From c52b8ad9421b84bc404dcf3003c7f95692418d9f Mon Sep 17 00:00:00 2001 From: Jeel Date: Mon, 16 Dec 2024 17:05:11 +0530 Subject: [PATCH] MASTG-082-Debugging-Detection --- .../ios/MASVS-RESILIENCE/MASTG-TEST-0x82.md | 24 +++++++++++++++++++ tests/ios/MASVS-RESILIENCE/MASTG-TEST-0082.md | 3 +++ 2 files changed, 27 insertions(+) create mode 100644 tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0x82.md diff --git a/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0x82.md b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0x82.md new file mode 100644 index 0000000000..974af0bc6a --- /dev/null +++ b/tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0x82.md @@ -0,0 +1,24 @@ +--- +platform: ios +title: Testing Whether the App is Debuggable +id: MASTG-TEST-0x82 +type: [static, dynamic] +weakness: MASWE-0101 +--- + +## Overview + +The test evaluates whether an iOS application is configured to allow debugging. If an app is debuggable, attackers can leverage debugging tools to reverse-engineer the application, analyse its runtime behaviour, and potentially compromise sensitive data or functionality. + +## Steps + +1. Run a static analysis using @MASTG-TOOL-0111 to extract entitlements from the binary to check the value of the `get-task-allow` key and is set to `true`. +2. Run a [dynamic analysis](../../../techniques/ios/MASTG-TECH-0084.md) using @MASTG-TOOL-0057. + +## Observation + +The entitlement get-task-allow is false, and anti-reverse engineering measures prevent debugger attachment attempts. + +## Evaluation + +The test fails as the entitlement get-task-allow is true, allowing debugger attachment. diff --git a/tests/ios/MASVS-RESILIENCE/MASTG-TEST-0082.md b/tests/ios/MASVS-RESILIENCE/MASTG-TEST-0082.md index 523ebd1838..33649a81f7 100644 --- a/tests/ios/MASVS-RESILIENCE/MASTG-TEST-0082.md +++ b/tests/ios/MASVS-RESILIENCE/MASTG-TEST-0082.md @@ -7,6 +7,9 @@ platform: ios title: Testing whether the App is Debuggable masvs_v1_levels: - R +status: deprecated +covered_by: [MASTG-TEST-0x82] +deprecation_note: New version available in MASTG V2 --- ## Overview