+MASVS-NETWORK Network Communication
---+MASTG-TEST-0217 Insecure TLS Protocols Explicitly Allowed in Code (Android)
---+MASTG-TEST-0218 Insecure TLS Protocols in Network Traffic (Android)
---+MASTG-TEST-0233 Hardcoded HTTP URLs (Android)
---+MASTG-TEST-0234 Missing Implementation of Server Hostname Verification with SSLSockets (Android)
---+MASTG-TEST-0235 Android App Configurations Allowing Cleartext Traffic (Android)
---+MASTG-TEST-0236 Cleartext Traffic Observed on the Network (Network)
---+MASTG-TEST-0242 Missing Certificate Pinning in Network Security Configuration (Android)
---+MASTG-TEST-0243 Expired Certificate Pins in the Network Security Configuration (Android)
---+MASTG-TEST-0244 Missing Certificate Pinning in Network Traffic (Network)
---+MASTG-TEST-0282 Unsafe Custom Trust Evaluation (Android)
---+MASTG-TEST-0283 Incorrect Implementation of Server Hostname Verification (Android)
---+MASTG-TEST-0284 Incorrect SSL Error Handling in WebViews (Android)
---+MASTG-TEST-0286 Network Security Configuration Allowing Trust in User-Provided CAs (Android)
---+MASTG-TEST-0295 GMS Security Provider Not Updated (Android)
---+MASTG-TEST-0321 Hardcoded HTTP URLs (iOS)
---+MASTG-TEST-0322 App Transport Security Configurations Allowing Cleartext Traffic (iOS)
---+MASTG-TEST-0323 Uses of Low-Level Networking APIs for Cleartext Traffic (iOS)
---+MASTG-TEST-0342 References to Weak ATS TLS Policy Exceptions in Info.plist (iOS)
---+MASTG-TEST-0343 URLSession TLS Protocol Configuration (iOS)
---+MASTG-TEST-0344 Network.framework TLS Protocol Configuration (iOS)
---+MASTG-TEST-0345 Embedded or Third-party TLS Stack Configuration (iOS)
---+MASTG-TEST-0348 Insecure TLS Protocols in Network Traffic (iOS)
---+MASTG-TEST-0385 Missing Certificate Pinning in ATS (iOS)
---+MASTG-TEST-0396 References to URLSessionDelegate Bypassing Certificate Validation (iOS)
---+MASTG-TEST-0397 References to WKNavigationDelegate Bypassing Certificate Validation (iOS)

MASVS-NETWORK Network Communication

Tests for the MASVS group MASVS-NETWORK.

1. Overzicht

Titel Standaard

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde regelingen

2. Geïdentificeerde eisen

Eisen
Bron Eis

3. Gerelateerde regelingen

Regelingen
Bron Regelgeving

Gekoppelde issues

Koppelingen
Koppelingstype Issue
includes MASTG-TEST-0217 Insecure TLS Protocols Explicitly Allowed in Code (Android)
includes MASTG-TEST-0218 Insecure TLS Protocols in Network Traffic (Android)
includes MASTG-TEST-0233 Hardcoded HTTP URLs (Android)
includes MASTG-TEST-0234 Missing Implementation of Server Hostname Verification with SSLSockets (Android)
includes MASTG-TEST-0235 Android App Configurations Allowing Cleartext Traffic (Android)
includes MASTG-TEST-0236 Cleartext Traffic Observed on the Network (Network)
includes MASTG-TEST-0242 Missing Certificate Pinning in Network Security Configuration (Android)
includes MASTG-TEST-0243 Expired Certificate Pins in the Network Security Configuration (Android)
includes MASTG-TEST-0244 Missing Certificate Pinning in Network Traffic (Network)
includes MASTG-TEST-0282 Unsafe Custom Trust Evaluation (Android)
includes MASTG-TEST-0283 Incorrect Implementation of Server Hostname Verification (Android)
includes MASTG-TEST-0284 Incorrect SSL Error Handling in WebViews (Android)
includes MASTG-TEST-0286 Network Security Configuration Allowing Trust in User-Provided CAs (Android)
includes MASTG-TEST-0295 GMS Security Provider Not Updated (Android)
includes MASTG-TEST-0321 Hardcoded HTTP URLs (iOS)
includes MASTG-TEST-0322 App Transport Security Configurations Allowing Cleartext Traffic (iOS)
includes MASTG-TEST-0323 Uses of Low-Level Networking APIs for Cleartext Traffic (iOS)
includes MASTG-TEST-0342 References to Weak ATS TLS Policy Exceptions in Info.plist (iOS)
includes MASTG-TEST-0343 URLSession TLS Protocol Configuration (iOS)
includes MASTG-TEST-0344 Network.framework TLS Protocol Configuration (iOS)
includes MASTG-TEST-0345 Embedded or Third-party TLS Stack Configuration (iOS)
includes MASTG-TEST-0348 Insecure TLS Protocols in Network Traffic (iOS)
includes MASTG-TEST-0385 Missing Certificate Pinning in ATS (iOS)
includes MASTG-TEST-0396 References to URLSessionDelegate Bypassing Certificate Validation (iOS)
includes MASTG-TEST-0397 References to WKNavigationDelegate Bypassing Certificate Validation (iOS)
  • OWASP -

    EN: Publications of the OWASP Foundation, https://owasp.org/. OWASP® is a registered trademark of the OWASP Foundation, Inc.; GRCA is not affiliated with, nor endorsed by, the OWASP Foundation. Only the versions published by OWASP are authoritative.

    DE: Veröffentlichungen der OWASP Foundation, https://owasp.org/. OWASP® ist eine eingetragene Marke der OWASP Foundation, Inc.; GRCA steht in keiner Verbindung zur OWASP Foundation und wird von ihr nicht unterstützt. Maßgeblich sind allein die von OWASP veröffentlichten Fassungen.