.md index 93d7a4c2a01..8048402bec3 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0377.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0377.md @@ -3,7 +3,7 @@ platform: ios title: References to `evaluateJavaScript` Used as Bridge Reply in `WKScriptMessageHandler` id: MASTG-TEST-0377 type: [static, code, manual] -weakness: MASWE-0069 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0062] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076, MASTG-KNOW-0139] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0378.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0378.md index dbb9dbbfea2..7d9e7b1c1e0 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0378.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0378.md @@ -3,7 +3,7 @@ platform: ios title: References to Password Fields in WebView-Loaded HTML id: MASTG-TEST-0378 type: [static, code, manual] -weakness: MASWE-0069 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0059, MASTG-BEST-0060] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076, MASTG-KNOW-0139] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0379.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0379.md index 7bdfc4dc79d..b2ffe517e08 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0379.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0379.md @@ -3,7 +3,7 @@ platform: ios title: References to `evaluateJavaScript` Without Content World Isolation id: MASTG-TEST-0379 type: [static, code] -weakness: MASWE-0069 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0061] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076, MASTG-KNOW-0139] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0380.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0380.md index 28a8850605d..60bca186fd3 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0380.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0380.md @@ -3,7 +3,7 @@ platform: ios title: References to `evaluateJavaScript` Writing Sensitive Data into WebView DOM id: MASTG-TEST-0380 type: [static, code, manual] -weakness: MASWE-0069 +weakness: MASWE-0034 best-practices: [MASTG-BEST-0059] profiles: [L1, L2] knowledge: [MASTG-KNOW-0076, MASTG-KNOW-0139] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0389.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0389.md index 1dcc13e4e7e..a8453a88375 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0389.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0389.md @@ -3,7 +3,7 @@ platform: ios title: References to the App-Wide Restriction of Custom Keyboards id: MASTG-TEST-0389 type: [static, code, manual] -weakness: MASWE-0061 +weakness: MASWE-0031 prerequisites: - identify-sensitive-data best-practices: [MASTG-BEST-0069] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md index 3eba211c972..1800b7f1e61 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0390.md @@ -3,7 +3,7 @@ platform: ios title: Full Access Requested by a Custom Keyboard Extension id: MASTG-TEST-0390 type: [static, code, manual] -weakness: MASWE-0061 +weakness: MASWE-0066 prerequisites: - identify-sensitive-data best-practices: [MASTG-BEST-0069] diff --git a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0395.md b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0395.md index 310b4031656..d230e1031e0 100644 --- a/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0395.md +++ b/tests-beta/ios/MASVS-PLATFORM/MASTG-TEST-0395.md @@ -3,7 +3,7 @@ platform: ios title: Missing Input Validation in Universal Link Handlers id: MASTG-TEST-0395 type: [static, code, manual] -weakness: MASWE-0058 +weakness: MASWE-0029 profiles: [L1, L2] best-practices: [MASTG-BEST-0072] knowledge: [MASTG-KNOW-0080] diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md index 8105ee4c613..075bca83af8 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md @@ -3,7 +3,7 @@ platform: ios title: Undeclared Known Tracking Domains id: MASTG-TEST-0281 type: [static, dynamic] -weakness: MASWE-0108 +weakness: MASWE-0074 profiles: [P] --- diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0360.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0360.md index 3a22151d2c1..f7ac5e2ccc2 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0360.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0360.md @@ -3,7 +3,7 @@ title: Purpose String Accuracy for Reachable Protected Resource Access platform: ios id: MASTG-TEST-0360 type: [static, config, manual] -weakness: MASWE-0117 +weakness: MASWE-0066 profiles: [P] best-practices: [MASTG-BEST-0051] knowledge: [MASTG-KNOW-0077] diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0361.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0361.md index 3412285141f..d2b410890fd 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0361.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0361.md @@ -3,7 +3,7 @@ title: Runtime Use of Protected Resource APIs Without Accurate Purpose Strings platform: ios id: MASTG-TEST-0361 type: [dynamic, hooks, manual] -weakness: MASWE-0117 +weakness: MASWE-0066 profiles: [P] best-practices: [MASTG-BEST-0051] knowledge: [MASTG-KNOW-0077] diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0362.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0362.md index 3be8d381f01..7ef2b6255fa 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0362.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0362.md @@ -3,7 +3,7 @@ title: Entitlements for Unjustified Capability Exposure platform: ios id: MASTG-TEST-0362 type: [static, package, manual] -weakness: MASWE-0117 +weakness: MASWE-0066 profiles: [P] best-practices: [MASTG-BEST-0051] knowledge: [MASTG-KNOW-0077] diff --git a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0363.md b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0363.md index b3ca6126b7d..816bc3bb3a0 100644 --- a/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0363.md +++ b/tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0363.md @@ -3,7 +3,7 @@ title: Runtime Use of Entitlement-Backed APIs for Unjustified Capability Exposur platform: ios id: MASTG-TEST-0363 type: [dynamic, hooks, manual] -weakness: MASWE-0117 +weakness: MASWE-0066 profiles: [P] best-practices: [MASTG-BEST-0051] knowledge: [MASTG-KNOW-0077] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0219.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0219.md index 1142553e300..e5a4bc416a0 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0219.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0219.md @@ -3,14 +3,14 @@ platform: ios title: Testing for Debugging Symbols id: MASTG-TEST-0219 type: [static, code] -weakness: MASWE-0093 +weakness: MASWE-0061 profiles: [R] knowledge: [MASTG-KNOW-0063] --- ## Overview -This test case checks for [debugging symbols](https://mas.owasp.org/MASWE/MASVS-RESILIENCE/MASWE-0093/) in all binaries contained in the app. +This test case checks for debugging symbols in all binaries contained in the app. Debugging symbols are added by the [compiler to ease development](https://developer.apple.com/documentation/xcode/building-your-app-to-include-debugging-information "Building your app to include debugging information") and allow symbolication of crashes. However, they can also be used to reverse engineer the app and should not be present in a released app. [Symbolication can also be performed](https://developer.apple.com/documentation/xcode/adding-identifiable-symbol-names-to-a-crash-report "Adding identifiable symbol names to a crash report") with a separate dSYM file. diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0220.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0220.md index 6d94bed22c1..56b2a142bce 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0220.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0220.md @@ -3,7 +3,7 @@ platform: ios title: Usage of Outdated Code Signature Format id: MASTG-TEST-0220 type: [static, code] -weakness: MASWE-0104 +weakness: MASWE-0056 profiles: [R] knowledge: [MASTG-KNOW-0058] --- diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0240.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0240.md index eb535baa24f..297a6bcd0cd 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0240.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0240.md @@ -3,7 +3,7 @@ platform: ios title: Jailbreak Detection in Code id: MASTG-TEST-0240 type: [static, code] -weakness: MASWE-0097 +weakness: MASWE-0051 false_negative_prone: true profiles: [R] knowledge: [MASTG-KNOW-0084] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0241.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0241.md index 3a5ca4f3f18..6a4f89df27a 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0241.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0241.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of Jailbreak Detection Techniques id: MASTG-TEST-0241 type: [dynamic, hooks] -weakness: MASWE-0097 +weakness: MASWE-0051 false_negative_prone: true profiles: [R] knowledge: [MASTG-KNOW-0084] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0246.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0246.md index b059dbd53b5..db764c98773 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0246.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0246.md @@ -4,7 +4,7 @@ title: Runtime Use of Secure Screen Lock Detection APIs id: MASTG-TEST-0246 apis: [LAContext.canEvaluatePolicy, kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly] type: [dynamic, hooks] -weakness: MASWE-0008 +weakness: MASWE-0017 best-practices: [] profiles: [L2] knowledge: [MASTG-KNOW-0056] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0248.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0248.md index 80a76b92751..a280b72d8e1 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0248.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0248.md @@ -4,7 +4,7 @@ title: References to APIs for Detecting Secure Screen Lock id: MASTG-TEST-0248 apis: [LAContext.canEvaluatePolicy, kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly] type: [static, code] -weakness: MASWE-0008 +weakness: MASWE-0017 best-practices: [] profiles: [L2] knowledge: [MASTG-KNOW-0056] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0261.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0261.md index 6c3edc24bb5..3740270b2a3 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0261.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0261.md @@ -3,7 +3,7 @@ platform: ios title: Debuggable Entitlement Enabled in the entitlements.plist id: MASTG-TEST-0261 type: [static, code] -weakness: MASWE-0067 +weakness: MASWE-0063 profiles: [R] knowledge: [MASTG-KNOW-0062] --- diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0354.