Skip to content

09-reporting.md

Latest commit

 

History

History
94 lines (69 loc) · 3.57 KB

09-reporting.md

File metadata and controls

94 lines (69 loc) · 3.57 KB
Raw

09 — Reporting

Mobile findings need device context, reproduction steps, and stack-specific remediation.

Evidence standards

Severity Evidence required
Critical Screenshot / screen recording + full request/response + device/OS version
High Screenshot + HTTP request/response or Frida hook output
Medium Screenshot or video + description
Low Screenshot of the issue

Capture workflow

# Screenshot (iOS)
ios ui screenshot /tmp/evidence_01.png

# Screenshot (Android)
adb shell screencap -p /sdcard/screen.png
adb pull /sdcard/screen.png .

# Screen recording (iOS — macOS QuickTime or ios_screen_capture)
# Screen recording (Android)
adb shell screenrecord /sdcard/video.mp4

# cURL reproduction for API findings
curl -s -H "Authorization: Bearer $TOKEN" \
     https://target.com/api/v2/users/12345 | jq .

Report structure per finding

## F-01: Hardcoded AWS Access Key in iOS Binary

**Severity:** High  
**Platform:** iOS  
**Version tested:** 2.4.1 (build 54321)

**Description:**
The iOS binary contains a hardcoded AWS access key (`AKIA...`) in the `strings` dump.

**Evidence:**
- Screenshot: [01-strings-dump.png]
- Extracted key: `AKIAIOSFODNN7EXAMPLE` (rotated after test)
- Command: `strings -a App | grep "AKIA"`

**Impact:**
An attacker with the compiled IPA can extract the key and access the associated S3 bucket.

**Remediation:**
- Remove the key from source code.
- Use temporary credentials via STS AssumeRole.
- Rotate the exposed key immediately.

**References:**
- OWASP M2: Inadequate Supply Chain Security

Severity guidance

  • Critical — RCE via runtime injection, full auth bypass, hardcoded cloud admin keys, unprotected Firebase database with PII.
  • High — IDOR exposing other users' data, SSL pinning missing on sensitive endpoints, hardcoded API keys with read/write access, biometric bypass leading to account takeover.
  • Medium — Weak crypto (MD5/SHA1), missing root detection, local storage of session tokens without encryption, missing certificate pinning.
  • Low — Verbose error messages, outdated libraries with no exploitable CVE, missing security headers in WebView.

Adjust up if:

  • The finding affects all users by default.
  • Chainable with another finding (e.g., hardcoded key + missing pinning = easy extraction).

Mobile-specific remediation tips

Finding iOS Fix Android Fix
Hardcoded secrets Keychain + server-side retrieval Android Keystore + server-side retrieval
Weak crypto CommonCrypto → CryptoKit BouncyCastle → Android Keystore
Missing pinning NSURLPinningValidator / TrustKit NetworkSecurityConfig / OkHttp CertificatePinner
Local storage Keychain (kSecAttrAccessibleWhenUnlockedThisDeviceOnly) EncryptedSharedPreferences / DataStore
Biometric bypass LAPolicy.deviceOwnerAuthenticationWithBiometrics + key tied to biometrics BiometricPrompt + setUserAuthenticationRequired(true)

Retest

  • Re-test on both iOS and Android if the finding applies to both.
  • Verify fixes in both static analysis (binary strings) and dynamic (runtime behavior).
  • Confirm server-side fixes don't break older app versions still in use.

What makes mobile reports bad

  • No platform/version specified.
  • Generic remediation that ignores mobile constraints (e.g., "use prepared statements" for an Objective-C app).
  • Screenshots with the client's app icon/logo visible (redact if possible).
  • Missing jailbreak/root status — some findings only manifest on modified devices.