Port MAST-TEST-0019 (by @guardsquare) by titze · Pull Request #3030 · OWASP/mastg

titze · 2024-11-04T18:49:39Z

This PR closes #2959.

Adds new draft tests:

Using low-level APIs (e.g. Socket) to set up a custom HTTP connection.
Cleartext traffic is allowed for cross-platform frameworks
Runtime Use of Network APIs Transmitting Cleartext Traffic (Frida)

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-2.md

cpholguera · 2024-11-05T11:15:00Z

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-2.md

+platform: android
+id: MASTG-TEST-0x19-2
+type: [static]
+weakness: MASWE-0050


Wouldn't https://mas.owasp.org/MASWE/MASVS-NETWORK/MASWE-0052/ be a better fit?

cpholguera · 2024-11-05T11:47:51Z

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-2.md

+1. Reverse engineer the app (@MASTG-TECH-0017).
+2. Run a static analysis (@MASTG-TECH-0014) tool and look for all usages of `SSLSocket`.
+3. Verify each usage performans manual hostname verification correctly.


After changing the above, we should update the steps and be more specific. We can tell them to search for uses of SSLSocket that are not using HostnameVerifier, or that are using it but potentially incorrectly (as indicated above).

Examples (not for linking here, but maybe to use later for demos):

https://semgrep.dev/r?q=problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification

https://semgrep.dev/playground/r/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier?editorMode=advanced

cpholguera · 2024-11-05T11:55:30Z

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-3.md

+Since Android 9 (API level 28) cleartext HTTP traffic is blocked by default (thanks to the [default Network Security Configuration](../../../Document/0x05g-Testing-Network-Communication.md#default-configurations)) but there are multiple ways in which an application can still send it:
+
+- Setting the [`android:usesCleartextTraffic`](https://developer.android.com/guide/topics/manifest/application-element#usesCleartextTraffic "Android documentation - usesCleartextTraffic flag") attribute of the `<application>` tag in the AndroidManifest.xml file. Note that this flag is ignored in case the Network Security Configuration is configured.
+- Configuring the Network Security Configuration to enable cleartext traffic by setting the `cleartextTrafficPermitted` attribute to true on `<domain-config>` elements.


Suggested change

- Configuring the Network Security Configuration to enable cleartext traffic by setting the `cleartextTrafficPermitted` attribute to true on `<domain-config>` elements.

- Configuring the [Network Security Configuration to enable cleartext traffic](https://developer.android.com/privacy-and-security/security-config#CleartextTrafficPermitted) by setting the `cleartextTrafficPermitted` attribute to true on `<domain-config>` elements.

cpholguera · 2024-11-05T12:00:25Z

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-3.md

+
+1. Reverse engineer the app (@MASTG-TECH-0017).
+2. Verify `usesCleartextTraffic` is not set to `true` in the AndroidManifest.xml
+3. Inspect the AndroidManifest.xml, and check if a `networkSecurityConfig` is set in the `<application>` tag. If yes, inspect the referenced file, and make sure `cleartextTrafficPermitted` is not set to `true` for any domain.


Suggested change

3. Inspect the AndroidManifest.xml, and check if a `networkSecurityConfig` is set in the `<application>` tag. If yes, inspect the referenced file, and make sure `cleartextTrafficPermitted` is not set to `true` for any domain.

3. Inspect the AndroidManifest.xml, and check if a `networkSecurityConfig` is set in the `<application>` tag. If yes, inspect the referenced file, and make sure that `cleartextTrafficPermitted` is not set to `true`

- globally in the `<base-config>` element.

- or for specific domains in their `<domain-config>` elements.

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-2.md

cpholguera · 2024-11-05T12:27:16Z

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-3.md

+
+## Observation
+
+The output contains a list of domains for which cleartext traffic is enabled.


More accurate like this I think.

Suggested change

The output contains a list of domains for which cleartext traffic is enabled.

The output contains a list of configurations allowing for cleartext traffic.

cpholguera · 2024-11-05T12:28:58Z

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-4.md

+weakness: MASWE-0050
+---
+
+## Overview
+
+Cross-platform frameworks (e.g. Flutter, React native, ...), typically have their own implementations for HTTP libraries, where cleartext traffic can be allowed.
+
+## Steps
+
+## Observation
+
+## Evaluation


We can do this as long as there's a new Issue. Please mention the issue in the PR description.

Suggested change

weakness: MASWE-0050

---

## Overview

Cross-platform frameworks (e.g. Flutter, React native, ...), typically have their own implementations for HTTP libraries, where cleartext traffic can be allowed.

## Steps

## Observation

## Evaluation

weakness: MASWE-0050

status: draft

note: Cross-platform frameworks (e.g. Flutter, React native, ...), typically have their own implementations for HTTP libraries, where cleartext traffic can be allowed.

---

cpholguera · 2024-11-05T12:35:10Z

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-5.md

+
+## Overview
+
+Intercept the tested app's incoming and outgoing network traffic and make sure that this traffic is encrypted.


Rephrase to highlight more why we're doing this test, what's the value/benefit. For example, this are REAL cleartext connections not just potential ones (as it is the case if we just retrieve the hardcoded URLs).

Limitations:

thanks to doing this we can know what domains are contacted in cleartext but we don't know which location in the code is producing this traffic, right? (we can add a note in the Evaluation)

this depends on how much of the app you can exercise so you cannot expect full coverage

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-5.md

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-1.md

cpholguera · 2024-12-07T10:07:02Z

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-1.md

+
+## Evaluation
+
+The test case fails if any HTTP URLs are used for communication.


