mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
41 lines
2.3 KiB
Markdown
41 lines
2.3 KiB
Markdown
# Standards Reference: Mobile Traffic Interception with Burp Suite
|
|
|
|
## OWASP Mobile Top 10 2024 Mapping
|
|
|
|
| OWASP ID | Risk | Burp Suite Testing Coverage |
|
|
|----------|------|----------------------------|
|
|
| M1 | Improper Credential Usage | Identify credentials in plaintext, weak token formats in API traffic |
|
|
| M3 | Insecure Authentication/Authorization | Test auth bypass, session management, IDOR via request manipulation |
|
|
| M4 | Insufficient Input/Output Validation | SQL injection, XSS, command injection via Burp Scanner/Repeater |
|
|
| M5 | Insecure Communication | Detect cleartext HTTP, weak TLS, missing HSTS, certificate validation |
|
|
| M8 | Security Misconfiguration | Identify verbose error messages, debug endpoints, missing security headers |
|
|
|
|
## OWASP MASVS v2.0 Control Mapping
|
|
|
|
| MASVS Category | Burp Suite Assessment | Test Method |
|
|
|----------------|----------------------|-------------|
|
|
| MASVS-NETWORK | TLS configuration, certificate pinning, cleartext detection | Proxy interception, SSL scan |
|
|
| MASVS-AUTH | Token validation, session handling, credential transmission | Repeater manipulation |
|
|
| MASVS-STORAGE | Sensitive data in API responses cached client-side | Response header analysis |
|
|
| MASVS-PLATFORM | Deep link parameter injection, WebView URL loading | Request crafting |
|
|
|
|
## OWASP API Security Top 10 2023
|
|
|
|
| API Risk | Burp Suite Test |
|
|
|----------|----------------|
|
|
| API1: Broken Object Level Authorization | Modify object IDs in intercepted requests |
|
|
| API2: Broken Authentication | Replay tokens, test token expiration |
|
|
| API3: Broken Object Property Level Auth | Modify response/request properties |
|
|
| API5: Broken Function Level Authorization | Access admin endpoints with user tokens |
|
|
| API8: Security Misconfiguration | Check response headers, error handling |
|
|
|
|
## CWE Mappings
|
|
|
|
| CWE ID | Title | Detection Method |
|
|
|--------|-------|-----------------|
|
|
| CWE-200 | Exposure of Sensitive Information | Inspect API responses for data leakage |
|
|
| CWE-295 | Improper Certificate Validation | Test with self-signed proxy certificate |
|
|
| CWE-319 | Cleartext Transmission | Monitor for HTTP (non-HTTPS) requests |
|
|
| CWE-352 | Cross-Site Request Forgery | Check for anti-CSRF tokens in requests |
|
|
| CWE-613 | Insufficient Session Expiration | Test token validity after logout |
|