MASTG Demos

About the MASTG Demos

Demos are write-ups that demonstrate the weakness in a sample application. They can be seen as a practical application of the tests.

Each demo contains the following information:

  • Overview: A brief description of the demo.
  • Sample: A code snippet that demonstrates the weakness.
  • Steps: The specific steps followed to identify the weakness in the sample code.
  • Observation: A description of the results of running the test against the code.
  • Evaluation: The evaluation of the results of the test explaining why it failed or passed.

All demos in the MASTG are written in markdown and are located in the demos directory.

Each demo directory contains the following files:

  • MASTG-DEMO-****.md: The markdown file containing the demo write-up.
  • MastgTest.kt: The Kotlin code snippet that demonstrates the weakness.
  • output.txt: The output of running the test against the code.
  • run.sh: The script that runs the test against the code.

Depending on the test, the demo may contain additional files, such as configuration files or additional code snippets, scripts (e.g. in Python), or output files. The samples are written in Kotlin or Swift, depending on the platform. In some cases, the samples will also include configuration files such as AndroidManifest.xml or Info.plist.

If the sample can be decompiled, the decompiled code is also provided in the demo. This is useful for understanding the code in the context of the application.

Demos are required to be fully self-contained and should not rely on external resources or dependencies. This ensures that the demos can be run independently and that the results are reproducible. They must be proven to work on the provided sample applications and must be tested thoroughly before being included in the MASTG.

MAS Test Apps

In order for our new demos to be reliable and consistent, we needed to make sure that the results were reproducible and could be tested and validated. This is where the new MASTestApps came in. They are two very simple apps that mirror each other on Android and iOS. Demos must be implemented using these apps. This helps the reviewer and serves as a playground to create and practice your MAS skills.

Simply clone the repository and follow the instructions to run the apps on your local machine. Use them to validate the demos before submitting them to the MASTG.

IMPORTANT DISCLAIMER

Please read this disclaimer carefully as it contains essential information regarding the use of the Mobile Application Security Testing Guide (MASTG).

  • Scope and Purpose of MASTG Artifacts: Each new release of the MASTG will include a collection of testing resources such as Static Application Security Testing (SAST) rules, Dynamic Application Security Testing (DAST) scripts, and other relevant artifacts. However, it's crucial to understand that these resources are not intended to provide a comprehensive solution for all your security testing needs.

  • Baseline: The resources provided in the MASTG serve as a baseline or starting point. They are designed to be used as references and learning tools in the field of mobile application security. While they offer valuable insights and guidelines, they should be used as a foundation upon which you can build and tailor your own specific automation and security testing processes.

  • No Guarantee of Complete Coverage: The OWASP Mobile Application Security (MAS) project, the entity behind the MASTG, explicitly does not assume responsibility or guarantee that the provided code and resources will identify all possible vulnerabilities in mobile applications. Security testing is a complex and evolving field, and the effectiveness of any set of tools or rules varies depending on numerous factors, including the specific context of the application being tested, the experience of the tester, and the changing landscape of security threats.

  • Potential for False Positives and Negatives: Users of the MASTG should be aware that the testing resources might generate a significant number of false positives (incorrectly identifying non-issues as vulnerabilities) and false negatives (failing to detect actual vulnerabilities). It is essential to approach the results with a critical and informed mindset, and supplement automated testing with manual review and analysis.

  • Continuous Learning and Adaptation: The field of mobile application security is continuously evolving. As such, the MASTG resources should be seen as a living body of knowledge, subject to updates and improvements. Users are encouraged to stay informed about the latest security trends and techniques and to actively contribute to the evolution of these resources.

By using the MASTG, you acknowledge and agree to these limitations. It's recommended to combine the use of MASTG resources with other security practices and tools to achieve a more comprehensive and effective security testing strategy for your mobile applications.

ID Title Platform Test Status
MASTG-DEMO-0090 Uses of BiometricPrompt with Event-Bound Authentication with semgrep platform:android MASTG-TEST-0327 currentstatus:current
MASTG-DEMO-0089 Uses of BiometricPrompt with Device Credential Fallback with semgrep platform:android MASTG-TEST-0326 currentstatus:current
MASTG-DEMO-0093 Uses of Extended Validity Duration in setUserAuthenticationParameters with semgrep platform:android MASTG-TEST-0330 currentstatus:current
MASTG-DEMO-0092 Uses of BiometricPrompt without Explicit User Confirmation with semgrep platform:android MASTG-TEST-0329 currentstatus:current
MASTG-DEMO-0091 Uses of setInvalidatedByBiometricEnrollment with semgrep platform:android MASTG-TEST-0328 currentstatus:current
MASTG-DEMO-0116 Native Anti-Debugging Checks with TracerPid and ptrace platform:android MASTG-TEST-0352 currentstatus:current
MASTG-DEMO-0108 Bypassing Frida Detection in /proc/self/maps to Extract Sensitive Data platform:android MASTG-TEST-0341 currentstatus:current
MASTG-DEMO-0027 Runtime Use of KeyguardManager.isDeviceSecure and BiometricManager.canAuthenticate APIs with Frida platform:android MASTG-TEST-0249 currentstatus:current
MASTG-DEMO-0088 Runtime Detection of Root Detection Mechanisms platform:android MASTG-TEST-0325 currentstatus:current
MASTG-DEMO-0028 Uses of KeyguardManager.isDeviceSecure and BiometricManager.canAuthenticate with semgrep platform:android MASTG-TEST-0247 currentstatus:current
MASTG-DEMO-0107 Detecting Frida hooks and terminating the application on response platform:android MASTG-TEST-0341 currentstatus:current
MASTG-DEMO-0101 References to Storage Integrity Check APIs with semgrep platform:android MASTG-TEST-0338 currentstatus:current
MASTG-DEMO-0037 App Leaking Information about Unclosed SQL Cursor via StrictMode platform:android MASTG-TEST-0263 currentstatus:current
MASTG-DEMO-0132 Root Detection Logic in Java/Kotlin Layer Only Protected by Identifier Renaming platform:android MASTG-TEST-0368 currentstatus:current
MASTG-DEMO-0114 Detecting Emulator Detection Checks with Frida platform:android MASTG-TEST-0351 currentstatus:current
MASTG-DEMO-0133 Root Detection Logic in Native Layer with Insufficient Obfuscation platform:android MASTG-TEST-0369 currentstatus:current
MASTG-DEMO-0115 JDWP Debugging Checks in App Code platform:android MASTG-TEST-0352 currentstatus:current
MASTG-DEMO-0087 Uses of Root Detection Techniques with Semgrep platform:android MASTG-TEST-0324 currentstatus:current
MASTG-DEMO-0106 Extracting Sensitive Data from Cipher.doFinal via Frida Hooking platform:android MASTG-TEST-0341 currentstatus:current
MASTG-DEMO-0038 Detecting StrictMode Uses with Frida platform:android MASTG-TEST-0264 currentstatus:current
MASTG-DEMO-0039 Detecting StrictMode PenaltyLog Usage with Semgrep platform:android MASTG-TEST-0265 currentstatus:current
MASTG-DEMO-0081 Sensitive User Data Sent to Firebase Analytics with Frida platform:android MASTG-TEST-0319 currentstatus:current
MASTG-DEMO-0033 Dangerous Permissions in the AndroidManifest with semgrep platform:android MASTG-TEST-0254 currentstatus:current
MASTG-DEMO-0009 Detecting Undeclared PII in Network Traffic platform:android MASTG-TEST-0206 currentstatus:current
MASTG-DEMO-0072 Runtime Use of Asymmetric Key Pairs Used For Multiple Purposes With Frida platform:android MASTG-TEST-0308 currentstatus:current
