Port MASTG test 0039 (by @guardsquare) #3042

titze · 2024-11-06T11:08:22Z

Thank you for submitting a Pull Request to the OWASP MASTG. Please make sure that:

Your contribution is written in the 2nd person (e.g. you)
Your contribution is written in an active present form for as much as possible.
You have made sure that the reference section is up to date (e.g. please add sources you have used, make sure that the references to MITRE/MASVS/etc. are up to date)
Your contribution has proper formatted markdown and/or code
Any references to website have been formatted as [TEXT](URL “NAME”)
You verified/tested the effectiveness of your contribution (e.g.: is the code really an effective remediation? Please verify it works!)

If your PR is related to an issue. Please end your PR test with the following line:
This PR closes #3014.

I did not copy the dynamic part, since this has no benefits over the static analysis (imo).

TheDauntless · 2024-11-07T15:03:48Z

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0x39-1.md

+
+## Steps
+
+1. View the AndroidManifest.xml, e.g., via @MASTG-TOOL-0121.


TOOL-0121 is objdump (ios)

we should use MASTG-TOOL-0123

But even better, use a technique "Obtaining Information from the AndroidManifest" (or similar title) with 2 sections to

get the whole android manifest: can use apktool or jadx/jadx-gui

or read properties from it: can use aapt

Always better to use a tech. from a test rather than a tool.

@TheDauntless I think this overlapped with landing another tool. Fixed.

@cpholguera I split it up into tech and tool.

cpholguera · 2024-11-07T16:57:41Z

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0x39-2.md

+
+To enable debugging of Webviews, the API `WebView.setWebContentsDebuggingEnabled(true);` can be used to enable WebView debugging (see ["see Android documentation"](https://developer.chrome.com/docs/devtools/remote-debugging/webviews/#configure_webviews_for_debugging)).
+
+Calling this API will enable WebView debugging for **all** of the application's WebViews, independently of the AndroidManifest.xml debuggable flag (See @MASTG-TEST-0x39-1). This allows an attached PC to eavesdrop on, and modify all communication inside WebViews.


does this really apply to all webviews even if it's only called in one instance?

Yes 🤯

This setting applies to all of the application's WebViews.

https://developer.chrome.com/docs/devtools/remote-debugging/webviews/#configure_webviews_for_debugging

Oh wow 😨

cpholguera · 2024-11-07T17:01:28Z

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0x39-2.md

+Calling this API will enable WebView debugging for **all** of the application's WebViews, independently of the AndroidManifest.xml debuggable flag (See @MASTG-TEST-0x39-1). This allows an attached PC to eavesdrop on, and modify all communication inside WebViews.
+
+!!! note Other ways to debug the application
+    Disabling WebView debugging does not fully prevent all possibilities to debug the app and the WebViews. See @MASWE-0101 for more details on how to prevent debugging.


I'm not sure if this note will confuse more than help. Let me know what you think:

What are other ways of debugging the webview if it's not using this? Do you mean that the app can be debugged by other means (but not necessarily the webviews). I guess an attacker able to use frida could call that to enable debugging ...

I meant that setting debuggable=false still allows someone with root to attach a debugger or attach Frida, essentially debugging the app. This is handled in MASWE-101, not 100% it needs a mention here.

cpholguera · 2024-11-07T17:02:29Z

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0x39-2.md

+2. Inspect all locations where `WebView.setWebContentsDebuggingEnabled` is called, and check
+    1. if it is set to true, and
+    2. if the API call can be executed during runtime.


Suggested change

2. Inspect all locations where `WebView.setWebContentsDebuggingEnabled` is called, and check

1. if it is set to true, and

2. if the API call can be executed during runtime.

2. Obtain all locations where `WebView.setWebContentsDebuggingEnabled` is called and set to `true`.

what's meant by "if the API call can be executed during runtime"?

https://developer.chrome.com/docs/devtools/remote-debugging/webviews/#configure_webviews_for_debugging contains a code snippet that ties the API call to the manifest debuggable flag.

What this sentence should mean is that the API call itself is not a problem if it is essentially in dead code. Maybe it still should not be in the app...

if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.KITKAT) { if (0 != (getApplicationInfo().flags & ApplicationInfo.FLAG_DEBUGGABLE)) { WebView.setWebContentsDebuggingEnabled(true); } }

Ok, got it! Let's see if we should reformulate and/or use this for the evaluation and remediation as well but with more detail mentioning those conditions.

cpholguera · 2024-11-07T17:05:02Z

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0x39-2.md

+The output should contain all locations where `WebView.setWebContentsDebuggingEnabled` can be called with `true` at runtime.
+
+## Evaluation
+
+The test case fails if any locations in the application can be executed ar runtime, where WebView debugging is enabled.


same question as above about the "runtime" aspect. Shouldn't we just say that if we found this being true that must be fixed?

