saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/intercepting-mobile-traffic-with-burpsuite/references/standards.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.3 KiB
Raw Blame History

Standards Reference: Mobile Traffic Interception with Burp Suite

OWASP Mobile Top 10 2024 Mapping

OWASP ID Risk Burp Suite Testing Coverage
M1 Improper Credential Usage Identify credentials in plaintext, weak token formats in API traffic
M3 Insecure Authentication/Authorization Test auth bypass, session management, IDOR via request manipulation
M4 Insufficient Input/Output Validation SQL injection, XSS, command injection via Burp Scanner/Repeater
M5 Insecure Communication Detect cleartext HTTP, weak TLS, missing HSTS, certificate validation
M8 Security Misconfiguration Identify verbose error messages, debug endpoints, missing security headers

OWASP MASVS v2.0 Control Mapping

MASVS Category Burp Suite Assessment Test Method
MASVS-NETWORK TLS configuration, certificate pinning, cleartext detection Proxy interception, SSL scan
MASVS-AUTH Token validation, session handling, credential transmission Repeater manipulation
MASVS-STORAGE Sensitive data in API responses cached client-side Response header analysis
MASVS-PLATFORM Deep link parameter injection, WebView URL loading Request crafting

OWASP API Security Top 10 2023

API Risk Burp Suite Test
API1: Broken Object Level Authorization Modify object IDs in intercepted requests
API2: Broken Authentication Replay tokens, test token expiration
API3: Broken Object Property Level Auth Modify response/request properties
API5: Broken Function Level Authorization Access admin endpoints with user tokens
API8: Security Misconfiguration Check response headers, error handling

CWE Mappings

CWE ID Title Detection Method
CWE-200 Exposure of Sensitive Information Inspect API responses for data leakage
CWE-295 Improper Certificate Validation Test with self-signed proxy certificate
CWE-319 Cleartext Transmission Monitor for HTTP (non-HTTPS) requests
CWE-352 Cross-Site Request Forgery Check for anti-CSRF tokens in requests
CWE-613 Insufficient Session Expiration Test token validity after logout