MASTG-DEMO-0012 Cryptographic Key Generation With Insufficient Key Length platform:android MASTG-TEST-0208 currentstatus:current
MASTG-DEMO-0017 Use of Hardcoded AES Key in SecretKeySpec with semgrep platform:android MASTG-TEST-0212 currentstatus:current
MASTG-DEMO-0071 References to Asymmetric Key Pairs Used For Multiple Purposes with Semgrep platform:android MASTG-TEST-0307 currentstatus:current
MASTG-DEMO-0008 Uses of Non-random Sources platform:android MASTG-TEST-0205 currentstatus:current
MASTG-DEMO-0007 Common Uses of Insecure Random APIs platform:android MASTG-TEST-0204 currentstatus:current
MASTG-DEMO-0075 Uses of Explicit Security Providers in Cryptographic APIs with semgrep platform:android MASTG-TEST-0312 currentstatus:current
MASTG-DEMO-0022 Uses of Broken Symmetric Encryption Algorithms in Cipher with semgrep platform:android MASTG-TEST-0221 currentstatus:current
MASTG-DEMO-0058 Using KeyGenParameterSpec with a Broken ECB Block Mode platform:android MASTG-TEST-0350 currentstatus:current
MASTG-DEMO-0023 Uses of Broken Encryption Modes in Cipher with semgrep platform:android MASTG-TEST-0232 currentstatus:current
MASTG-DEMO-0035 Data Exclusion using backup_rules.xml with adb backup platform:android MASTG-TEST-0216 currentstatus:current
MASTG-DEMO-0010 File System Snapshots from Internal Storage platform:android MASTG-TEST-0207 currentstatus:current
MASTG-DEMO-0060 App Writing Sensitive Data to Sandbox using EncryptedSharedPreferences platform:android MASTG-TEST-0287 currentstatus:current
MASTG-DEMO-0005 App Writing to External Storage via the MediaStore API platform:android MASTG-TEST-0202 currentstatus:current
MASTG-DEMO-0034 Backup and Restore App Data with semgrep platform:android MASTG-TEST-0262 currentstatus:current
MASTG-DEMO-0068 Sensitive Data in Unencrypted SQLite platform:android MASTG-TEST-0304 placeholderstatus:placeholder
MASTG-DEMO-0004 App Writing to External Storage with Scoped Storage Restrictions platform:android MASTG-TEST-0202 currentstatus:current
MASTG-DEMO-0006 Tracing Common Logging APIs Looking for Secrets platform:android MASTG-TEST-0203 currentstatus:current
MASTG-DEMO-0059 Using SharedPreferences to Write Sensitive Data Unencrypted to the App Sandbox platform:android MASTG-TEST-0287 currentstatus:current
MASTG-DEMO-0070 Sensitive Data Stored Unencrypted via Room Database platform:android MASTG-TEST-0306 placeholderstatus:placeholder
MASTG-DEMO-0003 App Writing to External Storage without Scoped Storage Restrictions platform:android MASTG-TEST-0202 currentstatus:current
MASTG-DEMO-0064 Uses of Caching UI Elements with semgrep platform:android MASTG-TEST-0258 currentstatus:current
MASTG-DEMO-0069 Sensitive Data Stored Unencrypted via DataStore platform:android MASTG-TEST-0305 placeholderstatus:placeholder
MASTG-DEMO-0020 Data Exclusion using backup_rules.xml with Backup Manager platform:android MASTG-TEST-0216 currentstatus:current
MASTG-DEMO-0001 File System Snapshots from External Storage platform:android MASTG-TEST-0200 currentstatus:current
MASTG-DEMO-0002 External Storage APIs Tracing with Frida platform:android MASTG-TEST-0201 currentstatus:current
MASTG-DEMO-0136 Internal Activity Communication via Implicit Intent platform:android MASTG-TEST-0372 currentstatus:current