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0354.md index 3feb7e1ef1f..a63f85de8ca 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0354.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0354.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of Hook Detection Techniques id: MASTG-TEST-0354 type: [dynamic, hooks] -weakness: MASWE-0107 +weakness: MASWE-0058 profiles: [R] knowledge: [MASTG-KNOW-0087] best-practices: [MASTG-BEST-0048] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0358.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0358.md index 72012de7c43..16b009ca971 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0358.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0358.md @@ -3,7 +3,7 @@ platform: ios title: Implementation Details Exposure Through Logging APIs id: MASTG-TEST-0358 type: [static, code] -weakness: MASWE-0094 +weakness: MASWE-0061 best-practices: [MASTG-BEST-0022] knowledge: [MASTG-KNOW-0064, MASTG-KNOW-0101] profiles: [R] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0359.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0359.md index 2796191c979..8f4bd72ad90 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0359.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0359.md @@ -3,7 +3,7 @@ platform: ios title: Implementation Details Exposure in Logs id: MASTG-TEST-0359 type: [dynamic, logs] -weakness: MASWE-0094 +weakness: MASWE-0061 best-practices: [MASTG-BEST-0022] knowledge: [MASTG-KNOW-0064, MASTG-KNOW-0101] profiles: [R] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0367.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0367.md index 38d8a7c6dce..de9dee2f259 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0367.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0367.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Use of Virtual Device Detection Techniques id: MASTG-TEST-0367 type: [dynamic] -weakness: MASWE-0099 +weakness: MASWE-0053 best-practices: [MASTG-BEST-0053] profiles: [R] knowledge: [MASTG-KNOW-0135] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0387.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0387.md index 0d082b289df..73bd9285b34 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0387.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0387.md @@ -4,7 +4,7 @@ title: References to Storage Integrity Check APIs id: MASTG-TEST-0387 apis: [HMAC, CCHmac, CCHmacFinal, CC_SHA256, CC_SHA512, SecKeyCreateSignature] type: [static, code, manual] -weakness: MASWE-0105 +weakness: MASWE-0057 false_negative_prone: true profiles: [R] knowledge: [MASTG-KNOW-0086] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0391.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0391.md index e0d7efd072a..b5542b57efa 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0391.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0391.md @@ -3,7 +3,7 @@ platform: ios title: Insufficient Obfuscation of Security-Relevant Native Code id: MASTG-TEST-0391 type: [static, package, manual] -weakness: MASWE-0089 +weakness: MASWE-0059 best-practices: [MASTG-BEST-0029] profiles: [R] knowledge: [MASTG-KNOW-0089] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0401.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0401.md index 722b99746fa..5335fae49e8 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0401.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0401.md @@ -4,7 +4,7 @@ title: References to Debugging Detection APIs id: MASTG-TEST-0401 apis: [ptrace, PT_DENY_ATTACH, sysctl, KERN_PROC_PID, P_TRACED, getppid, task_get_exception_ports, EXC_MASK_BREAKPOINT] type: [static, code, manual] -weakness: MASWE-0101 +weakness: MASWE-0064 best-practices: [MASTG-BEST-0029, MASTG-BEST-0074] profiles: [R] knowledge: [MASTG-KNOW-0085] diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0402.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0402.md index a214c3f610f..0000e9bfdce 100644 --- a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0402.md +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0402.md @@ -4,7 +4,7 @@ title: Runtime Use of Debugging Detection APIs id: MASTG-TEST-0402 apis: [ptrace, PT_DENY_ATTACH, sysctl, KERN_PROC_PID, P_TRACED, getppid, task_get_exception_ports, EXC_MASK_BREAKPOINT] type: [dynamic, hooks, manual] -weakness: MASWE-0101 +weakness: MASWE-0064 best-practices: [MASTG-BEST-0029, MASTG-BEST-0074] profiles: [R] knowledge: [MASTG-KNOW-0085] diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0215.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0215.md index 4e0213cfd7e..dd3d3468b85 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0215.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0215.md @@ -3,7 +3,7 @@ platform: ios title: Sensitive Data Not Marked For Backup Exclusion id: MASTG-TEST-0215 type: [static, code] -weakness: MASWE-0004 +weakness: MASWE-0006 best-practices: [MASTG-BEST-0023] profiles: [L1, L2, P] knowledge: [MASTG-KNOW-0102] diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0296.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0296.md index 01b5ec27abb..b119bad2c9f 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0296.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0296.md @@ -3,7 +3,7 @@ platform: ios title: Sensitive Data Exposure in Logs id: MASTG-TEST-0296 type: [dynamic, logs] -weakness: MASWE-0001 +weakness: MASWE-0005 prerequisites: - identify-sensitive-data best-practices: [MASTG-BEST-0022] diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0297.