ostorlab_insecure_ios_app - Vulnerable Ios application for Ostolab Security Sc

项目说明

Ostorlab iOS App

This repository contains the source code for an iOS app intentionally made for testing purposes.
The app is designed to exhibit a wide of security that are common in mobile applications.
It's recommended to use this app as a playground to test and learn about different iOS security .

Here are the that the app demonstrates:

* __Biometric None Cryptobject (biometric_none_cryptobject.dart)__: Demonstrates associated with incorrect
implementation or lack of cryptographic protection in biometric authentication.

* __ECB Cipher Mode (ecb_cipher_mode.dart)__: Shows the weaknesses of using the ECB (Electronic CodeBook) mode of operation
for cryptographic ciphers.

* __Insecure Commands (insecure_commands.dart)__: Illustrates when insecure or system commands are executed
from the application.

* __Reflection API (reflection_api.dart)__: Provides instances of unsafe usage of reflection APIs.

* __TLS Traffic (tls_traffic.dart)__: Illustrates potential security threats when using unencrypted or improperly encrypted
Transport Layer Security (TLS) traffic.

* __Clear Text Traffic (clear_text_traffic.dart)__: Highlights the risks associated with transmitting sensitive data over
clear text traffic.

* __Hardcoded Credentials in URL (hardcoded_creds_in_url.dart)__: Demonstrates the risk of hardcoding sensiti
within URLs.

* __Insecure Random (insecure_random.dart)__: Showcases the issues with using insecure random number generators for sensitive
operations.

* __Oracle Padding (oracle_padding.dart)__: Illustrates the potential dangers of oracle padding .

* __SQLite Database Call (sqlite_database_call.dart)__: Showcases insecure practices related to SQLite database calls.

* __Webview Insecure Settings (web.dart)__: Demonstrates potential with insecure WebView
settings.

* __Command Exec (command_exec.dart)__: Displays potential issues when executing system commands.

* __Hash Call (hash_call.dart)__: Demonstrates improper usage of hash functions.

* __Insecure Shared Preferences (insecure_shared_preferences.dart)__: Shows risks related to insecure handling of shared
preferences.

* __Path Tra (path_tra.dart)__: Showcases the potential dangers of path tra .

* __Static IV (static_iv.dart)__: Demonstrates the security risks associated with using static initialization in
encryption.

Installation

Please follow the standard iOS application building process for installation.

// TODO.

Usage

To use the app, simply run it on your iOS device or emulator. You can explore different by na
through the app's UI.

// TODO

Disclaimer

This app is intentionally and therefore not intended for production use. Use it at your own risk. The authors
are not responsible for any misuse or damage caused by this program.

Contribution

Contributions are always welcome! Please feel free to create issues for bug reports or enhancement suggestions, and make
pull requests to improve the application.

Building and Installing the App

Follow these steps to build and install the Ostorlab Insecure ios App:

Prerequisites

* Flutter SDK
* Xcode

Building the App

1. Clone the repository.
Clone the repository: Run the following command in your terminal or command prompt to clone the repository to your local machine:

2. Na to the Flutter project: Change directory to the ostorlab_insecure_ios_app directory within the cloned repository:

3. Get Flutter dependencies: Run the following command to fetch the required dependencies for the Flutter project:

4. Build the Flutter project: Run the following command to build the Flutter project:

5. Open the project in Xcode: Run the following command to open the project in Xcode:

6. Select a de team: In Xcode, select a de team to use for pro the app. To do this, select a team from the Signing & Capabilities tab of the Runner project.
7. Build and run the app: In Xcode, click the Run button to build and run the app on your iOS device or emulator.

项目信息

开发语言：Dart

Star 数：8

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Vulnerable Ios application for Ostolab Security Scanner展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。