a.edenhauser/Shelly-Loqed-Touch
1
1
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects Releases Wiki Activity

add: empty test documents

Browse Source
This commit is contained in:
a.edenhauser
2026-11-02 11:59:30 +01:00
parent 2bf8e28b83
commit 20dfd8ba2b
5 changed files with 239 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Document1-Network.md
+20
View File
@@ -0,0 +1,20 @@
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
| ------- | -------------- | ---- | ----- | ------ | ------- |
| DES-02 | ISTG-DES-AUTHZ-001 | Unauthorized Access to Data Exchange Services | nmap, mitm, adb | Open | Test not yet performed. |
| DES-06 | ISTG-DES-INFO-001 | Disclosure of Implementation Details (DES) | nmap, jadx, smali code | Open | Test not yet performed. |
| DES-07 | ISTG-DES-INFO-003 | Disclosure of User Data | Wireshark, tcpdump, mitm | Open | Test not yet performed. |
| DES-08 | ISTG-DES-CONF-001 | Usage of Outdated Software | testssl.sh, openssl | Open | Test not yet performed. |
| DES-09 | ISTG-DES-CONF-002 | Presence of Unnecessary Software (Network Services) | nmap | Open | Test not yet performed. |
| DES-10 | ISTG-DES-SCRT-001 | Access to Confidential Data | adb/root, Frida, SQLCipher, sqlite3 | Open | Test not yet performed. |
| DES-11 | ISTG-DES-CRYPT-001 | Usage of Weak Cryptographic Algorithms (Transport Encryption) | testssl.sh, openssl | Open |Test not yet performed. |
| DES-12 | ISTG-DES-INPV-001 | Insufficient Input Validation (Network API) | mitm | Open | Test not yet performed. |
| DES-13 | ISTG-DES-INPV-002 | Code or Command Injection (Network API) | mitm | Open | Test not yet performed. |
---
### Example Commands
```bash
```
Document2-Firmware.md
+20
View File
@@ -0,0 +1,20 @@
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
| ------- | -------------- | ---- | ----- | ------ | ------- |
| FW-04 | ISTG-FW-CONF-001 | Usage of Outdated Software (Firmware Components) | binwalk, strings, grep | Open | Test not yet performed. |
| FW-05 | ISTG-FW-CONF-002 | Presence of Unnecessary Software (Debug Tools) | binwalk, find | Open | Test not yet performed. |
| FW-06 | ISTG-FW-CONF-003 | Usage of Insecure Configuration (Defaults) | strings, grep | Open | Test not yet performed. |
| FW-07 | ISTG-FW-SCRT-001 | Secrets Stored in Public Storage | binwalk, find, openssl | Open | Test not yet performed. |
| FW-08 | ISTG-FW-SCRT-002 | Unencrypted Storage of Secrets | binwalk, file | Open | Test not yet performed. |
| FW-09 | ISTG-FW-SCRT-003 | Usage of Hardcoded Secrets | strings, grep | Open | Test not yet performed. |
| FW-10 | ISTG-FW-CRYPT-001 | Usage of Weak Cryptographic Algorithms (Firmware) | openssl | Open | Test not yet performed. |
| MEM-04 | ISTG-MEM-SCRT-001 | Unencrypted Storage of Secrets (Memory/Flash) | binwalk, hexdump | Open | Test not yet performed. |
| WRLS-02 | ISTG-WRLS-CONF-001 | Usage of Outdated Software (WiFi Stack) | strings, grep | Open | Test not yet performed. |
---
### Example Commands
```bash
```
Document3-Active_Interaction.md
+22
View File
@@ -0,0 +1,22 @@
Requires physical access to the device (but no disassembly). Device must be powered on and reachable.
