MASVS-PLATFORM

Temporary Checklist

This checklist contains the old MASVS v1 verification levels (L1, L2 and R) which we are currently reworking into "security testing profiles". The levels were assigned according to the MASVS v1 ID that the test was previously covering and might differ in the upcoming version of the MASTG and MAS Checklist.

For the upcoming of the MASTG version we will progressively split the MASTG tests into smaller tests, the so-called "atomic tests" and assign the new MAS profiles accordingly.

MASVS-ID	Platform	Control / MASTG Test	L1	L2	R
MASVS-PLATFORM-1		The app uses IPC mechanisms securely.
		Determining Whether Sensitive Stored Data Has Been Exposed via IPC Mechanisms
		Testing for Sensitive Functionality Exposure Through IPC
		Testing for App Permissions
		Testing for Vulnerable Implementation of PendingIntent
		Testing Deep Links
		Testing Custom URL Schemes
		Testing Universal Links
		Testing App Permissions
		Determining Whether Sensitive Data Is Exposed via IPC Mechanisms
		Testing UIActivity Sharing
		Testing for Sensitive Functionality Exposure Through IPC
		Testing UIPasteboard
		Testing App Extensions
MASVS-PLATFORM-2		The app uses WebViews securely.
		Testing WebViews Cleanup
		Testing JavaScript Execution in WebViews
		Testing for Java Objects Exposed Through WebViews
		Testing WebView Protocol Handlers
		Testing WebView Protocol Handlers
		Testing iOS WebViews
		Determining Whether Native Methods Are Exposed Through WebViews
MASVS-PLATFORM-3		The app uses the user interface securely.
		Testing for Overlay Attacks
		Checking for Sensitive Data Disclosure Through the User Interface
		Finding Sensitive Information in Auto-Generated Screenshots
		Checking for Sensitive Data Disclosed Through the User Interface
		Testing Auto-Generated Screenshots for Sensitive Information