See my new comment above, in the evaluation we can now use the output and explain how to discard false positives. This is not an easy task, but there are some things we can do to get a better list.

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-3.md

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-5.md

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-3.md

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-4.md

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0x19-2.md

…eir usage

…t cases

…ST-0239

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0239.md

…lated test references

… weaknesses

…TG-TEST-0239

* Port MASTG test 0019 * Fix markdown * Review feedback * Add Frida to trace traffic * Apply suggestions from code review * Refine MASTG-TEST-0x19-1.md for clarity on hardcoded HTTP URLs and their usage * Update covered_by references in MASTG-TEST-0019.md to reflect new test cases * Rename MASTG-TEST-0x19 test cases to MASTG-TEST-0233 through MASTG-TEST-0239 * update IDs * Update MASTG-TEST-0233 to modify title, improve evaluation and add related test references * Update MASTG-TEST-0239 note to clarify potential support for multiple weaknesses * Add --- at end of files for MASTG-TEST-0237, MASTG-TEST-0238, and MASTG-TEST-0239 * rm bare URL --------- Co-authored-by: Carlos Holguera <perezholguera@gmail.com>

titze added 2 commits November 4, 2024 18:48

Port MASTG test 0019

d3cb11b

Fix markdown

1f8be5d

cpholguera added the MASTG Refactor label Nov 5, 2024

cpholguera requested changes Nov 5, 2024

View reviewed changes

titze added 2 commits November 5, 2024 17:50

Review feedback

355ea51

Add Frida to trace traffic

4127f2c

titze requested a review from cpholguera November 5, 2024 18:14

cpholguera added the changes-done label Nov 26, 2024

cpholguera requested changes Dec 7, 2024

View reviewed changes

cpholguera added 4 commits December 7, 2024 15:14

Apply suggestions from code review

2898338

Refine MASTG-TEST-0x19-1.md for clarity on hardcoded HTTP URLs and th…

8cb1160

…eir usage

Update covered_by references in MASTG-TEST-0019.md to reflect new tes…

b047054

…t cases

Rename MASTG-TEST-0x19 test cases to MASTG-TEST-0233 through MASTG-TE…

e89ee89

…ST-0239

cpholguera reviewed Dec 7, 2024

View reviewed changes

tests-beta/android/MASVS-NETWORK/MASTG-TEST-0239.md Show resolved Hide resolved

cpholguera added 5 commits December 7, 2024 16:12

update IDs

cbf0815

Update MASTG-TEST-0233 to modify title, improve evaluation and add re…

2e0f6d3

…lated test references

Update MASTG-TEST-0239 note to clarify potential support for multiple…

707f147

… weaknesses

Add --- at end of files for MASTG-TEST-0237, MASTG-TEST-0238, and MAS…

dc19857

…TG-TEST-0239

rm bare URL

5601893

cpholguera approved these changes Dec 7, 2024

View reviewed changes

cpholguera removed the changes-done label Dec 7, 2024

cpholguera merged commit bc93250 into OWASP:master Dec 7, 2024

titze deleted the port-MASTG-TEST-0019 branch December 9, 2024 08:21

cpholguera changed the title ~~Port MASTG test 0019 (by @guardsquare)~~ Port MAST-TEST-0019 (by @guardsquare) May 15, 2025

cpholguera mentioned this pull request Jan 20, 2026

Added/Updated Android Network Knowledge, Test and Demo #3617

Draft

2 tasks

	- Configuring the Network Security Configuration to enable cleartext traffic by setting the `cleartextTrafficPermitted` attribute to true on `<domain-config>` elements.
	- Configuring the [Network Security Configuration to enable cleartext traffic](https://developer.android.com/privacy-and-security/security-config#CleartextTrafficPermitted) by setting the `cleartextTrafficPermitted` attribute to true on `<domain-config>` elements.

-. Inspect the AndroidManifest.xml, and check if a `networkSecurityConfig` is set in the `<application>` tag. If yes, inspect the referenced file, and make sure `cleartextTrafficPermitted` is not set to `true` for any domain.
+. Inspect the AndroidManifest.xml, and check if a `networkSecurityConfig` is set in the `<application>` tag. If yes, inspect the referenced file, and make sure that `cleartextTrafficPermitted` is not set to `true`
+  - globally in the `<base-config>` element.
+  - or for specific domains in their `<domain-config>` elements.


		## Observation

		The output contains a list of domains for which cleartext traffic is enabled.

	The output contains a list of domains for which cleartext traffic is enabled.
	The output contains a list of configurations allowing for cleartext traffic.


		## Overview

		Intercept the tested app's incoming and outgoing network traffic and make sure that this traffic is encrypted.


		## Evaluation

		The test case fails if any HTTP URLs are used for communication.

Uh oh!

Conversation

titze commented Nov 4, 2024 • edited by cpholguera Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

cpholguera Nov 5, 2024

Choose a reason for hiding this comment

Uh oh!

cpholguera Nov 5, 2024

Choose a reason for hiding this comment

Uh oh!

cpholguera Nov 5, 2024

Choose a reason for hiding this comment

Uh oh!

cpholguera Nov 5, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cpholguera Nov 5, 2024

Choose a reason for hiding this comment

Uh oh!

cpholguera Nov 5, 2024

Choose a reason for hiding this comment

Uh oh!

cpholguera Nov 5, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cpholguera Dec 7, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

titze commented Nov 4, 2024 •

edited by cpholguera

Loading

cpholguera Dec 7, 2024 •

edited

Loading