Port MASTG-TEST-0082: Testing whether the App is Debuggable (ios) (by @appknox) #3097

jeel38 · 2024-12-16T11:36:46Z

cpholguera · 2024-12-18T09:13:01Z

tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0x82.md

+
+## Steps
+
+1. Run a static analysis using @MASTG-TOOL-0111 to extract entitlements from the binary to check the value of the `get-task-allow` key and is set to `true`.


Prefer to use the technique instead of specific tools in TESTS

https://mas.owasp.org/MASTG/techniques/ios/MASTG-TECH-0111/

Also, let's do the evaluation (check for true, in this case) later.

Suggested change

1. Run a static analysis using @MASTG-TOOL-0111 to extract entitlements from the binary to check the value of the `get-task-allow` key and is set to `true`.

1. Use @MASTG-TECH-0111 to extract entitlements from the binary and obtain the value of the `get-task-allow` key.

cpholguera · 2024-12-18T09:16:47Z

tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0x82.md

+## Steps
+
+1. Run a static analysis using @MASTG-TOOL-0111 to extract entitlements from the binary to check the value of the `get-task-allow` key and is set to `true`.
+2. Run a [dynamic analysis](../../../techniques/ios/MASTG-TECH-0084.md) using @MASTG-TOOL-0057.


The static analysis step should be enough. However, you still can refer to this TECH. See overview

cpholguera · 2024-12-18T09:18:14Z

tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0x82.md

+
+## Observation
+
+The entitlement get-task-allow is false, and anti-reverse engineering measures prevent debugger attachment attempts.


Suggested change

The entitlement get-task-allow is false, and anti-reverse engineering measures prevent debugger attachment attempts.

The output contains the value of the `get-task-allow` entitlement.

cpholguera · 2024-12-18T09:19:23Z

tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0x82.md

+
+## Evaluation
+
+The test fails as the entitlement get-task-allow is true, allowing debugger attachment.


Suggested change

The test fails as the entitlement get-task-allow is true, allowing debugger attachment.

The test fails if the `get-task-allow` entitlement is `true`.

cpholguera · 2024-12-18T09:23:22Z

tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0x82.md

+
+## Overview
+
+The test evaluates whether an iOS application is configured to allow debugging. If an app is debuggable, attackers can leverage debugging tools to reverse-engineer the application, analyse its runtime behaviour, and potentially compromise sensitive data or functionality.


Suggested change

The test evaluates whether an iOS application is configured to allow debugging. If an app is debuggable, attackers can leverage debugging tools to reverse-engineer the application, analyse its runtime behaviour, and potentially compromise sensitive data or functionality.

The test evaluates whether an iOS application is configured to allow debugging. If an app is debuggable, attackers can leverage debugging tools (see @MASTG-TECH-0084) to analyse the runtime behaviour of the app, and potentially compromise sensitive data or functionality.

cpholguera · 2024-12-18T09:25:08Z

First round of review done. Please remember to include a demo using https://github.com/cpholguera/MASTestApp-iOS

Thanks a lot @jeel38!

jeel38 · 2025-02-03T11:28:26Z

@cpholguera Please Review it

serek8

Thanks for contribution. I added a few comments in code.

One more thingy, your demo covers 2 cases:

detects if an app is debuggable
detects if an app is currently being debugged

Can you split these two cases into two distinct demos and make sure this subtle difference is clear for the reader?

serek8 · 2025-02-04T09:11:01Z

demos/ios/MASVS-RESILIENCE/MASTG-DEMO-0023/MastgTest.swift

+        print("📄 Info.plist Path: \(infoPath)")
+
+        if let infoDict = NSDictionary(contentsOfFile: infoPath) {
+            print("📋 Info.plist Contents: \(infoDict)")


Why do we print Info.plist? Does it contain info about a debuggable capability?

serek8 · 2025-02-04T10:04:44Z

demos/ios/MASVS-RESILIENCE/MASTG-DEMO-0023/MastgTest.swift

+
+                if data.count > 0 {
+                    if let content = String(data: data, encoding: .ascii),
+                       content.contains("get-task-allow") {


I am afraid this method might cause false positives. For example, if there is a third-party code in the binary that also contains get-task-allow string, this would trigger a false positive. It's also a bit slow to search through the whole binary, no? Can you optimise it?

serek8 · 2025-02-04T10:14:49Z

demos/ios/MASVS-RESILIENCE/MASTG-DEMO-0023/MastgTest.swift

+
+        // Method 4: Process Info
+        print("\nMethod 4: Checking Process Info")
+        let isDebugger = isDebuggerAttached()


Can you make such a function for each method? It would clean up the code a bit.

Do we need this file at all? If I'm not wrong I think we just need the modified entitlements file, so that we can build the app using it, and the reversed version.

Here's the original: https://github.com/cpholguera/MASTestApp-iOS/blob/main/entitlements.plist

Reducing this demo to only one method is also ok

cpholguera · 2025-02-14T08:19:52Z

demos/ios/MASVS-RESILIENCE/MASTG-DEMO-0023/debuggable.r2

cpholguera · 2025-02-14T08:20:04Z

demos/ios/MASVS-RESILIENCE/MASTG-DEMO-0023/run.sh

@@ -0,0 +1 @@
+r2 -q -i debuggable.r2 -A MASTestApp > output.asm


Suggested change

r2 -q -i debuggable.r2 -A MASTestApp > output.asm

rabin2 -OC MASTestApp | grep -A1 get-task-allow

cpholguera · 2025-02-14T08:20:21Z

demos/ios/MASVS-RESILIENCE/MASTG-DEMO-0023/output.asm

+search for get-task-allow
+271 0x00011987 0x100011987 401 402                         ascii   <?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0">\n<dict>\n\t<key>application-identifier</key>\n\t<string>AYRP7NNB54.org.owasp.mastestapp.MASTestApp-iOS</string>\n\t<key>com.apple.developer.team-identifier</key>\n\t<string>AYRP7NNB54</string>\n\t<key>get-task-allow</key>\n\t<true/>\n</dict>\n</plist>\n
+273 0x00011baa 0x100011baa 14  15                          ascii   get-task-allow


Suggested change

search for get-task-allow

271 0x00011987 0x100011987 401 402 ascii <?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0">\n<dict>\n\t<key>application-identifier</key>\n\t<string>AYRP7NNB54.org.owasp.mastestapp.MASTestApp-iOS</string>\n\t<key>com.apple.developer.team-identifier</key>\n\t<string>AYRP7NNB54</string>\n\t<key>get-task-allow</key>\n\t<true/>\n</dict>\n</plist>\n

273 0x00011baa 0x100011baa 14 15 ascii get-task-allow

<key>get-task-allow</key>

<true/>

cpholguera · 2025-02-14T08:54:53Z

tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0x82.md

+
+## Steps
+
+1. Use @MASTG-TECH-0111 to extract entitlements from the binary and obtain the value of the `get-task-allow` key.


Suggested change

1. Use @MASTG-TECH-0111 to extract entitlements from the binary and obtain the value of the `get-task-allow` key.

1. Use @MASTG-TECH-0111 to extract entitlements from the binary

2. Search for the `get-task-allow` key.

cpholguera · 2025-02-14T09:00:13Z

demos/ios/MASVS-RESILIENCE/MASTG-DEMO-0023/MASTG-DEMO-0023.md

+
+The code snippet below shows sample code that verify the application is debuggable.
+
+{{ MastgTest.swift }}


Instead of this we need the modified entitlements file, so that we can build the app using it, and the reversed version.

Here's the original: https://github.com/cpholguera/MASTestApp-iOS/blob/main/entitlements.plist

Suggested change

{{ MastgTest.swift }}

{{ entitlements.plist # entitlements_reversed.plist }}

cpholguera · 2025-02-14T09:01:41Z

demos/ios/MASVS-RESILIENCE/MASTG-DEMO-0023/MASTG-DEMO-0023.md

+2. Open the app binary with @MASTG-TOOL-0073 with the `-i` option to run this script.
+
+{{ debuggable.r2 }}


Suggested change

2. Open the app binary with @MASTG-TOOL-0073 with the `-i` option to run this script.

{{ debuggable.r2 }}

2. Run @MASTG-TOOL-0129 with the `-OC` options to obtain the entitlements file.

cpholguera · 2025-02-14T09:03:03Z

demos/ios/MASVS-RESILIENCE/MASTG-DEMO-0023/MASTG-DEMO-0023.md

+
+### Evaluation
+
+The test passes because debugging detection checks are implemented in the app.


Suggested change

The test passes because debugging detection checks are implemented in the app.

The test fails because the app is debuggable due to the `get-task-allow` entitlement being present.

cpholguera · 2025-02-14T09:04:33Z

demos/ios/MASVS-RESILIENCE/MASTG-DEMO-0023/MASTG-DEMO-0023.md

@@ -0,0 +1,32 @@
+---
+platform: ios
+title: Verify App is Debuggable with r2


Suggested change

title: Verify App is Debuggable with r2

title: Debuggable Entitlement Enabled in the entitlements.plist with rabin2

cpholguera · 2025-02-14T09:05:52Z

tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0x82.md

@@ -0,0 +1,23 @@
+---
+platform: ios
+title: Testing Whether the App is Debuggable


Suggested change

title: Testing Whether the App is Debuggable

title: Debuggable Entitlement Enabled in the entitlements.plist

cpholguera · 2025-02-14T09:09:07Z

tests-beta/ios/MASVS-RESILIENCE/MASTG-TEST-0x82.md

+title: Testing Whether the App is Debuggable
+id: MASTG-TEST-0x82
+type: [static, dynamic]
+weakness: MASWE-0101


MASWE-0067: Debuggable Flag Not Disabled

Suggested change

weakness: MASWE-0101

weakness: MASWE-0067

cpholguera · 2025-02-14T09:09:38Z

@jeel38 we're almost there, thanks!!

cpholguera · 2025-02-28T08:00:32Z

@jeel38 any news? Thanks

MASTG-082-Debugging-Detection

c52b8ad

cpholguera requested changes Dec 18, 2024

View reviewed changes

cpholguera added the changes-requested label Dec 18, 2024

cpholguera mentioned this pull request Jan 12, 2025

[MASWE-0103] - RASP Techniques Not Implemented #3074

Closed

cpholguera requested a review from serek8 January 14, 2025 14:50

MASTG-082-Debugging-Detection-add-a-demo

a2b2cb5

serek8 suggested changes Feb 4, 2025

View reviewed changes

cpholguera requested changes Feb 14, 2025

View reviewed changes

cpholguera changed the title ~~Port MASTG-TEST-0082 (by @appknox)~~ Port MASTG-TEST-0082: Testing whether the App is Debuggable (ios) (by @appknox) Feb 24, 2025

cpholguera added iOS MASVS-RESILIENCE MASTG Refactor labels Feb 24, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Port MASTG-TEST-0082: Testing whether the App is Debuggable (ios) (by @appknox) #3097

Port MASTG-TEST-0082: Testing whether the App is Debuggable (ios) (by @appknox) #3097

jeel38 commented Dec 16, 2024

cpholguera Dec 18, 2024

cpholguera Dec 18, 2024

cpholguera Dec 18, 2024

cpholguera Dec 18, 2024

cpholguera Dec 18, 2024

cpholguera commented Dec 18, 2024

jeel38 commented Feb 3, 2025

serek8 left a comment

serek8 Feb 4, 2025

serek8 Feb 4, 2025 •

edited

Loading

serek8 Feb 4, 2025

cpholguera Feb 4, 2025

serek8 Feb 4, 2025

cpholguera Feb 14, 2025

cpholguera Feb 14, 2025

cpholguera Feb 14, 2025

cpholguera Feb 14, 2025

cpholguera Feb 14, 2025

cpholguera Feb 14, 2025

cpholguera Feb 14, 2025

cpholguera Feb 14, 2025

cpholguera Feb 14, 2025

cpholguera Feb 14, 2025

cpholguera commented Feb 14, 2025

cpholguera commented Feb 28, 2025 •

edited

Loading


		## Steps

		1. Run a static analysis using @MASTG-TOOL-0111 to extract entitlements from the binary to check the value of the `get-task-allow` key and is set to `true`.

	1. Run a static analysis using @MASTG-TOOL-0111 to extract entitlements from the binary to check the value of the `get-task-allow` key and is set to `true`.
	1. Use @MASTG-TECH-0111 to extract entitlements from the binary and obtain the value of the `get-task-allow` key.


		## Observation

		The entitlement get-task-allow is false, and anti-reverse engineering measures prevent debugger attachment attempts.

	The entitlement get-task-allow is false, and anti-reverse engineering measures prevent debugger attachment attempts.
	The output contains the value of the `get-task-allow` entitlement.


		## Evaluation

		The test fails as the entitlement get-task-allow is true, allowing debugger attachment.

	The test fails as the entitlement get-task-allow is true, allowing debugger attachment.
	The test fails if the `get-task-allow` entitlement is `true`.


		## Overview

		The test evaluates whether an iOS application is configured to allow debugging. If an app is debuggable, attackers can leverage debugging tools to reverse-engineer the application, analyse its runtime behaviour, and potentially compromise sensitive data or functionality.

		@@ -0,0 +1 @@
		r2 -q -i debuggable.r2 -A MASTestApp > output.asm

	r2 -q -i debuggable.r2 -A MASTestApp > output.asm
	rabin2 -OC MASTestApp \| grep -A1 get-task-allow

	1. Use @MASTG-TECH-0111 to extract entitlements from the binary and obtain the value of the `get-task-allow` key.
	1. Use @MASTG-TECH-0111 to extract entitlements from the binary
	2. Search for the `get-task-allow` key.


		The code snippet below shows sample code that verify the application is debuggable.

		{{ MastgTest.swift }}

	{{ MastgTest.swift }}
	{{ entitlements.plist # entitlements_reversed.plist }}

		2. Open the app binary with @MASTG-TOOL-0073 with the `-i` option to run this script.

		{{ debuggable.r2 }}


		### Evaluation

		The test passes because debugging detection checks are implemented in the app.

	The test passes because debugging detection checks are implemented in the app.
	The test fails because the app is debuggable due to the `get-task-allow` entitlement being present.

	title: Verify App is Debuggable with r2
	title: Debuggable Entitlement Enabled in the entitlements.plist with rabin2

	title: Testing Whether the App is Debuggable
	title: Debuggable Entitlement Enabled in the entitlements.plist

Port MASTG-TEST-0082: Testing whether the App is Debuggable (ios) (by @appknox) #3097

Are you sure you want to change the base?

Port MASTG-TEST-0082: Testing whether the App is Debuggable (ios) (by @appknox) #3097

Conversation

jeel38 commented Dec 16, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cpholguera commented Dec 18, 2024

jeel38 commented Feb 3, 2025

serek8 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

serek8 Feb 4, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cpholguera commented Feb 14, 2025

cpholguera commented Feb 28, 2025 • edited Loading

serek8 Feb 4, 2025 •

edited

Loading

cpholguera commented Feb 28, 2025 •

edited

Loading