Port MASTG-TEST-0069: Testing App Permissions (ios) (by @appknox) by sk3l10x1ng · Pull Request #3673 · OWASP/mastg

sk3l10x1ng · 2026-01-30T09:02:35Z

serek8 · 2026-02-09T14:30:29Z

tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0x69-1.md

+
+If an app declares entitlements that are not justified by its core functionality, it gains access to privileged capabilities beyond standard sandbox restrictions — such as HomeKit, HealthKit, VPN configuration, or iCloud containers. This can lead to unauthorized access to sensitive user data, expanded attack surface, or privacy violations through excessive privilege.
+
+On iOS, entitlements are declared in the provisioning profile (`embedded.mobileprovision`) as a cryptographically signed property list. They represent permissions granted by Apple's provisioning system for capabilities that go beyond the default app sandbox.


embedded.mobileprovision is available only on apps built for: Development, Ad Hoc distribution, Enterprise distribution. We might need to mention it, so the testers won't have issues when searching for them?

serek8 · 2026-02-09T15:27:27Z

demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69/MastgTest.swift

+    func requestAllPermissionsSequentially(completion: @escaping (String) -> Void) {
+        self.completionHandler = completion
+        resetState()
+        requestLocationPermission()


Just for clarity:

Suggested change

requestLocationPermission()

requestLocationPermission()

// Subsequent requests are triggered within delegates or callbacks

serek8 · 2026-02-09T16:13:04Z

demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69/MastgTest.swift

+
+    private func requestLocationPermission() {
+        locationManager.requestWhenInUseAuthorization()
+        locationManager.requestAlwaysAuthorization()


Shouldn't we call requestAlwaysAuthorization() after the request for requestWhenInUseAuthorization() finishes?

In other words, why don't we call requestAlwaysAuthorization() from func locationManager(.., didChangeAuthorization status: CLAuthorizationStatus)

serek8 · 2026-02-09T16:40:26Z

demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69/MastgTest.swift

+        completionHandler?(results)
+    }
+
+    func locationManager(_ manager: CLLocationManager, didChangeAuthorization status: CLAuthorizationStatus) {


Isn't this API deprecated?
https://developer.apple.com/documentation/corelocation/cllocationmanagerdelegate/locationmanager(_:didchangeauthorization:)

serek8 · 2026-02-09T16:42:48Z

demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69/MastgTest.swift

+        if granted {
+            manager.startUpdatingLocation()
+        }
+        requestCameraPermission()


Shouldn't we call it on the main thread similarly to the other cases?

Suggested change

requestCameraPermission()

DispatchQueue.main.async {

requestCameraPermission()

}

Or even wrap a bigger part of code?

serek8 · 2026-02-10T11:35:39Z

tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0x69-2.md

+
+## Overview
+
+If an app embeds entitlements in its binary that are not justified by its core functionality, it gains access to privileged capabilities such as HomeKit, HealthKit, VPN configuration, or shared app groups. This can lead to unauthorized access to sensitive user data, an expanded attack surface, or privacy violations through excessive privilege.


Can we have a Knowledge page about embedded entitlements and external one. Just to clarify why there are both places. We could also describe there that an app needs to have a usage description in Info.plist

Copilot

Pull request overview

This PR ports the legacy iOS test MASTG-TEST-0069 (Testing App Permissions) to the v2 structure by deprecating the v1 test and adding new v2 test(s), an iOS technique page, and multiple iOS demos intended to demonstrate permission declarations and runtime permission usage.

Changes:

Deprecates the v1 test tests/ios/MASVS-PLATFORM/MASTG-TEST-0069.md and links it to new v2 coverage.
Adds four new v2 iOS test pages related to purpose strings and entitlements under tests-beta/ios/.
Adds a new iOS technique page and several new iOS demos (static and dynamic) with scripts and captured outputs.

Reviewed changes

Copilot reviewed 20 out of 23 changed files in this pull request and generated 30 comments.

Show a summary per file

File	Description
tests/ios/MASVS-PLATFORM/MASTG-TEST-0069.md	Marks the v1 test as deprecated and attempts to point to v2 replacements via `covered_by`.
tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0x69.md	Adds a new v2 static test for excessive `Info.plist` purpose strings.
tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0x69-1.md	Adds a new v2 static test for entitlements in `embedded.mobileprovision`.
tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0x69-2.md	Adds a new v2 static test for entitlements embedded in the app binary.
tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0x69-3.md	Adds a new v2 dynamic test for runtime tracing of permission API calls.
techniques/ios/MASTG-TECH-0x69.md	Adds a technique page intended to explain how to obtain and review iOS permissions/capabilities.
demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69/MASTG-DEMO-0x69.md	Adds a demo documenting purpose strings in `Info.plist`.
demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69/MastgTest.swift	Adds a Swift sample that requests many permissions sequentially for demo purposes.
demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69/Info.plist	Adds a demo `Info.plist` artifact used by the purpose-string demo.
demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69/run.sh	Adds an automation script to extract/grep purpose-string keys from `Info.plist`.
demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69/output.txt	Adds captured output listing `UsageDescription` keys found in the plist.
demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69/embedded.mobileprovision	Adds a provisioning profile artifact used by entitlement demos.
demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69-1/MASTG-DEMO-0x69-1.md	Adds a demo documenting entitlements in `embedded.mobileprovision`.
demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69-1/run.sh	Adds an automation script to decode the provisioning profile with `security cms`.
demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69-1/output.txt	Adds captured decoded provisioning-profile output.
demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69-2/MASTG-DEMO-0x69-2.md	Adds a demo documenting entitlements extracted from the signed binary.
demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69-2/run.sh	Adds an automation script using `rabin2` to extract entitlements.
demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69-2/output.txt	Adds captured entitlements output.
demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69-3/MASTG-DEMO-0x69-3.md	Adds a demo documenting runtime tracing of permission APIs with Frida.
demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69-3/run.sh	Adds a Frida spawn script for the runtime tracing demo.
demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69-3/output.txt	Adds captured Frida output showing permission API calls.
demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69-3/script.js	Adds a Frida script intended to hook many iOS permission-related APIs.

tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0x69-1.md

techniques/ios/MASTG-TECH-0x69.md

demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69/MastgTest.swift

Copilot · 2026-02-10T21:38:27Z

tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0x69.md

+id: MASTG-TEST-0x69
+type: [static]
+weakness: MASWE-0117
+profiles:  [L1, L2]


For MASVS-PRIVACY tests, profiles is typically [P] (e.g., tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0281.md:7 and tests-beta/android/MASVS-PRIVACY/MASTG-TEST-0254.md:7). Using [L1, L2] here looks inconsistent; please switch to [P] (or justify why this permission-privacy test belongs to L1/L2).

Copilot · 2026-02-10T21:38:27Z

demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69/MASTG-DEMO-0x69.md

+## Observation
+
+The output lists 16 purpose strings found in the `Info.plist` file, indicating the app declares access to a wide range of protected resources.
+
+{{ output.txt }}


The demo claims it finds “purpose strings” and the test expects key/value pairs, but run.sh only greps for UsageDescription and the committed output.txt contains only <key>...UsageDescription</key> entries (no <string>...). Update the script/output to include the associated description values, or adjust the text to accurately state that only keys are collected.

True, it's not just about the keys being there. They also MUST have an actual appropriate description that serves as rationale about the need for that permission.

demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69-3/MASTG-DEMO-0x69-3.md

tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0x69.md

tests-beta/ios/MASVS-PRIVACY/MASTG-TEST-0x69-2.md

Copilot · 2026-02-10T21:38:33Z

demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69-1/run.sh

@@ -0,0 +1 @@
+security cms -D -i ../MASTG-DEMO-0x69/embedded.mobileprovision  > output.txt


run.sh is missing a shebang (other demos use #!/bin/bash) and basic safety flags. Add a shebang and set -euo pipefail so the demo fails fast and can be executed consistently by automation.

demos/ios/MASVS-PRIVACY/MASTG-DEMO-0x69-2/MASTG-DEMO-0x69-2.md

sk3l10x1ng and others added 3 commits December 13, 2025 20:18

added demo

4447073

demo files and deprecation note added

77707f5

Merge branch 'master' into port_mastg_test_0069

01f0dc4

cpholguera changed the title ~~Port MASTG-TEST-0034: Testing App Permissions (ios) (by @appknox)~~ Port MASTG-TEST-0069: Testing App Permissions (ios) (by @appknox) Jan 30, 2026

fix

a88b6d2

serek8 reviewed Feb 10, 2026

View reviewed changes

Merge branch 'master' into port_mastg_test_0069

a6324ac

cpholguera requested a review from Copilot February 10, 2026 21:26

Copilot started reviewing on behalf of cpholguera February 10, 2026 21:26 View session

Copilot AI reviewed Feb 10, 2026

View reviewed changes


		If an app declares entitlements that are not justified by its core functionality, it gains access to privileged capabilities beyond standard sandbox restrictions — such as HomeKit, HealthKit, VPN configuration, or iCloud containers. This can lead to unauthorized access to sensitive user data, expanded attack surface, or privacy violations through excessive privilege.

		On iOS, entitlements are declared in the provisioning profile (`embedded.mobileprovision`) as a cryptographically signed property list. They represent permissions granted by Apple's provisioning system for capabilities that go beyond the default app sandbox.

	requestLocationPermission()
	requestLocationPermission()
	// Subsequent requests are triggered within delegates or callbacks


		## Overview

		If an app embeds entitlements in its binary that are not justified by its core functionality, it gains access to privileged capabilities such as HomeKit, HealthKit, VPN configuration, or shared app groups. This can lead to unauthorized access to sensitive user data, an expanded attack surface, or privacy violations through excessive privilege.

		@@ -0,0 +1 @@
		security cms -D -i ../MASTG-DEMO-0x69/embedded.mobileprovision > output.txt No newline at end of file

Uh oh!

Conversation

sk3l10x1ng commented Jan 30, 2026

Uh oh!

serek8 Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

serek8 Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

serek8 Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

serek8 Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

serek8 Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

serek8 Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

cpholguera Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants