{"action":"created","comment":{"url":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/comments/89921400","pull_request_review_id":10448364,"id":89921400,"diff_hunk":"@@ -1,5 +1,54 @@\n-## <a name=\"OMTG-DATAST-002\"></a>OMTG-DATAST-002: Testing for Sensitive Data Disclosure in Log Files\n+## <a name=\"OMTG-DATAST-001-1\"></a>OMTG-DATAST-001-1: Test for system credentials storage features \n+\n+### Black-box Testing\n+\n+A way to identify if sensitive information like credentials and keys are stored insecurely and without leveraging the native functions from IOS is to analyse the app data directory. It is important to trigger as much app functionality as possbile before the data is analysed, as the app might only store system credentials as specific functionality is triggered by the user. A static analysis can then be performed for the data dump based on generic keywords and app specifc data. Identify how the application stores data locally on the iOS device. Some of the possible options for the application to store it's data locally includes:\n+ \n+- Plain Files\n+- Plist\n+- SQLite3 DB\n+- Realm DB\n+\n+Steps :\n+\n+1. Proceed to trigger functionality that stores potential sensitive data.\n+2. SSH into your iOS device and browse to the following directory: `/var/mobile/Containers/Data/Application/$APP_ID/`\n+3. Perform a grep command of the data that you have stored, such as: `grep -irn \"jk@vantagepoint.sg\"`.\n+4. If the sensitive data is being stored in plaintext, it fails this test.\n+\n+Manual dynamic analysis such as debugging can also be leveraged to verify how specific system credentials are stored and processed on the device. As this approach is more time consuming and is likely conducted manually, it might be only feasible for specific use cases.  \n+\n+\n+### White-box Testing\n+When going through the source code it should be analyzed if native mechanisms that are offered by IOS are applied to the identified sensitive information. Ideally sensitive information should not be stored on the device at all. If there is a requirement to store sensitive information on the device itself, several functions/API calls are available to protect the data on IOS device by using for example the Keychain. ","path":"Document/Testcases/0x00b_OMTG-DATAST_iOS.md","position":24,"original_position":24,"commit_id":"0979ff9547ce3b9b528773d07a057c947626b983","original_commit_id":"0979ff9547ce3b9b528773d07a057c947626b983","user":{"login":"sushi2k","id":5951320,"avatar_url":"https://avatars.githubusercontent.com/u/5951320?v=3","gravatar_id":"","url":"https://api.github.com/users/sushi2k","html_url":"https://github.com/sushi2k","followers_url":"https://api.github.com/users/sushi2k/followers","following_url":"https://api.github.com/users/sushi2k/following{/other_user}","gists_url":"https://api.github.com/users/sushi2k/gists{/gist_id}","starred_url":"https://api.github.com/users/sushi2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sushi2k/subscriptions","organizations_url":"https://api.github.com/users/sushi2k/orgs","repos_url":"https://api.github.com/users/sushi2k/repos","events_url":"https://api.github.com/users/sushi2k/events{/privacy}","received_events_url":"https://api.github.com/users/sushi2k/received_events","type":"User","site_admin":false},"body":"Be more specific. What native mechanisms are there? What are the functions call I need to look for? What are the best practices? Are there differences in different iOS versions?","created_at":"2016-11-29T01:05:40Z","updated_at":"2016-11-29T01:10:40Z","html_url":"https://github.com/OWASP/owasp-mstg/pull/37#discussion_r89921400","pull_request_url":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/37","_links":{"self":{"href":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/comments/89921400"},"html":{"href":"https://github.com/OWASP/owasp-mstg/pull/37#discussion_r89921400"},"pull_request":{"href":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/37"}}},"pull_request":{"url":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/37","id":95446449,"html_url":"https://github.com/OWASP/owasp-mstg/pull/37","diff_url":"https://github.com/OWASP/owasp-mstg/pull/37.diff","patch_url":"https://github.com/OWASP/owasp-mstg/pull/37.patch","issue_url":"https://api.github.com/repos/OWASP/owasp-mstg/issues/37","number":37,"state":"open","locked":false,"title":"updated on iOS test