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0297.md index e583a714f62..70590eb0ccd 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0297.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0297.md @@ -3,7 +3,7 @@ platform: ios title: Sensitive Data Exposure Through Logging APIs id: MASTG-TEST-0297 type: [static, code] -weakness: MASWE-0001 +weakness: MASWE-0005 prerequisites: - identify-sensitive-data best-practices: [MASTG-BEST-0022] diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0298.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0298.md index 834e09c0e8f..8185b892e24 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0298.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0298.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Monitoring of Files Eligible for Backup id: MASTG-TEST-0298 type: [dynamic, hooks] -weakness: MASWE-0004 +weakness: MASWE-0006 best-practices: [MASTG-BEST-0023] profiles: [L1, L2, P] knowledge: [MASTG-KNOW-0102] diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0299.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0299.md index ad604d93119..7a88cd4bd29 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0299.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0299.md @@ -6,7 +6,7 @@ type: [dynamic, filesystem] prerequisites: - identify-sensitive-data profiles: [L1] -weakness: MASWE-0006 +weakness: MASWE-0001 best-practices: [MASTG-BEST-0024] knowledge: [MASTG-KNOW-0082, MASTG-KNOW-0091, MASTG-KNOW-0108] --- diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0300.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0300.md index 71003b6e717..4129dc4f510 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0300.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0300.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0300 type: [static, code] profiles: [L2] best-practices: [MASTG-BEST-0024] -weakness: MASWE-0006 +weakness: MASWE-0001 knowledge: [MASTG-KNOW-0091, MASTG-KNOW-0057, MASTG-KNOW-0108] --- diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0301.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0301.md index 3f4dd31dae5..7f24967f0ff 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0301.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0301.md @@ -4,7 +4,7 @@ title: Runtime Use of APIs for Storing Unencrypted Data in Private Storage id: MASTG-TEST-0301 type: [dynamic, hooks] profiles: [L2] -weakness: MASWE-0006 +weakness: MASWE-0001 best-practices: [MASTG-BEST-0024] knowledge: [MASTG-KNOW-0091, MASTG-KNOW-0057, MASTG-KNOW-0108] --- diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0302.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0302.md index c604f89f995..2fe5d691c8e 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0302.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0302.md @@ -6,7 +6,7 @@ type: [dynamic, filesystem] prerequisites: - identify-sensitive-data profiles: [L2] -weakness: MASWE-0006 +weakness: MASWE-0001 best-practices: [MASTG-BEST-0024] knowledge: [MASTG-KNOW-0108] --- diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0303.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0303.md index 1631d12d955..3c536548b61 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0303.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0303.md @@ -5,7 +5,7 @@ id: MASTG-TEST-0303 type: [static, code] profiles: [L1, L2] best-practices: [MASTG-BEST-0024] -weakness: MASWE-0007 +weakness: MASWE-0002 knowledge: [MASTG-KNOW-0122, MASTG-KNOW-0091, MASTG-KNOW-0057, MASTG-KNOW-0108] --- diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0313.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0313.md index e6bca86576a..71bc21fd357 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0313.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0313.md @@ -3,7 +3,7 @@ platform: ios title: References to APIs for Preventing Keyboard Caching of Text Fields id: MASTG-TEST-0313 type: [static, code, manual] -weakness: MASWE-0053 +weakness: MASWE-0036 profiles: [L2] best-practices: [MASTG-BEST-0026] knowledge: [MASTG-KNOW-0100] diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0314.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0314.md index c69145cabd1..6d584e73c2f 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0314.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0314.md @@ -3,7 +3,7 @@ platform: ios title: Runtime Monitoring of Text Fields Eligible for Keyboard Caching id: MASTG-TEST-0314 type: [dynamic, hooks] -weakness: MASWE-0053 +weakness: MASWE-0036 profiles: [L2] prerequisites: - identify-sensitive-data diff --git a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0388.md b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0388.md index bafd3128480..9b3ab0ada71 100644 --- a/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0388.md +++ b/tests-beta/ios/MASVS-STORAGE/MASTG-TEST-0388.md @@ -3,7 +3,7 @@ platform: ios title: References to Sensitive Data Stored Unprotected in Shared App Group Containers id: MASTG-TEST-0388 type: [static, code, manual] -weakness: MASWE-0006 +weakness: MASWE-0001 prerequisites: - identify-sensitive-data best-practices: [MASTG-BEST-0068]