MASTG-DEMO-0139 Path Traversal via Malicious ContentProvider Filename platform:android MASTG-TEST-0375 currentstatus:current
MASTG-DEMO-0140 Attacker App Registering for Internal Implicit Intent platform:android MASTG-TEST-0372 currentstatus:current
MASTG-DEMO-0050 Identifying Insecure Dependencies in Android Studio platform:android MASTG-TEST-0272 currentstatus:current
MASTG-DEMO-0102 SQL Injection via URI Path and Selection in Android Content Providers platform:android MASTG-TEST-0339 currentstatus:current
MASTG-DEMO-0025 Uses of Build.VERSION.SDK_INT with semgrep platform:android MASTG-TEST-0245 currentstatus:current
MASTG-DEMO-0100 Object Deserialization Using Serializable with semgrep platform:android MASTG-TEST-0337 currentstatus:current
MASTG-DEMO-0156 SafeBrowsing Disabled Detection with semgrep platform:android MASTG-TEST-0399 currentstatus:current
MASTG-DEMO-0141 Attacker App Returning Malicious ContentProvider Filename platform:android MASTG-TEST-0375 currentstatus:current
MASTG-DEMO-0051 Identifying Insecure Dependencies through SBOM Creation platform:android MASTG-TEST-0272 currentstatus:current
MASTG-DEMO-0158 Runtime Use of WebViewClient URL Loading Handlers with Frida platform:android MASTG-TEST-0400 currentstatus:current
MASTG-DEMO-0157 Uses of WebViewClient URL Loading Handlers with semgrep platform:android MASTG-TEST-0398 currentstatus:current
MASTG-DEMO-0138 Leaking Sensitive Information via Implicit Intents platform:android MASTG-TEST-0374 currentstatus:current
MASTG-DEMO-0040 Debuggable Flag Enabled in the AndroidManifest with semgrep platform:android MASTG-TEST-0226 currentstatus:current
MASTG-DEMO-0032 Uses of WebViews Allowing Local File Access with semgrep platform:android MASTG-TEST-0252 currentstatus:current
MASTG-DEMO-0105 Activity-Level Overlay Protection Using setHideOverlayWindows platform:android MASTG-TEST-0340 currentstatus:current
MASTG-DEMO-0082 WebView WebStorage Cleanup platform:android MASTG-TEST-0320 currentstatus:current
MASTG-DEMO-0130 Sensitive Action Exposed Through an Unprotected Manifest-Declared Broadcast Receiver platform:android MASTG-TEST-0366 currentstatus:current
MASTG-DEMO-0152 Custom URL Scheme Handler Without Input Validation with semgrep platform:android MASTG-TEST-0394 currentstatus:current
MASTG-DEMO-0151 Deep Link Intent Filter Missing android:autoVerify with semgrep platform:android MASTG-TEST-0393 currentstatus:current
MASTG-DEMO-0079 App Exposing Access and Verification Codes in Text Input Fields platform:android MASTG-TEST-0316 currentstatus:current
MASTG-DEMO-0123 Exfiltration of Private Files via FileProvider URI Grant Oversharing platform:android MASTG-TEST-0357 currentstatus:current
MASTG-DEMO-0097 Sensitive Data and Functionality Exposed Through WebView JavaScript Bridges platform:android MASTG-TEST-0334 currentstatus:current
MASTG-DEMO-0121 Unauthorized Access to Database Records through Exported Content Provider platform:android MASTG-TEST-0356 currentstatus:current
MASTG-DEMO-0061 Uses of FLAG_SECURE with semgrep platform:android MASTG-TEST-0291 currentstatus:current
MASTG-DEMO-0147 Uses of Insecure PendingIntent platform:android MASTG-TEST-0381 currentstatus:current
MASTG-DEMO-0120 Uses of Unauthorized Access to Exported Content Providers platform:android MASTG-TEST-0355 currentstatus:current
MASTG-DEMO-0122 Oversharing via FileProvider with Unrestricted Path Configuration platform:android MASTG-TEST-0357 currentstatus:current
MASTG-DEMO-0128 Sensitive Data Exposed Through an Unprotected Activity platform:android MASTG-TEST-0364 currentstatus:current
MASTG-DEMO-0103 Missing Overlay Protection on a Sensitive View platform:android MASTG-TEST-0340 currentstatus:current
MASTG-DEMO-0078 App Leaking Sensitive Data via Notifications platform:android MASTG-TEST-0315 currentstatus:current
MASTG-DEMO-0029 Uses of WebViews Allowing Content Access with semgrep platform:android MASTG-TEST-0250 currentstatus:current
MASTG-DEMO-0063 Incorrectly Preventing Screenshots with SecureFlagPolicy in Compose Dialogs with semgrep platform:android MASTG-TEST-0293 placeholderstatus:placeholder
MASTG-DEMO-0129 Sensitive Action Exposed Through an Unprotected Service platform:android MASTG-TEST-0365 currentstatus:current
MASTG-DEMO-0031 Uses of WebViews Allowing Local File Access with Frida platform:android MASTG-TEST-0253 currentstatus:current
MASTG-DEMO-0104 App Requesting SYSTEM_ALERT_WINDOW Permission platform:android MASTG-TEST-0340 currentstatus:current
MASTG-DEMO-0030 Uses of WebViews Allowing Content Access with Frida platform:android MASTG-TEST-0251 currentstatus:current
MASTG-DEMO-0062 Enabling Screenshots in Recents via setRecentsScreenshotEnabled with semgrep platform:android MASTG-TEST-0292 placeholderstatus:placeholder
MASTG-DEMO-0057 Network Security Configuration Allows User-Added Certificates platform:android MASTG-TEST-0286 currentstatus:current
MASTG-DEMO-0048 SSLSocket Connection to Wrong Host Server Allowed by Lack of HostnameVerifier platform:android MASTG-TEST-0234 currentstatus:current
MASTG-DEMO-0055 Use of the HostnameVerifier that Allows Any Hostname platform:android MASTG-TEST-0283 currentstatus:current
MASTG-DEMO-0049 SSLSocket Connection to Wrong Host Server Blocked by HostnameVerifier platform:android MASTG-TEST-0234 currentstatus:current
MASTG-DEMO-0054 Use of a TrustManager that Does Not Validate Certificate Chains platform:android MASTG-TEST-0282 currentstatus:current
MASTG-DEMO-0056 WebView Ignoring TLS Errors in onReceivedSslError platform:android MASTG-TEST-0284 currentstatus:current
MASTG-DEMO-0041 Uses of LAContext.evaluatePolicy with r2 platform:ios MASTG-TEST-0266 currentstatus:current
MASTG-DEMO-0045 Uses of kSecAccessControlBiometryCurrentSet with r2 platform:ios MASTG-TEST-0270 currentstatus:current
MASTG-DEMO-0043 Uses of kSecAccessControlUserPresence with r2 platform:ios MASTG-TEST-0268 currentstatus:current
MASTG-DEMO-0042 Runtime Use of LAContext.evaluatePolicy with Frida platform:ios MASTG-TEST-0267 currentstatus:current
MASTG-DEMO-0044 Runtime Use of kSecAccessControlUserPresence with Frida platform:ios MASTG-TEST-0269 currentstatus:current
MASTG-DEMO-0047 Runtime Use of the Keychain Not Requiring User Presence with Frida platform:ios MASTG-TEST-0266 placeholderstatus:placeholder
MASTG-DEMO-0046 Runtime Use of kSecAccessControlBiometryCurrentSet with Frida platform:ios MASTG-TEST-0271 currentstatus:current
MASTG-DEMO-0036 Debuggable Entitlement Enabled in the entitlements.plist with rabin2 platform:ios MASTG-TEST-0261 currentstatus:current
MASTG-DEMO-0124 Logging APIs Exposing Implementation Details with r2 platform:ios MASTG-TEST-0358 currentstatus:current
