PTKD security knowledge base

Every check PTKD runs, with a real exploit scenario, the impact, and how to fix it, mapped to the OWASP Mobile Top 10 and MASVS.

critical severity

• PTKD-CRED-SECRET Hardcoded secret in binary M1

high severity

• PTKD-NET-CLEARTEXT Cleartext network traffic permitted M5
• PTKD-NET-USERCA Network config trusts user-installed CAs M5
• PTKD-NET-ATS App Transport Security disabled (NSAllowsArbitraryLoads) M5
• PTKD-IOS-DEBUGGABLE iOS build is debuggable (get-task-allow = true) M7
• PTKD-CFG-DEBUGGABLE Application is debuggable M8
• PTKD-CFG-TESTONLY Application marked test-only M8
• PTKD-NET-TRUSTALL TLS validation appears disabled (trust-all / accept-all hostnames) M5
• PTKD-SIGN-V1 APK signed with the legacy v1 (JAR) scheme M8
• PTKD-SUPPLY-CVE Vulnerable third-party dependency M2
• PTKD-DYN-CLEARTEXT Cleartext HTTP traffic at runtime M5
• PTKD-DYN-NOPINNING TLS interception succeeded (no certificate pinning) M5
• PTKD-DYN-SECRET-TRANSIT Hardcoded secret sent on the wire M1
• PTKD-DYN-STORAGE-SECRET Secret written to device storage M9

medium severity

• PTKD-NET-ATS-MEDIA App Transport Security disabled for media M5
• PTKD-CRYPTO-WEAK Weak cryptographic primitive M10
• PTKD-CFG-SHAREDUID Deprecated android:sharedUserId in use M8
• PTKD-CFG-EXPORTED Exported component without a permission guard M8
• PTKD-WEBVIEW-FILEACCESS WebView allows file access from web content M4
• PTKD-STO-BACKUP Application data is backed up M9
• PTKD-STO-FILESHARING iTunes file sharing enabled M9
• PTKD-WEBVIEW-JSI WebView JavaScript bridge exposed M4
• PTKD-PRIV-FIREBASE Firebase Realtime Database endpoint embedded M9
• PTKD-BIN-NOPIE Executable is not position-independent (no PIE/ASLR) M7
• PTKD-DYN-WEAKTLS Weak TLS version negotiated at runtime M5
• PTKD-DYN-AUTH-IN-URL Credential passed in a URL M1
• PTKD-DYN-PII-THIRD-PARTY Device/user PII sent to a third party M6
• PTKD-DYN-EXTERNAL-SENSITIVE Sensitive data written to external storage M9
• PTKD-DYN-LOG-SENSITIVE Sensitive data written to the log M9

low severity

• PTKD-NET-HTTP-URL Cleartext (http://) endpoints in the binary (review) M5
• PTKD-NET-ATS-WEB App Transport Security disabled in web content M5
• PTKD-IOS-APS-DEV Development APNs (push) environment M8
• PTKD-IOS-WILDCARD-ID Wildcard application identifier M8
• PTKD-NET-ATS-EXCEPTION App Transport Security insecure exception domains M5
• PTKD-CFG-CUSTOMPERM Custom permission with a weak protection level M8
• PTKD-WEBVIEW-DEBUG WebView remote debugging enabled M8
• PTKD-BIN-NOENCRYPT iOS binary is not encrypted (cryptid = 0) M7
• PTKD-PRIV-PERMS Dangerous runtime permissions requested M6
• PTKD-BIN-NOCANARY Executable built without stack canaries M7
• PTKD-DYN-INSECURE-COOKIE Session cookie without Secure/HttpOnly M5