Repository navigation
feat(mobile): add Security Misconfiguration - #1118
Open
SeanDuggan wants to merge 24 commits into
Open
SeanDuggan wants to merge 24 commits into
SeanDuggan wants to merge 24 commits into
Conversation
Adds the Gradle project, manifest, resources, launch/login/main activities, navigation, preferences, authentication, key validation and progress tracking utilities, and the home, progress, scoreboard and ADB reference screens. Lesson and challenge screens referenced by the navigation graph are added in the following PRs, so those destinations are not usable until then. Part of the split of OWASP#894 (mobile app).
Disable cleartext traffic app-wide via a network security config and reject non-https server URLs at login, registration and key validation. Debug builds additionally trust user-installed CAs for local development.
The shell now builds with an empty KeyValidator.Module enum and empty nav, menu and module-info registries. Each lesson/challenge category PR registers its own entries. Removes the myapp://open deep link and the KeyValidator unit test, which return with the first category.
Removes lesson/challenge strings and the Insufficient Cryptography ADB reference card. These return with their own category PRs.
The app asks /mobileModuleStatus which modules the signed-in student can open and greys out the rest in the navigation drawer and progress list, with the server's reason shown when tapped. This mirrors the platform's open floor / CTF rules: module closed, event not running, module blocked. Advisory only: the server re-checks every module start and key request. It fails open, so signed-out or offline use and failed requests grey out nothing. Status refreshes on resume, drawer open, sign in and sign out.
…JDK path Changing server_preference while signed in kept the old server's session cookie, so it would be sent to the new server. Log out when the server actually changes. Remove org.gradle.java.home, which pinned a Windows Android Studio path and overrode JAVA_HOME on other machines.
Replace the individually listed local planning docs with a single *.md rule.
Remove CHALLENGE_SOLUTIONS.txt and missing_challenges.txt, which refer to no files in the repository.
The logcat grep example rendered a literal "search_term" on the ADB Commands screen.
Adds the Mobile Security Misconfiguration (OWASP M8) lesson and Challenge 1 to the Android app, with the matching server-side module registrations. Lesson: the learner scans the app's activities, finds the debug screen that is exported when it should not be, and launches it with `adb shell am start` to retrieve the key. Challenge: the app ships with backup enabled and stores the key in plaintext shared preferences; the learner extracts the app data and reads it. Server-side: coreSchema.sql module rows and cheat sheets, solutions, moduleNames, level-classification.toml topic, and the Setter.java mobile category clause. Also adds the lesson/challenge JSPs and i18n properties and a docs/mobile-levels.md entry. Scoring depends on the Mobile* servlets from the server-API PR.
…iguration' into mobile-split/13-security-misconfiguration
Run generate-level-catalogue.py so docs/mobile-levels.md matches coreSchema.sql and level-classification.toml (fixes the docs-build catalogue check).
The Android app lives in mobile/, not mobile/MobileShepherd/.
…l' into mobile-split/04-android-app-shell
Insecure Communication is deferred to 4.0.1. Remove its key hash entries, ProGuard rules and the cleartext-traffic comment.
…-security-misconfiguration
…ng to it The lesson footer now names the risk (for example 'OWASP Mobile Top 10 - M4: Insufficient Input/Output Validation') without an external URL, and no uri.properties key is required.
Drop the About dialog button that opened owasp.org and the unused hidden Top 10 FAB with its string. Lessons now name the relevant risk as plain text.
…-security-misconfiguration
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the Security Misconfiguration (OWASP Mobile Top 10 M8) lesson and one challenge to the Mobile Shepherd app, with the matching server-side module content. Part of the #894 split. This PR covers one category only.
What's included
Android app
SecurityMisconfigLessonFragment: a "Scan App Components" button that lists the app's activities (viaPackageManager) and marks each EXPORTED or Safe. The lesson has one vulnerability: a debug activity (MisconfigLessonSecretActivity) that is exported when it should not be. The student launches it withadb shell am start -n org.owasp.mobileshepherd/<activity>to retrieve the key.SecurityMisconfigChallenge2Fragment("Security Misconfiguration 1"): the app has ADB backup enabled; the student extracts the app data and finds the plaintext key.ModuleInfoHelperinfo dialogs andKeyValidatormodule ids. The ids are the server's string names, because the app sends them to/mobileModuleStart,/mobileFlagGetand/mobileFlagSubmit.Server / content
coreSchema.sqlrows and cheat-sheet entries,solutions.properties,moduleNames.properties.level-classification.tomland theSetter.javamobile category where clause.docs/mobile-levels.mdupdated.Dependencies
Mobile*servlets from feat(mobile): add Mobile* servlets for the unified Android app #1062 and the app shell from feat(mobile): android app shell #1068. Those must merge first, and this branch will be rebased afterwards.owasp.mobile.m8.securityMisconfigurationinuri.properties. That key is not ondevyet, so the link renders "null" until the mobileuri.propertieskeys are added. I plan to send that as a small separate PR.Testing
assembleDebugandtestDebugUnitTestpass.core.results.adb backupstep returns a 0-byte file on API 37. A pre-API-31 emulator or a device that still supports backup is needed to exercise it.Notes
Setter.javacategory where clause and the module-registration files.