guide","user":{"login":"jinkunong","id":22487369,"avatar_url":"https://avatars.githubusercontent.com/u/22487369?v=3","gravatar_id":"","url":"https://api.github.com/users/jinkunong","html_url":"https://github.com/jinkunong","followers_url":"https://api.github.com/users/jinkunong/followers","following_url":"https://api.github.com/users/jinkunong/following{/other_user}","gists_url":"https://api.github.com/users/jinkunong/gists{/gist_id}","starred_url":"https://api.github.com/users/jinkunong/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jinkunong/subscriptions","organizations_url":"https://api.github.com/users/jinkunong/orgs","repos_url":"https://api.github.com/users/jinkunong/repos","events_url":"https://api.github.com/users/jinkunong/events{/privacy}","received_events_url":"https://api.github.com/users/jinkunong/received_events","type":"User","site_admin":false},"body":"","created_at":"2016-11-28T06:52:21Z","updated_at":"2016-11-29T01:10:40Z","closed_at":null,"merged_at":null,"merge_commit_sha":"bca6c9606dd13aa8046c486b19c03fb9be4ff918","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/37/commits","review_comments_url":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/37/comments","review_comment_url":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/comments{/number}","comments_url":"https://api.github.com/repos/OWASP/owasp-mstg/issues/37/comments","statuses_url":"https://api.github.com/repos/OWASP/owasp-mstg/statuses/0979ff9547ce3b9b528773d07a057c947626b983","head":{"label":"thec00n:master","ref":"master","sha":"0979ff9547ce3b9b528773d07a057c947626b983","user":{"login":"thec00n","id":6027459,"avatar_url":"https://avatars.githubusercontent.com/u/6027459?v=3","gravatar_id":"","url":"https://api.github.com/users/thec00n","html_url":"https://github.com/thec00n","followers_url":"https://api.github.com/users/thec00n/followers","following_url":"https://api.github.com/users/thec00n/following{/other_user}","gists_url":"https://api.github.com/users/thec00n/gists{/gist_id}","starred_url":"https://api.github.com/users/thec00n/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thec00n/subscriptions","organizations_url":"https://api.github.com/users/thec00n/orgs","repos_url":"https://api.github.com/users/thec00n/repos","events_url":"https://api.github.com/users/thec00n/events{/privacy}","received_events_url":"https://api.github.com/users/thec00n/received_events","type":"User","site_admin":false},"repo":{"id":74318504,"name":"owasp-mstg","full_name":"thec00n/owasp-mstg","owner":{"login":"thec00n","id":6027459,"avatar_url":"https://avatars.githubusercontent.com/u/6027459?v=3","gravatar_id":"","url":"https://api.github.com/users/thec00n","html_url":"https://github.com/thec00n","followers_url":"https://api.github.com/users/thec00n/followers","following_url":"https://api.github.com/users/thec00n/following{/other_user}","gists_url":"https://api.github.com/users/thec00n/gists{/gist_id}","starred_url":"https://api.github.com/users/thec00n/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thec00n/subscriptions","organizations_url":"https://api.github.com/users/thec00n/orgs","repos_url":"https://api.github.com/users/thec00n/repos","events_url":"https://api.github.com/users/thec00n/events{/privacy}","received_events_url":"https://api.github.com/users/thec00n/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/thec00n/owasp-mstg","description":" The Mobile Security Testing Guide (MSTG) is a manual for testing the security of mobile apps. It describes technical processes for verifying the controls listed in the OWASP Mobile Application Verification Standard (MASVS). The MSTG is meant to provide a baseline set of test cases for black-box and white-box security tests, and to help ensure completeness and consistency of the tests.","fork":true,"url":"https://api.github.com/repos/thec00n/owasp-mstg","forks_url":"https://api.github.com/repos/thec00n/owasp-mstg/forks","keys_url":"https://api.github.com/repos/thec00n/owasp-mstg/keys{/key_id}","collaborators_url":"https://api.github.com/repos/thec00n/owasp-mstg/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/thec00n/owasp-mstg/teams","hooks_url":"https://api.github.com/repos/thec00n/owasp-mstg/hooks","issue_events_url":"https://api.github.com/repos/thec00n/owasp-mstg/issues/events{/number}","events_url":"https://api.github.com/repos/thec00n/owasp-mstg/events","assignees_url":"https://api.github.com/repos/thec00n/owasp-mstg/assignees{/user}","branches_url":"https://api.github.com/repos/thec00n/owasp-mstg/branches{/branch}","tags_url":"https://api.github.com/repos/thec00n/owasp-mstg/tags","blobs_url":"https://api.github.com/repos/thec00n/owasp-mstg/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/thec00n/owasp-mstg/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/thec00n/owasp-mstg/git/refs{/sha}","trees_url":"https://api.github.com/repos/thec00n/owasp-mstg/git/trees{/sha}","statuses_url":"https://api.github.com/repos/thec00n/owasp-mstg/statuses/{sha}","languages_url":"https://api.github.com/repos/thec00n/owasp-mstg/languages","stargazers_url":"https://api.github.com/repos/thec00n/owasp-mstg/stargazers","contributors_url":"https://api.github.com/repos/thec00n/owasp-mstg/contributors","subscribers_url":"https://api.github.com/repos/thec00n/owasp-mstg/subscribers","subscription_url":"https://api.github.com/repos/thec00n/owasp-mstg/subscription","commits_url":"https://api.github.com/repos/thec00n/owasp-mstg/commits{/sha}","git_commits_url":"https://api.github.com/repos/thec00n/owasp-mstg/git/commits{/sha}","comments_url":"https://api.github.com/repos/thec00n/owasp-mstg/comments{/number}","issue_comment_url":"https://api.github.com/repos/thec00n/owasp-mstg/issues/comments{/number}","contents_url":"https://api.github.com/repos/thec00n/owasp-mstg/contents/{+path}","compare_url":"https://api.github.com/repos/thec00n/owasp-mstg/compare/{base}...{head}","merges_url":"https://api.github.com/repos/thec00n/owasp-mstg/merges","archive_url":"https://api.github.com/repos/thec00n/owasp-mstg/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/thec00n/owasp-mstg/downloads","issues_url":"https://api.github.com/repos/thec00n/owasp-mstg/issues{/number}","pulls_url":"https://api.github.com/repos/thec00n/owasp-mstg/pulls{/number}","milestones_url":"https://api.github.com/repos/thec00n/owasp-mstg/milestones{/number}","notifications_url":"https://api.github.com/repos/thec00n/owasp-mstg/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/thec00n/owasp-mstg/labels{/name}","releases_url":"https://api.github.com/repos/thec00n/owasp-mstg/releases{/id}","deployments_url":"https://api.github.com/repos/thec00n/owasp-mstg/deployments","created_at":"2016-11-21T02:25:26Z","updated_at":"2016-11-21T02:25:27Z","pushed_at":"2016-11-28T08:06:36Z","git_url":"git://github.com/thec00n/owasp-mstg.git","ssh_url":"git@github.com:thec00n/owasp-mstg.git","clone_url":"https://github.com/thec00n/owasp-mstg.git","svn_url":"https://github.com/thec00n/owasp-mstg","homepage":"","size":1051,"stargazers_count":0,"watchers_count":0,"language":"Shell","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"open_issues_count":0,"forks":1,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"OWASP:master","ref":"master","sha":"0c140c1f9770466de9322340590c37efe52e6129","user":{"login":"OWASP","id":155815,"avatar_url":"https://avatars.githubusercontent.com/u/155815?v=3","gravatar_id":"","url":"https://api.github.com/users/OWASP","html_url":"https://github.com/OWASP","followers_url":"https://api.github.com/users/OWASP/followers","following_url":"https://api.github.com/users/OWASP/following{/other_user}","gists_url":"https://api.github.com/users/OWASP/gists{/gist_id}","starred_url":"https://api.github.com/users/OWASP/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OWASP/subscriptions","organizations_url":"https://api.github.com/users/OWASP/orgs","repos_url":"https://api.github.com/users/OWASP/repos","events_url":"https://api.github.com/users/OWASP/events{/privacy}","received_events_url":"https://api.github.com/users/OWASP/received_events","type":"Organization","site_admin":false},"repo":{"id":69648386,"name":"owasp-mstg","full_name":"OWASP/owasp-mstg","owner":{"login":"OWASP","id":155815,"avatar_url":"https://avatars.githubusercontent.com/u/155815?v=3","gravatar_id":"","url":"https://api.github.com/users/OWASP","html_url":"https://github.com/OWASP","followers_url":"https://api.github.com/users/OWASP/followers","following_url":"https://api.github.com/users/OWASP/following{/other_user}","gists_url":"https://api.github.com/users/OWASP/gists{/gist_id}","starred_url":"https://api.github.com/users/OWASP/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OWASP/subscriptions","organizations_url":"https://api.github.com/users/OWASP/orgs","repos_url":"https://api.github.com/users/OWASP/repos","events_url":"https://api.github.com/users/OWASP/events{/privacy}","received_events_url":"https://api.github.com/users/OWASP/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/OWASP/owasp-mstg","description":" The Mobile Security Testing Guide (MSTG) is a manual for testing the security of mobile apps. It describes technical processes for verifying the controls listed in the OWASP Mobile Application Verification Standard (MASVS). The MSTG is meant to provide a baseline set of test cases for black-box and white-box security tests, and to help ensure completeness and consistency of the tests.","fork":false,"url":"https://api.github.com/repos/OWASP/owasp-mstg","forks_url":"https://api.github.com/repos/OWASP/owasp-mstg/forks","keys_url":"https://api.github.com/repos/OWASP/owasp-mstg/keys{/key_id}","collaborators_url":"https://api.github.com/repos/OWASP/owasp-mstg/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/OWASP/owasp-mstg/teams","hooks_url":"https://api.github.com/repos/OWASP/owasp-mstg/hooks","issue_events_url":"https://api.github.com/repos/OWASP/owasp-mstg/issues/events{/number}","events_url":"https://api.github.com/repos/OWASP/owasp-mstg/events","assignees_url":"https://api.github.com/repos/OWASP/owasp-mstg/assignees{/user}","branches_url":"https://api.github.com/repos/OWASP/owasp-mstg/branches{/branch}","tags_url":"https://api.github.com/repos/OWASP/owasp-mstg/tags","blobs_url":"https://api.github.com/repos/OWASP/owasp-mstg/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/OWASP/owasp-mstg/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/OWASP/owasp-mstg/git/refs{/sha}","trees_url":"https://api.github.com/repos/OWASP/owasp-mstg/git/trees{/sha}","statuses_url":"https://api.github.com/repos/OWASP/owasp-mstg/statuses/{sha}","languages_url":"https://api.github.com/repos/OWASP/owasp-mstg/languages","stargazers_url":"https://api.github.com/repos/OWASP/owasp-mstg/stargazers","contributors_url":"https://api.github.com/repos/OWASP/owasp-mstg/contributors","subscribers_url":"https://api.github.com/repos/OWASP/owasp-mstg/subscribers","subscription_url":"https://api.github.com/repos/OWASP/owasp-mstg/subscription","commits_url":"https://api.github.com/repos/OWASP/owasp-mstg/commits{/sha}","git_commits_url":"https://api.github.com/repos/OWASP/owasp-mstg/git/commits{/sha}","comments_url":"https://api.github.com/repos/OWASP/owasp-mstg/comments{/number}","issue_comment_url":"https://api.github.com/repos/OWASP/owasp-mstg/issues/comments{/number}","contents_url":"https://api.github.com/repos/OWASP/owasp-mstg/contents/{+path}","compare_url":"https://api.github.com/repos/OWASP/owasp-mstg/compare/{base}...{head}","merges_url":"https://api.github.com/repos/OWASP/owasp-mstg/merges","archive_url":"https://api.github.com/repos/OWASP/owasp-mstg/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/OWASP/owasp-mstg/downloads","issues_url":"https://api.github.com/repos/OWASP/owasp-mstg/issues{/number}","pulls_url":"https://api.github.com/repos/OWASP/owasp-mstg/pulls{/number}","milestones_url":"https://api.github.com/repos/OWASP/owasp-mstg/milestones{/number}","notifications_url":"https://api.github.com/repos/OWASP/owasp-mstg/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/OWASP/owasp-mstg/labels{/name}","releases_url":"https://api.github.com/repos/OWASP/owasp-mstg/releases{/id}","deployments_url":"https://api.github.com/repos/OWASP/owasp-mstg/deployments","created_at":"2016-09-30T08:22:29Z","updated_at":"2016-11-27T20:09:02Z","pushed_at":"2016-11-28T11:49:56Z","git_url":"git://github.com/OWASP/owasp-mstg.git","ssh_url":"git@github.com:OWASP/owasp-mstg.git","clone_url":"https://github.com/OWASP/owasp-mstg.git","svn_url":"https://github.com/OWASP/owasp-mstg","homepage":"","size":1240,"stargazers_count":32,"watchers_count":32,"language":"Shell","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":12,"mirror_url":null,"open_issues_count":1,"forks":12,"open_issues":1,"watchers":32,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/37"},"html":{"href":"https://github.com/OWASP/owasp-mstg/pull/37"},"issue":{"href":"https://api.github.com/repos/OWASP/owasp-mstg/issues/37"},"comments":{"href":"https://api.github.com/repos/OWASP/owasp-mstg/issues/37/comments"},"review_comments":{"href":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/37/comments"},"review_comment":{"href":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/37/commits"},"statuses":{"href":"https://api.github.com/repos/OWASP/owasp-mstg/statuses/0979ff9547ce3b9b528773d07a057c947626b983"}}}}
{"actor":{"display_login":"sushi2k"}}