mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
127 lines
3.6 KiB
Markdown
127 lines
3.6 KiB
Markdown
# MobSF Static Analysis Report Template
|
|
|
|
## Engagement Information
|
|
|
|
| Field | Value |
|
|
|-------|-------|
|
|
| Application Name | [APP_NAME] |
|
|
| Package Name | [PACKAGE_NAME] |
|
|
| Version | [VERSION] |
|
|
| Target SDK | [TARGET_SDK] |
|
|
| Min SDK | [MIN_SDK] |
|
|
| File Hash (SHA256) | [HASH] |
|
|
| Analysis Date | [DATE] |
|
|
| Analyst | [ANALYST] |
|
|
| MobSF Version | [MOBSF_VERSION] |
|
|
|
|
## Executive Summary
|
|
|
|
**Security Score**: [SCORE]/100
|
|
|
|
**Overall Risk Rating**: [HIGH/MEDIUM/LOW]
|
|
|
|
[Brief narrative of key findings and overall security posture]
|
|
|
|
## Findings Summary
|
|
|
|
| Severity | Count | Categories |
|
|
|----------|-------|------------|
|
|
| Critical | [N] | [Categories] |
|
|
| High | [N] | [Categories] |
|
|
| Medium | [N] | [Categories] |
|
|
| Low | [N] | [Categories] |
|
|
| Info | [N] | [Categories] |
|
|
|
|
## Manifest Analysis
|
|
|
|
### Exported Components
|
|
|
|
| Component Type | Name | Permission Guard | Risk |
|
|
|---------------|------|-------------------|------|
|
|
| Activity | [NAME] | [PERMISSION/None] | [RISK] |
|
|
| Service | [NAME] | [PERMISSION/None] | [RISK] |
|
|
| Receiver | [NAME] | [PERMISSION/None] | [RISK] |
|
|
| Provider | [NAME] | [PERMISSION/None] | [RISK] |
|
|
|
|
### Permissions Requested
|
|
|
|
| Permission | Protection Level | Justification | Risk |
|
|
|-----------|-----------------|---------------|------|
|
|
| [PERMISSION] | [dangerous/normal/signature] | [JUSTIFICATION] | [RISK] |
|
|
|
|
### Manifest Flags
|
|
|
|
| Flag | Value | Expected | Status |
|
|
|------|-------|----------|--------|
|
|
| android:debuggable | [VALUE] | false | [PASS/FAIL] |
|
|
| android:allowBackup | [VALUE] | false | [PASS/FAIL] |
|
|
| android:usesCleartextTraffic | [VALUE] | false | [PASS/FAIL] |
|
|
|
|
## Code Analysis Findings
|
|
|
|
### Finding [N]: [TITLE]
|
|
|
|
- **Severity**: [CRITICAL/HIGH/MEDIUM/LOW]
|
|
- **CWE**: [CWE-ID]
|
|
- **OWASP Mobile**: [M1-M10]
|
|
- **MASVS**: [MASVS-CATEGORY]
|
|
- **Description**: [DESCRIPTION]
|
|
- **Affected Files**:
|
|
- [FILE_PATH:LINE_NUMBER]
|
|
- **Evidence**: [CODE_SNIPPET]
|
|
- **Recommendation**: [REMEDIATION_STEPS]
|
|
|
|
## Network Security Analysis
|
|
|
|
| Check | Result | Details |
|
|
|-------|--------|---------|
|
|
| Certificate Pinning | [Present/Absent] | [DETAILS] |
|
|
| Network Security Config | [Present/Absent] | [DETAILS] |
|
|
| Cleartext Traffic | [Allowed/Blocked] | [DETAILS] |
|
|
| TLS Version | [VERSION] | [DETAILS] |
|
|
|
|
## Binary Analysis
|
|
|
|
| Check | Result | Details |
|
|
|-------|--------|---------|
|
|
| Code Obfuscation | [Yes/No] | [DETAILS] |
|
|
| Root Detection | [Present/Absent] | [DETAILS] |
|
|
| Debug Detection | [Present/Absent] | [DETAILS] |
|
|
| Emulator Detection | [Present/Absent] | [DETAILS] |
|
|
| Native Libraries (NX) | [Enabled/Disabled] | [DETAILS] |
|
|
| Native Libraries (PIE) | [Enabled/Disabled] | [DETAILS] |
|
|
| Native Libraries (Stack Canary) | [Present/Absent] | [DETAILS] |
|
|
|
|
## Recommendations
|
|
|
|
### Critical (Immediate Action Required)
|
|
|
|
1. [RECOMMENDATION]
|
|
|
|
### High (Fix Before Release)
|
|
|
|
1. [RECOMMENDATION]
|
|
|
|
### Medium (Address in Next Sprint)
|
|
|
|
1. [RECOMMENDATION]
|
|
|
|
### Low (Track in Backlog)
|
|
|
|
1. [RECOMMENDATION]
|
|
|
|
## OWASP Mobile Top 10 2024 Compliance
|
|
|
|
| ID | Risk | Status | Findings |
|
|
|----|------|--------|----------|
|
|
| M1 | Improper Credential Usage | [PASS/FAIL] | [DETAILS] |
|
|
| M2 | Inadequate Supply Chain Security | [PASS/FAIL] | [DETAILS] |
|
|
| M3 | Insecure Authentication/Authorization | [PASS/FAIL] | [DETAILS] |
|
|
| M4 | Insufficient Input/Output Validation | [PASS/FAIL] | [DETAILS] |
|
|
| M5 | Insecure Communication | [PASS/FAIL] | [DETAILS] |
|
|
| M6 | Inadequate Privacy Controls | [PASS/FAIL] | [DETAILS] |
|
|
| M7 | Insufficient Binary Protections | [PASS/FAIL] | [DETAILS] |
|
|
| M8 | Security Misconfiguration | [PASS/FAIL] | [DETAILS] |
|
|
| M9 | Insecure Data Storage | [PASS/FAIL] | [DETAILS] |
|
|
| M10 | Insufficient Cryptography | [PASS/FAIL] | [DETAILS] |
|