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
| ------- | -------------- | ---- | ----- | ------ | ------- |
| DES-01 | ISTG-DES-AUTHZ-001 | Unauthorized Access to Data Exchange Services | curl, openssl, mitmproxy, tcpdump | Open | Test not yet performed. |
| DES-04 | ISTG-DES-AUTHZ-001 | Unauthorized Access to Data Exchange Services (Cloud Connection) | | Open | Test not yet performed. |
| UI-02 | ISTG-UI-AUTHZ-001 | Unauthorized Access to User Interface (Web UI) | curl | Open | Test not yet performed. |
| UI-10 | ISTG-UI-LOGIC-001 | Circumvention of the Intended Business Logic (Factory Reset) | sha256sum, diff | Open | Test not yet performed. |
| UI-11 | ISTG-UI-INPV-001 | Insufficient Input Validation (SSID/Password Fields) | curl, python3 | Open | Test not yet performed. |
| UI-12 | ISTG-UI-INPV-002 | Code or Command Injection (UI Input Fields) | curl | Open | Test not yet performed. |
| WRLS-01 | ISTG-WRLS-AUTHZ-001 | Unauthorized Access to Wireless Interface (BLE command channel) | bleak, Frida, Python | Open | Test not yet performed. |
| WRLS-04 | ISTG-WRLS-CRYPT-001 | Usage of Weak Cryptographic Algorithms | jadx, Python | Open | Test not yet performed. |
| FWUPDT-04 | ISTG-FW[UPDT]-CRYPT-003 | Insecure Firmware Update Transmission | Wireshark, mitmproxy, tcpdump, tshark | Open | Test not yet performed. |
| ECS-02 | ISTG-ECS-CONF-003 | Absence of a Responsible Disclosure Policy | curl, wget | Open | Test not yet performed. |
---
### Example Commands
```bash
```
Document4-AV_Comparison.md
+56
View File
@@ -0,0 +1,56 @@
## Combined AV-Comparatives Derived Test Cases
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
| ------- | -------------- | ---- | ----- | ------ | ------- |
| AUTH-01 | ISTG-APP-AUTHZ-001 | Password Strength Check (App Account) | curl, manual | Open | Test not yet performed. |
| AUTH-02 | ISTG-APP-AUTHZ-001 | Password Requirements Enforcement | manual |Open | Test not yet performed. |
| AUTH-03 | ISTG-APP-AUTHZ-002 | Two-Factor Authentication (2FA) available | manual | Open | Test not yet performed. |
| AUTH-04 | ISTG-APP-AUTHZ-003 | Account Lockout after Failed Login Attempts | curl, python3 |Open | Test not yet performed. |
| WRLS-05 | ISTG-WRLS-CONF-002 | Warning when Connecting to Unsecured Network | manual | Open | Test not yet performed. |
| STG-01 | ISTG-DES-CONF-003 | Cloud Storage available | manual | Open | Test not yet performed. |
| STG-02 | ISTG-DES-CONF-003 | Cloud Storage Duration configurable | manual | Open | Test not yet performed. |
| STG-03 | ISTG-DES-CONF-003 | Local Storage available (SD Card / USB) | manual |Open | Test not yet performed. |
| STG-04 | ISTG-DES-CONF-003 | NAS Storage available | manual | Open | Test not yet performed. |
| APP-01 | ISTG-APP-CONF-001 | Manufacturer Account required for Setup | manual | Open | Test not yet performed. |
| APP-02 | ISTG-APP-CONF-002 | App Permissions appropriate (no over-permission) | Android permission checker, manual | Open | Test not yet performed. |
| APP-03 | ISTG-APP-CONF-003 | Logout from App possible | manual | Open | Test not yet performed. |
| SHA-01 | ISTG-APP-AUTHZ-004 | Shared Access: Administration for other Users | manual |Open | Test not yet performed. |
| SHA-02 | ISTG-APP-AUTHZ-004 | Shared Access: Livestream for other Users | manual | Open | Test not yet performed. |
| SHA-03 | ISTG-APP-AUTHZ-004 | Shared Access: Recordings for other Users | manual | Open | Test not yet performed. |
| SHA-04 | ISTG-APP-AUTHZ-004 | Admin/Non-Admin Access configurable | manual | Open | Test not yet performed. |
| SHA-05 | ISTG-APP-AUTHZ-005 | Public Browser Access: Livestream configurable | curl, browser | Open | Test not yet performed. |
| SHA-06 | ISTG-APP-AUTHZ-005 | Public Browser Access: Password Protection configurable | curl, browser | Open | Test not yet performed. |
---
## Mapping: AV-Comparatives Test → Internal Test Cases
| AV-Comparatives Category | AV Test Question | Internal Test-ID | Name |
| ------------------------ | ---------------- | ---------------- | ---- |
