mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
36 lines
1.4 KiB
Markdown
36 lines
1.4 KiB
Markdown
# Standards Reference: Mobile API Authentication Testing
|
|
|
|
## OWASP Mobile Top 10 2024
|
|
|
|
| OWASP ID | Risk | Testing Focus |
|
|
|----------|------|---------------|
|
|
| M1 | Improper Credential Usage | Hardcoded API keys, credential transmission |
|
|
| M3 | Insecure Authentication/Authorization | Auth bypass, IDOR, privilege escalation |
|
|
|
|
## OWASP API Security Top 10 2023
|
|
|
|
| API Risk | Test Case |
|
|
|----------|-----------|
|
|
| API1: Broken Object Level Authorization | Modify object IDs, test cross-user access |
|
|
| API2: Broken Authentication | JWT vulnerabilities, token replay, session management |
|
|
| API3: Broken Object Property Level Auth | Mass assignment, property-level access |
|
|
| API5: Broken Function Level Authorization | Admin endpoint access with user tokens |
|
|
|
|
## OWASP MASVS v2.0 - MASVS-AUTH
|
|
|
|
| Control | Test Method |
|
|
|---------|-------------|
|
|
| MASVS-AUTH-1 | Verify authentication enforcement on all sensitive endpoints |
|
|
| MASVS-AUTH-2 | Test token generation, validation, and revocation |
|
|
| MASVS-AUTH-3 | Assess multi-factor authentication implementation |
|
|
|
|
## CWE Mappings
|
|
|
|
| CWE | Title | Test |
|
|
|-----|-------|------|
|
|
| CWE-287 | Improper Authentication | Missing auth on endpoints |
|
|
| CWE-639 | Authorization Bypass Through User-Controlled Key | IDOR testing |
|
|
| CWE-798 | Hardcoded Credentials | API key in APK/IPA |
|
|
| CWE-613 | Insufficient Session Expiration | Token lifetime testing |
|
|
| CWE-384 | Session Fixation | Pre-auth token reuse |
|