Port MASTG-TEST-0024 (by @appknox) #3076
Conversation
| platform: android | ||
| title: Testing for App Permissions | ||
| id: MASTG-TEST-0x24 | ||
| --- |
There was a problem hiding this comment.
Check other recently added V2 tests for missing fields such as MASWE ID
|
|
||
| ## Steps | ||
|
|
||
| ### Static analysis |
There was a problem hiding this comment.
We do not use these sections anymore but rather one unique list of steps.
In this case you can easily create a MASTG-TECH for "Obtaining App Permissions" and there use one ## section per tool.
Example:
## @MASTG-TOOL-xxx
See the latest MASTG-TECH and MASTG-TEST (V2 beta) for reference (you can go to the page and sort the IDs to see the recent ones).
FOR THIS TEST:
as you'll see in the other ones this will become one step about using the technique by referencing it with @
| 2. Use the @MASTG-TOOL-0004 with the following command : | ||
| `$ adb shell dumpsys package sg.vp.owasp_mobile.omtg_android` | ||
|
|
||
| Please refer to this [permissions overview ↗](https://developer.android.com/guide/topics/permissions/overview#permission-groups "Table 1. Dangerous permissions and permission groups.") for descriptions of the listed permissions that are considered dangerous. |
There was a problem hiding this comment.
This would be better for the evaluation. Be careful not to include that arrow right before the closing bracket
|
Could you please include a MASTG-DEMO as well using our app? This greatly helps understanding the test, so we're going to make this a requirement for everyone from now on (unless there's a good reason to schedule it for later, e.g. due to great complexity). Thanks a lot @ScreaMy7! |
closes #2985