Changes to templates that better accomodate Pen Test report writing #521
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
RRudder
changed the title
Updated all first instances of SSL to read as Secure Sockets Layer (SSL)
Replaced instances of PitM with MitM to align with OWASP standard naming convention
This reverts commit 23276e0. Reverting to keep acronym as PitM.
norsec0de
suggested changes
May 15, 2024
| @@ -1,6 +1,6 @@ | |||
| # Recommendation(s) | |||
|
|
|||
| It is recommended to implement SSL certificate pinning for the application. | |||
| It is recommended to implement Sockets Layer (SSL) certificate pinning for the application. | |||
There was a problem hiding this comment.
Should we be migrating each instance of SSL to TLS? While it's somewhat universal, SSL as a term is deprecated and has been for a long time.
|
|
||
| ## Overview of the Vulnerability | ||
|
|
||
| Mobile security misconfigurations can occur at any level of the application stack and can involve unpatched software, unprotected files or pages, or unauthorized access to the application. SSL pinning adds an extra layer of security for an application as it forces the application to validate the server’s CA certificate against a known copy. | ||
| Mobile security misconfigurations can occur at any level of the application stack and can involve unpatched software, unprotected files or pages, or unauthorized access to the application. Sockets Layer (SSL) pinning adds an extra layer of security for an application as it forces the application to validate the server’s CA certificate against a known copy. |
There was a problem hiding this comment.
Missing "Secure" before "Sockets Layer (SSL)"
| @@ -1,6 +1,6 @@ | |||
| # Recommendation(s) | |||
|
|
|||
| It is recommended to securely implement SSL certificate pinning for the application. | |||
| It is recommended to securely implement Sockets Layer (SSL) certificate pinning for the application. | |||
There was a problem hiding this comment.
Missing "Secure" before "Sockets Layer (SSL)"
|
|
||
| ## Overview of the Vulnerability | ||
|
|
||
| Mobile security misconfigurations can occur at any level of the application stack and can involve unpatched software, unprotected files or pages, or unauthorized access to the application. SSL pinning adds an extra layer of security for an application as it forces the application to validate the server’s CA certificate against a known copy. | ||
| Mobile security misconfigurations can occur at any level of the application stack and can involve unpatched software, unprotected files or pages, or unauthorized access to the application. Sockets Layer (SSL) pinning adds an extra layer of security for an application as it forces the application to validate the server’s CA certificate against a known copy. |
There was a problem hiding this comment.
Missing "Secure" before "Sockets Layer (SSL)"
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
denial of service, with,Denial of Service.*Replaced all instance of
Navigate to {{url}}, with,Navigate to the following URL: {{url}}