| Login / Password | Check of password strength | AUTH-01 | Password Strength Check (App Account) |
| Login / Password | Password requirements | AUTH-02 | Password Requirements Enforcement |
| Login / Password | Two-factor authentication (2FA) | AUTH-03 | Two-Factor Authentication (2FA) available |
| Login / Password | Lockout after failed login attempts | AUTH-04 | Account Lockout after Failed Login Attempts |
| Wi-Fi Connection | Warning if network is unsecured | WRLS-05 | Warning when Connecting to Unsecured Network |
| Storage | Cloud storage available | STG-01 | Cloud Storage available |
| Storage | Configurable cloud storage duration | STG-02 | Cloud Storage Duration configurable |
| Storage | Local storage available | STG-03 | Local Storage available (SD Card / USB) |
| Storage | Network attached storage (NAS) | STG-04 | NAS Storage available |
| App | Manufacturer account required | APP-01 | Manufacturer Account required for Setup |
| App | Required permissions appropriate | APP-02 | App Permissions appropriate |
| App | Logout from app possible | APP-03 | Logout from App possible |
| Shared Access | Other users: Administration | SHA-01 | Shared Access: Administration for other Users |
| Shared Access | Other users: Live stream | SHA-02 | Shared Access: Livestream for other Users |
| Shared Access | Other users: Recordings | SHA-03 | Shared Access: Recordings for other Users |
| Shared Access | Configurable Admin / Non-Admin access | SHA-04 | Admin/Non-Admin Access configurable |
| Public Browser Access | Configurable live stream access | SHA-05 | Public Browser Access: Livestream configurable |
| Public Browser Access | Configurable password protection | SHA-06 | Public Browser Access: Password Protection configurable |
---
### Example Commands
```bash
```
Document5-AVC_IoT_Testing_Protocol.md
+121
View File
@@ -0,0 +1,121 @@
## Authentication & Password Management
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|--------|---------------|------|------|--------|--------|
| AUTH-05 | ISTG-APP-AUTHZ-001 | Default Password Present | manual | Open | Test not yet performed. |
| AUTH-06 | ISTG-APP-AUTHZ-001 | Device-Specific Default Password Generation | manual | Open | Test not yet performed. |
| AUTH-07 | ISTG-APP-AUTHZ-001 | Empty Password Input Validation | curl, manual | Open | Test not yet performed. |
| AUTH-08 | ISTG-APP-AUTHZ-001 | Password Confirmation Field Verification | manual | Open | Test not yet performed. |
| AUTH-09 | ISTG-APP-AUTHZ-002 | Password Strength Feedback to User | manual | Open | Test not yet performed. |
| AUTH-10 | ISTG-APP-AUTHZ-003 | Authentication Before Accessing Sensitive Device Data | curl, browser | Open | Test not yet performed. |
| AUTH-11 | ISTG-APP-AUTHZ-003 | Sensitive Data Exposure Before Authentication | Wireshark, tcpdump | Open | Test not yet performed. |
| AUTH-12 | ISTG-APP-AUTHZ-003 | Authentication Data Encryption During Transmission | Wireshark, tcpdump | Open | Test not yet performed. |
| AUTH-13 | ISTG-APP-AUTHZ-003 | Authentication Data Integrity Protection | Wireshark, mitmproxy | Open | Test not yet performed. |
| AUTH-14 | ISTG-APP-AUTHZ-003 | Authentication Status Timeout (Auto Logout) | manual | Open | Test not yet performed. |
| AUTH-15 | ISTG-APP-AUTHZ-003 | Display of Last Successful Login | manual | Open | Test not yet performed. |
| AUTH-16 | ISTG-APP-AUTHZ-003 | Ability to Block Specific Entities | manual | Open | Test not yet performed. |
---
## Firmware Update Security
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|--------|---------------|------|------|--------|--------|
| FWUPDT-05 | ISTG-FW[UPDT]-CONF-001 | Manual Firmware Update Availability | manual | Open | Test not yet performed. |
| FWUPDT-06 | ISTG-FW[UPDT]-AUTHZ-001 | Authentication Required for Firmware Update | manual | Open | Test not yet performed. |
| FWUPDT-07 | ISTG-FW[UPDT]-CONF-002 | Automatic Firmware Update Configuration | manual | Open | Test not yet performed. |
