-
-
Notifications
You must be signed in to change notification settings - Fork 2.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Android Tool] Replace Outdated Drozer when Possible #1904
[Android Tool] Replace Outdated Drozer when Possible #1904
Conversation
Failure of check links are not related to the PR 😢 |
Thanks for the info, I will do it coming weekend and push a commit in the
feature branch
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
First round review done ;) Please also consider the comment I've sent before that is not included in this review. Thanks!
Thanks a lot, I will work on it coming weekend and push commit in a the
feature branch.
|
Awesome! Thanks 😌 |
Co-authored-by: cpholguera <perezholguera@gmail.com>
@cpholguera : Update pushed in the feature branch and status described here. |
Hi @cpholguera and @TheDauntless |
Hi @cpholguera and @TheDauntless Any news? Thanks a lot in advance 😃 |
hi @righettod, we were very busy with the new release: https://github.com/OWASP/owasp-masvs/releases/tag/v1.3 We'll get back to you as soon as we can. Sorry for the wait. Have a great day! |
Hi @cpholguera , |
Hi @cpholguera and @TheDauntless , Any news about this PR? No stress at all, i'm just asking in case of you are waiting on a action on my side 😃 |
Hi @righettod we're very sorry that we cannot give any feedback yet. We're still dealing with a lot of things regarding the next big steps for both MASVS and MSTG so we cannot really address any PRs yet. we'll let you know as soon as we manage to go back to normal. Thanks again for your patience! |
Hi @cpholguera , No stress at all, as said, it was just to know if you are waiting any action on my side. Take the time you need, no stress at all once again 😃 Thank a lot for all your work on MSTG and MASVS, the team rocks!!!!! ❤️ ❤️ ❤️ ❤️ |
We definitely want to replace Drozer wherever possible with adb comments. Drozer is outdated and the added value is super limited. The one place where I do see added value is when you're trying to attack the system; Using Drozer it's possible to scan which applications have requested a specific permission and which of those applications are system applications. I think that's currently not easily possible through adb comments, but some more research may need to be done here. We will probably be doing some heavy refactoring in the near future, but we should try to merge your PR before we do that, as it fully aligns with our goals. |
@cpholguera @TheDauntless Thank you very much for your feedback. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi @righettod, we're very sorry for the delay and hope that you're aware of our situation and everything that's going on in the project. I finally could take some time today to do the final review. If you agree with the suggestions please apply them directly and we can merge ;)
When doing the dynamic analysis: validate whether the permission requested by the app is actually necessary for the app. For instance: a single-player game that requires access to `android.permission.WRITE_SMS`, might not be a good idea. | ||
|
||
To obtain detail about a specific permission you can refer to the [Android Documentation](https://developer.android.com/reference/android/Manifest.permission "Android Permissions"). | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We already wrote above about this. In this section we only focus on testing and interpreting results.
When doing the dynamic analysis: validate whether the permission requested by the app is actually necessary for the app. For instance: a single-player game that requires access to `android.permission.WRITE_SMS`, might not be a good idea. | |
To obtain detail about a specific permission you can refer to the [Android Documentation](https://developer.android.com/reference/android/Manifest.permission "Android Permissions"). |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Suggestion accepted 😃
Co-authored-by: cpholguera <perezholguera@gmail.com>
Co-authored-by: cpholguera <perezholguera@gmail.com>
Co-authored-by: cpholguera <perezholguera@gmail.com>
Co-authored-by: cpholguera <perezholguera@gmail.com>
Co-authored-by: cpholguera <perezholguera@gmail.com>
Co-authored-by: cpholguera <perezholguera@gmail.com>
Co-authored-by: cpholguera <perezholguera@gmail.com>
Co-authored-by: cpholguera <perezholguera@gmail.com>
@cpholguera You will never need to apologize with me, I know the both sides of the life of an OWASP PL (moreover with a flagship one like the MSTG) and the heavy load implied on spare times. I have accepted and committed all your proposal 😃 Thank a lot again for your amazing work on this project as well as your support on this PR ❤️ Links validation failure does not seem to come from my PR 😢 |
Co-authored-by: cpholguera <perezholguera@gmail.com>
Co-authored-by: cpholguera <perezholguera@gmail.com>
Co-authored-by: cpholguera <perezholguera@gmail.com>
Co-authored-by: cpholguera <perezholguera@gmail.com>
Co-authored-by: cpholguera <perezholguera@gmail.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the quick response and for the nice words
PR closes #1839