Create testcase issues on data storage for Parse and CouchDB

[commjoen]

In our data storage chapters (see 0x05d for Android and 0x06d for iOS), we miss writeups for Parse and CouchDB.

As this is a good first issue, we would like to invite anyone to start working on the following:

• Explain how the storagemechanism works (so what does CouchDB and Parse do?) in the overview part. Explain what could go wrong: where do you have to pay attention to? Thing about how the storage can be overriden or extracted?
• Explain in the static analysis part what to look for in terms of wrong and right code: what are signs that the technology is used? What are signs that it is used insecurely?
• Explain in the dynamic analysis part what to look for in terms of wrong behavior: what should a pentester/developer check to see issues in the behavior of the app regarding the integraiton?

[commjoen]

CouchDB Writeup Android.docx
WIP by @shwetajoshi26 👍 . Will have to pick this up and add data to git (e.g. how to exploit/secure and verify it)

[cpholguera]

Hi @shwetajoshi26, could you already start working on this? Do you need some support to get started?

[shwetajoshi26]

Hi, I am not able to proceed ahead because of unavailability of actual devices, rooted android and iphone for testing. I tried running another simulations, but not successful.

[cpholguera]

Hi @shwetajoshi26 , thanks for the status update :) what if we leave out the third point (dynamic analysis, at least for now)?

We'd highly appreciate if you could at least help us address the other two "how it works" and "static analysis" (from the description above). What do you think?

[shwetajoshi26]

Yes.. I will look for rest of the two things and leave dynamic analysis for now. Sorry for delay.. ☺️

…

On Thu, Dec 19, 2019, 16:34 cpholguera ***@***.***> wrote: Hi @shwetajoshi26 <https://github.com/shwetajoshi26> , thanks for the status update :) what if we leave out the third point (dynamic analysis, at least for now)? We'd highly appreciate if you could at least help us address the other two "how it works" and "static analysis" (from the description above). What do you think? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1041>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AJ2HTYWHUSDSQM2LXPKRJATQZNIK7ANCNFSM4F3M3VPA> .