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0x39-1.md

cpholguera · 2024-11-07T17:15:20Z

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0x39-1.md

+!!! note Other ways to debug the application
+    Not enabling debugging in the AndroidManifest.xml does fully prevent all possibilities to debug the app. See @MASWE-0101 for more details on how to prevent debugging.


If we know about other ways to debug the app we should shortly note them here.

Do you mean something like the attacker can set this attribute (which would invalidate the signature) and repackage & re-sign and be able to debug the app. I think this is something we could note here.

I meant #3042 (comment) here as well.

The resigning is a good point, not sure we want to open this topic here.

cpholguera · 2024-11-07T17:18:33Z

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0x39-1.md

+
+## Steps
+
+1. View the AndroidManifest.xml, e.g., via @MASTG-TOOL-0121.


we should use MASTG-TOOL-0123

cpholguera · 2024-11-07T17:22:01Z

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0x39-1.md

+
+## Steps
+
+1. View the AndroidManifest.xml, e.g., via @MASTG-TOOL-0121.


But even better, use a technique "Obtaining Information from the AndroidManifest" (or similar title) with 2 sections to

get the whole android manifest: can use apktool or jadx/jadx-gui

or read properties from it: can use aapt

cpholguera · 2024-11-07T17:22:23Z

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0x39-1.md

+
+## Steps
+
+1. View the AndroidManifest.xml, e.g., via @MASTG-TOOL-0121.


Always better to use a tech. from a test rather than a tool.

Co-authored-by: Carlos Holguera <[email protected]>

titze added 3 commits November 6, 2024 11:06

Port MASTG test 0039

b454bc3

linter

5b427ef

Fix tool link

538a5b2

TheDauntless reviewed Nov 7, 2024

View reviewed changes

cpholguera requested changes Nov 7, 2024

View reviewed changes

cpholguera added MASTG Refactor changes-requested labels Nov 7, 2024

titze and others added 2 commits November 7, 2024 18:27

Update tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0x39-1.md

3dc3478

Co-authored-by: Carlos Holguera <[email protected]>

review update

9cdf4e9

cpholguera removed the changes-requested label Nov 7, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Port MASTG test 0039 (by @guardsquare) #3042

Port MASTG test 0039 (by @guardsquare) #3042

titze commented Nov 6, 2024

TheDauntless Nov 7, 2024

cpholguera Nov 7, 2024

cpholguera Nov 7, 2024

cpholguera Nov 7, 2024

titze Nov 7, 2024

cpholguera Nov 7, 2024

titze Nov 7, 2024

cpholguera Nov 7, 2024

cpholguera Nov 7, 2024

titze Nov 7, 2024

cpholguera Nov 7, 2024

cpholguera Nov 7, 2024

titze Nov 7, 2024

cpholguera Nov 7, 2024

cpholguera Nov 7, 2024

cpholguera Nov 7, 2024

titze Nov 7, 2024

cpholguera Nov 7, 2024

cpholguera Nov 7, 2024

cpholguera Nov 7, 2024


		## Steps

		1. View the AndroidManifest.xml, e.g., via @MASTG-TOOL-0121.


		To enable debugging of Webviews, the API `WebView.setWebContentsDebuggingEnabled(true);` can be used to enable WebView debugging (see ["see Android documentation"](https://developer.chrome.com/docs/devtools/remote-debugging/webviews/#configure_webviews_for_debugging)).

		Calling this API will enable WebView debugging for all of the application's WebViews, independently of the AndroidManifest.xml debuggable flag (See @MASTG-TEST-0x39-1). This allows an attached PC to eavesdrop on, and modify all communication inside WebViews.

		!!! note Other ways to debug the application
		Not enabling debugging in the AndroidManifest.xml does fully prevent all possibilities to debug the app. See @MASWE-0101 for more details on how to prevent debugging.

Port MASTG test 0039 (by @guardsquare) #3042

Are you sure you want to change the base?

Port MASTG test 0039 (by @guardsquare) #3042

Conversation

titze commented Nov 6, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment