owasp / igoat Goto Github PK

OWASP iGoat - A Learning Tool for iOS App Pentesting and Security by Swaroop Yermalkar

License: GNU General Public License v3.0

Objective-C 1.28% HTML 0.16% CSS 0.01% Shell 2.66% Ruby 0.03% Makefile 0.51% M4 0.60% Roff 0.03% C 92.98% Tcl 1.07% C++ 0.02% Yacc 0.43% C# 0.08% Batchfile 0.13% Dockerfile 0.01% PHP 0.02% Hack 0.01%

igoat's Introduction

Select the OWASP iGoat Version:

iGoat (Objective C) was presented at:

OWASP iGoat - A Learning Tool for iOS App Pentesting and Security

iGoat is a learning tool for iOS developers (iPhone, iPad, etc.) and mobile app pentesters. It was inspired by the WebGoat project, and has a similar conceptual flow to it.

As such, iGoat is a safe environment where iOS developers can learn about the major security pitfalls they face as well as how to avoid them. It is made up of a series of lessons that each teach a single (but vital) security lesson.

The lessons are laid out in the following steps:

Brief introduction to the problem.
Verify the problem by exploiting it.
Brief description of available remediations to the problem.
Fix the problem by correcting and rebuilding the iGoat program.

Step 4 is optional, but highly recommended for all iOS developers. Assistance is available within iGoat if you don't know how to fix a specific problem.

Documentation: iGoat Guide

Project Details

Page - https://www.owasp.org/index.php/OWASP_iGoat_Tool_Project

Project Lead - Swaroop Yermalkar (@swaroopsy)

Twitter - (@OWASPiGoat)

Lead Developer - Anthony Gonsalves

Vulnerabities Covered (version 3.0):

Key Management
- Hardcoded Encryption Keys
- Key Storage Server Side
- Random Key Generation
URL Scheme Attack
Social Engineering
Reverse Engineering
- String Analysis
Data Protection (Rest)
- Local Data Storage (SQLite)
- Plist Storage
- Keychain Usage
- NSUserDefaults Storage
Data Protection (Transit)
- Server Communication
- Public Key Pinning
Authentication
- Remote Authentication
Side Channel Data Leaks
- Device Logs
- Cut-and-Paste
- Backgrounding
- Keystroke Logging
Tampering
- Method Swizzling
Injection Flaws
- SQL Injection
- Cross Site Scripting
Broken Cryptography

How to countribute?

You can add new exercises
Testing iGoat and checking if any issues
Suggest us new attacks
Writing blogs / article about iGoat
Spreading iGoat :)

To contribute to iGoat project, please contact Swaroop ( [email protected] or @swaroopsy )

Project Contributors -

Anthony Gonsalves
Junard Lebajan (@junard)
Ken van Wyk
Arun @he_hacks
Jonathan Carter
Heefan
Tilak Kumar
Bernhard Mueller
Sagar Popat
Chandrakant Nial
Valligayatri Rachakonda
Suraj Kumar
masbog
Cheena Kathpal
Matt Tesauro

igoat's People

Stargazers

Watchers

Forkers

masbog mtesauro testwireless anthonygp mhhashim les2255 heefan souravbadami jlebajan siowcy helloexp kumartilak dendim0n harper14 pengtao007 cxai yog3shsharma pentagramz kalpeshjjethva bdsimpteam brianwgray denisse-dev supersteelblue jdiazmx ro9ueadmin heruix giantbranchcollect subc0ol szliuyujie josue198s c002 arunm201192 haimo918 ariesliuh dosglas miguelfreitas93 pwntester dannylowecx litsakaramelitsa bikram990 pentestbr luisit0 viettrungphan digitaloffensive flerov ntgitdude23 am1ncmd jg8481 5l1v3r1 modulexcite dpakthakur imatlin chris7230 fjsnogueira istais practical-iot-hacking fdlucifer apython123 stnert drewgallis secureonelabs hartl3y94 abdulmalikjalloh sajibekanti ulsa5 dusmana myvali998 w4ter0 leonayen adunkey isabella232 hobo-hilly taiji-xo mrfaeez wss-qa sast-qaing robertmicklecx websecresearch ikpehlivan nova-8 okwero2014 robsberrry ilir4734 emchamp mvali959 stavares843 qpc-github safisec snyk-schmidtty naga90122 alekseywmz ethicalsecurity-agency bnreplah serhanoztuna devsecops-deneme chriss-0x01

igoat's Issues

igoatapp.com is redirecting to scam sites

I followed the link from this project to https://igoatapp.com/ where I scrolled down to the Download iGoat section and clicked on SWIFT VERSION. The mouse cursor did not change to a hand as usual. When I clicked a new browser tab opened with the following scam URL trying to convince me to launch some fake update. "https" has been replaced with "hxxps" so nobody clicks it by mistake.

hxxps://interfrogs.com/11/click/1/?source=3398217&csum=hNjjFae2TcG3E9vWM1KDKBiIiUzFrtfe-hwsKwTaBaI5ZkXldVrSN-4lYotsF1yxhsXavSIvTYzzsqMCDy15Tw%2C%2C&_subid=3qnkfg41cnbq1vlgti3m&_token=uuid_3qnkfg41cnbq1vlgti3m_3qnkfg41cnbq1vlgti3m600ebc5287a4e5.22325693

I could not reproduce this. I suspected cookies to be used to deliver the page only once so I opened https://igoatapp.com/ in a Firefox private window but the update page didn't show up.

The interfrogs link above cycles through different scams. When visited once more I got a "win an iPhone" scam instead.

Please review the site. Maybe some of the self-hosted minified JavaScript libraries are infected?

UI Scaling Issues in - Side Channel Data Leaks Module

Hi Team,
In the iGoat - Side Channel Data Leaks Module;
Most of all sub categories are having the UI scaling issues when we try to provide any user inputs.
This behaviour is observed in the iPhone 6s with iOS 10.2.
The below given screenshots depicts the same.

update to work on iOS 15+

Key Storage Server Side: Enable HTTPS

Documenting a fix for this bug:

Enable HTTPS on the API call.
Store the key in the keychain instead of a local variable.

Can you enable both HTTP and HTTPS on this endpoint? This should be pretty easy to achieve using AWS certificate manager or . Or swap the endpoint over to an API Gateway lambda call, which supports HTTPS out of the box.

Unable to install dependencies for server

pfa screenshots

A

Does this project still have some support?

localhost in URL requests ?

Hi,

I'm sorry if it is a stupid question, but why all the requests made by the iGoat app target localhost (such as the authentication challenge) ?

If I understood well, the Ruby server is meant to be launched on the attacker machine, but HTTP traffic against localhost doesn't go through the proxy. As a consequence, I get the error message "Server reqest failed; see log for details". And I did, with the mention that there is no server at localhost.

Thanks in advance!