t3mp3st contributors
537d5345dc
Three new category loadouts, each = arsenal + an offline-scorable benchmark, opt-in and
honestly scoped (roster marks all 🚧; pacu/frida stay catalog_only, unit-tested non-mintable):
- cloud: aws/az/gcloud + scoutsuite/cloudfox/pmapper; cloud:bench IaC-misconfig detection
- mobile: apkleaks/mobsfscan/drozer/objection/class-dump; mobile:bench static ruleset
- binary/RE: ghidra/objdump/checksec/strings/readelf/gdb; binary:bench decompiled-sink detector
Mobile/binary benches are DETECTOR REGRESSION CHECKS (rules+fixtures co-authored — a pass is a
floor, not a detection rate). No new headline numbers; verify-claims 24/24.
tsc clean; 337 tests; lint 0 errors.
70 lines
3.9 KiB
JSON
70 lines
3.9 KiB
JSON
{
|
|
"note": "Static-analysis detection corpus for the Mobile loadout. Fixtures are decompiled artifacts (AndroidManifest snippets + source strings) with KNOWN issues + hardened controls. Scored by the built-in ruleset in scripts/mobile-static-bench.mjs. DIRECTIONAL + STATIC only (manifest misconfig + hardcoded secrets/cleartext) — NOT dynamic runtime exploitation (the opt-in frida/objection path). Secrets are format-valid but fake. REGRESSION corpus — the ruleset was written against these fixtures, so a pass is a detector-regression floor, NOT a real-world detection rate.",
|
|
"fixtures": [
|
|
{
|
|
"id": "manifest-debuggable",
|
|
"kind": "manifest",
|
|
"desc": "Debuggable + allowBackup enabled in production",
|
|
"clean": false,
|
|
"expect": ["M-DEBUGGABLE", "M-BACKUP"],
|
|
"content": "<manifest xmlns:android=\"http://schemas.android.com/apk/res/android\" package=\"com.demo.app\">\n <application android:debuggable=\"true\" android:allowBackup=\"true\" android:label=\"Demo\">\n <activity android:name=\".MainActivity\" />\n </application>\n</manifest>\n"
|
|
},
|
|
{
|
|
"id": "manifest-exported-provider",
|
|
"kind": "manifest",
|
|
"desc": "Content provider exported with no guarding permission",
|
|
"clean": false,
|
|
"expect": ["M-EXPORTED"],
|
|
"content": "<manifest xmlns:android=\"http://schemas.android.com/apk/res/android\" package=\"com.demo.app\">\n <application android:label=\"Demo\">\n <provider android:name=\".DataProvider\" android:authorities=\"com.demo.app.data\" android:exported=\"true\" />\n </application>\n</manifest>\n"
|
|
},
|
|
{
|
|
"id": "manifest-cleartext",
|
|
"kind": "manifest",
|
|
"desc": "Cleartext HTTP traffic permitted app-wide",
|
|
"clean": false,
|
|
"expect": ["M-CLEARTEXT"],
|
|
"content": "<manifest xmlns:android=\"http://schemas.android.com/apk/res/android\" package=\"com.demo.app\">\n <application android:usesCleartextTraffic=\"true\" android:label=\"Demo\" />\n</manifest>\n"
|
|
},
|
|
{
|
|
"id": "code-aws-key",
|
|
"kind": "code",
|
|
"desc": "Hardcoded AWS access key id in source",
|
|
"clean": false,
|
|
"expect": ["S-AWS-KEY"],
|
|
"content": "public class Config {\n static final String AWS_KEY = \"AKIAIOSFODNN7EXAMPLE\";\n static final String ENDPOINT = \"https://api.demo.com\";\n}\n"
|
|
},
|
|
{
|
|
"id": "code-google-key",
|
|
"kind": "code",
|
|
"desc": "Hardcoded Google API key in source",
|
|
"clean": false,
|
|
"expect": ["S-GOOGLE-API"],
|
|
"content": "public class Maps {\n private static final String API = \"AIzaSyD-EXAMPLEfakeKEY1234567890abcdEFG\";\n}\n"
|
|
},
|
|
{
|
|
"id": "code-private-key-http",
|
|
"kind": "code",
|
|
"desc": "Embedded private key + cleartext HTTP endpoint",
|
|
"clean": false,
|
|
"expect": ["S-PRIVATE-KEY", "E-HTTP-URL"],
|
|
"content": "String pem = \"-----BEGIN PRIVATE KEY-----\\nMIIBVAIBADANBgkq\\n-----END PRIVATE KEY-----\";\nString url = \"http://legacy.demo.com/api\";\n"
|
|
},
|
|
{
|
|
"id": "manifest-hardened-control",
|
|
"kind": "manifest",
|
|
"desc": "Hardened manifest (control) — flags off, exported component guarded by permission",
|
|
"clean": true,
|
|
"expect": [],
|
|
"content": "<manifest xmlns:android=\"http://schemas.android.com/apk/res/android\" package=\"com.demo.app\">\n <application android:debuggable=\"false\" android:allowBackup=\"false\" android:usesCleartextTraffic=\"false\" android:label=\"Demo\">\n <provider android:name=\".DataProvider\" android:exported=\"true\" android:permission=\"com.demo.app.PERMISSION\" />\n </application>\n</manifest>\n"
|
|
},
|
|
{
|
|
"id": "code-clean-control",
|
|
"kind": "code",
|
|
"desc": "Clean source (control) — secret from env, HTTPS only",
|
|
"clean": true,
|
|
"expect": [],
|
|
"content": "public class Net {\n static final String BASE = \"https://secure.demo.com\";\n String token = System.getenv(\"API_TOKEN\");\n}\n"
|
|
}
|
|
]
|
|
}
|