MASTG-DEMO-0119 Bypassing Frida D-Bus Port Detection to Extract Sensitive Data platform:ios MASTG-TEST-0354 currentstatus:current
MASTG-DEMO-0131 Detecting Virtual Device Detection Checks with Frida platform:ios MASTG-TEST-0367 currentstatus:current
MASTG-DEMO-0026 Runtime Use of LAContext.canEvaluatePolicy with Frida platform:ios MASTG-TEST-0246 currentstatus:current
MASTG-DEMO-0117 Extracting Sensitive Data from CCCrypt via Frida Hooking platform:ios MASTG-TEST-0354 currentstatus:current
MASTG-DEMO-0024 Uses of LAContext.canEvaluatePolicy with r2 platform:ios MASTG-TEST-0248 currentstatus:current
MASTG-DEMO-0118 Detecting Frida Hooks Before Sensitive Cryptographic Operations platform:ios MASTG-TEST-0354 currentstatus:current
MASTG-DEMO-0150 References to Storage Integrity Check APIs with radare2 platform:ios MASTG-TEST-0387 currentstatus:current
MASTG-DEMO-0125 Implementation Details Exposed in App Logs platform:ios MASTG-TEST-0359 currentstatus:current
MASTG-DEMO-0021 Uses of Jailbreak Detection Techniques with r2 platform:ios MASTG-TEST-0240 currentstatus:current
MASTG-DEMO-0126 Runtime Location Capture with a Deceptive Purpose String platform:ios MASTG-TEST-0361 currentstatus:current
MASTG-DEMO-0127 Unjustified Capability Exposure due to Excessive Entitlements platform:ios MASTG-TEST-0363 currentstatus:current
MASTG-DEMO-0074 Uses of Insecure Random Number Generation with frida-trace platform:ios MASTG-TEST-0349 currentstatus:current
MASTG-DEMO-0014 Use of Hardcoded ECDSA Private Key in CryptoKit with r2 platform:ios MASTG-TEST-0213 currentstatus:current
MASTG-DEMO-0016 Uses of Broken Hashing Algorithms in CryptoKit with r2 platform:ios MASTG-TEST-0211 currentstatus:current
MASTG-DEMO-0013 Use of Hardcoded RSA Private Key in SecKeyCreateWithData with r2 platform:ios MASTG-TEST-0213 currentstatus:current
MASTG-DEMO-0011 Uses of Insufficient Key Size in SecKeyCreateRandomKey with r2 platform:ios MASTG-TEST-0209 currentstatus:current
MASTG-DEMO-0015 Uses of Broken Hashing Algorithms in CommonCrypto with r2 platform:ios MASTG-TEST-0211 currentstatus:current
MASTG-DEMO-0073 Uses of Insecure Random Number Generation with r2 platform:ios MASTG-TEST-0311 currentstatus:current
MASTG-DEMO-0018 Uses of Broken Encryption Algorithms in CommonCrypto with r2 platform:ios MASTG-TEST-0210 currentstatus:current
MASTG-DEMO-0080 Uses of Broken Encryption Modes in CommonCrypto with r2 platform:ios MASTG-TEST-0317 currentstatus:current
MASTG-DEMO-0019 Uses of isExcludedFromBackupKey with r2 platform:ios MASTG-TEST-0215 currentstatus:current
MASTG-DEMO-0067 Runtime Tracking of Files Eligible for Backup with Frida platform:ios MASTG-TEST-0298 currentstatus:current
MASTG-DEMO-0065 Uses of Logging APIs with r2 platform:ios MASTG-TEST-0297 currentstatus:current
MASTG-DEMO-0066 Sensitive Data Logging with idevicesyslog platform:ios MASTG-TEST-0296 currentstatus:current
MASTG-DEMO-0076 Keyboard Caching Not Prevented for Sensitive Data with r2 platform:ios MASTG-TEST-0313 currentstatus:current
MASTG-DEMO-0077 Runtime Monitoring of Text Fields Eligible for Keyboard Caching with Frida platform:ios MASTG-TEST-0314 currentstatus:current
MASTG-DEMO-0149 References to Object Deserialization of a URL Scheme Payload with r2 platform:ios MASTG-TEST-0386 draft
MASTG-DEMO-0052 Scanning Package Manager Artifacts for Insecure iOS Dependencies platform:ios MASTG-TEST-0273 currentstatus:current
MASTG-DEMO-0053 Identifying Insecure Dependencies in SwiftPM through SBOM creation platform:ios MASTG-TEST-0275 currentstatus:current
MASTG-DEMO-0099 Runtime Monitoring of WebView File Access with Frida platform:ios MASTG-TEST-0336 currentstatus:current
MASTG-DEMO-0143 Sensitive Data Returned to Page JavaScript via evaluateJavaScript in a WKScriptMessageHandler platform:ios MASTG-TEST-0377 currentstatus:current
MASTG-DEMO-0096 HTML Injection in a Local WebView Leading to Local File Access platform:ios MASTG-TEST-0333 currentstatus:current
MASTG-DEMO-0098 References to File Access in WebViews with radare2 platform:ios MASTG-TEST-0335 currentstatus:current
MASTG-DEMO-0146 Sensitive Data Written into WebView DOM via evaluateJavaScript platform:ios MASTG-TEST-0380 currentstatus:current
MASTG-DEMO-0094 Use of the Deprecated UIWebView platform:ios MASTG-TEST-0331 currentstatus:current
MASTG-DEMO-0144 Password Field Rendered in WebView DOM Without Native Overlay platform:ios MASTG-TEST-0378 currentstatus:current
MASTG-DEMO-0145 DOM Inspection Using evaluateJavaScript Without Content World Isolation platform:ios MASTG-TEST-0379 currentstatus:current
MASTG-DEMO-0095 Attacker-Controlled Input in a WebView Leading to Unintended Navigation platform:ios MASTG-TEST-0332 currentstatus:current
MASTG-DEMO-0113 Runtime Monitoring of Text Input Fields Not Hiding Sensitive Data platform:ios MASTG-TEST-0347 currentstatus:current
MASTG-DEMO-0112 Text Input Fields Not Hiding Sensitive Data platform:ios MASTG-TEST-0346 currentstatus:current
MASTG-DEMO-0134 Custom URL Scheme Handler Without Input Validation platform:ios MASTG-TEST-0370 currentstatus:current
MASTG-DEMO-0142 Sensitive Data and Functionality Exposed Through a WKWebView Native Bridge platform:ios MASTG-TEST-0376 currentstatus:current
MASTG-DEMO-0153 Universal Link Handler Without Input Validation platform:ios MASTG-TEST-0395 currentstatus:current
MASTG-DEMO-0135 Custom URL Scheme Handler with Source Validation platform:ios MASTG-TEST-0371 currentstatus:current
MASTG-DEMO-0155 WKNavigationDelegate Accepting Any Server Certificate platform:ios MASTG-TEST-0397 currentstatus:current
MASTG-DEMO-0110 URLSession Minimum TLS Version Lowered in Code platform:ios MASTG-TEST-0343 currentstatus:current
MASTG-DEMO-0148 Missing Certificate Pinning in ATS platform:ios MASTG-TEST-0385 currentstatus:current
MASTG-DEMO-0085 Uses of Network Framework Bypassing ATS platform:ios MASTG-TEST-0323 currentstatus:current
MASTG-DEMO-0109 ATS TLS Policy Exceptions in Info.plist platform:ios MASTG-TEST-0342 currentstatus:current
MASTG-DEMO-0083 Insecure ATS Configuration Allowing Cleartext Traffic platform:ios MASTG-TEST-0322 currentstatus:current
MASTG-DEMO-0086 Uses of BSD Sockets Bypassing ATS platform:ios MASTG-TEST-0323 currentstatus:current
MASTG-DEMO-0154 URLSessionDelegate Accepting Any Server Certificate platform:ios MASTG-TEST-0396 currentstatus:current
MASTG-DEMO-0111 Network.framework TLS Minimum Version Lowered via sec_protocol_options platform:ios MASTG-TEST-0344 currentstatus:current
MASTG-DEMO-0084 Hardcoded HTTP URLs in iOS Binary platform:ios MASTG-TEST-0321 currentstatus:current