| FWUPDT-08 | ISTG-FW[UPDT]-CONF-003 | Firmware Update File Validation (Format Check) | binwalk, file | Open | Test not yet performed. |
| FWUPDT-09 | ISTG-FW[UPDT]-CONF-004 | Firmware Update Integrity Verification (Checksum) | sha256sum | Open | Test not yet performed. |
| FWUPDT-10 | ISTG-FW[UPDT]-CONF-005 | Device Recovery After Failed Update | manual | Open | Test not yet performed. |
---
## Physical Security
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|--------|---------------|------|------|--------|--------|
| PHY-01 | ISTG-PHY-CONF-001 | Unique Device Physical Identifier | manual | Open | Test not yet performed. |
| PHY-02 | ISTG-PHY-CONF-002 | Serial Number Visibility | manual | Open | Test not yet performed. |
| PHY-03 | ISTG-PHY-AUTHZ-001 | Physical Factory Reset Protection | manual | Open | Test not yet performed. |
---
## Interfaces & Network Exposure
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|--------|---------------|------|------|--------|--------|
| INT-01 | ISTG-DES-CONF-004 | Unused Logical Interfaces Disabled | nmap | Open | Test not yet performed. |
| INT-02 | ISTG-DES-CONF-005 | Unnecessary Physical Interfaces Exposure | manual | Open | Test not yet performed. |
---
## Communication Security
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|--------|---------------|------|------|--------|--------|
| COMM-01 | ISTG-DES-CRYPT-002 | Encryption Between Device and Server | Wireshark, tcpdump | Open | Test not yet performed. |
| COMM-02 | ISTG-DES-CRYPT-003 | Encryption Between Device and User | Wireshark, jadx, Python | Open | Test not yet performed. |
| COMM-03 | ISTG-DES-INPV-003 | Integrity Check of Received Data | jadx, Python | Open | Test not yet performed. |
| COMM-04 | ISTG-DES-SESS-001 | Session Management and Identifier Tracking | Wireshark | Open | Test not yet performed. |
---
## Boot & Software Integrity
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|--------|---------------|------|------|--------|--------|
| BOOT-01 | ISTG-FW-SCRT-004 | Secure Boot Mechanism Protection | binwalk, strings | Open | Test not yet performed. |
| BOOT-02 | ISTG-FW-SCRT-005 | Detection of Unauthorized Software Modification | manual | Open | Test not yet performed. |
---
## Logging & Audit
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|--------|---------------|------|------|--------|--------|
| LOG-01 | ISTG-LOG-CONF-001 | Event Logging Availability | manual | Open | Test not yet performed. |
| LOG-02 | ISTG-LOG-SCRT-001 | Secure Storage of Logs | manual | Open | Test not yet performed. |
| LOG-03 | ISTG-LOG-SCRT-002 | Log Integrity Protection | manual | Open | Test not yet performed. |
| LOG-04 | ISTG-LOG-AUTHZ-001 | Authentication Required to Access Logs | manual | Open | Test not yet performed. |
---
## User Roles & Account Management
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|--------|---------------|------|------|--------|--------|
| ROLE-01 | ISTG-APP-AUTHZ-006 | Creation of Multiple User Accounts | manual | Open | Test not yet performed. |
| ROLE-02 | ISTG-APP-AUTHZ-006 | Role Assignment to User Accounts | manual | Open | Test not yet performed. |
| ROLE-03 | ISTG-APP-AUTHZ-006 | Hierarchical Role Model Support | manual | Open | Test not yet performed. |
| ROLE-04 | ISTG-APP-AUTHZ-006 | User Account Deletion | manual | Open | Test not yet performed. |
| ROLE-05 | ISTG-APP-AUTHZ-006 | User Account Modification | manual | Open | Test not yet performed. |
---
## Privacy & Personal Data
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|--------|---------------|------|------|--------|--------|
| PRIV-01 | ISTG-APP-PRIV-001 | User Notification of Personal Data Collection | manual | Open | Test not yet performed. |
| PRIV-02 | ISTG-APP-PRIV-002 | User Consent for Personal Data Usage | manual | Open | Test not yet performed. |
| PRIV-03 | ISTG-APP-PRIV-003 | Ability to Delete Personal Data | manual | Open | Test not yet performed. |
| PRIV-04 | ISTG-APP-PRIV-004 | Encryption of Personal Data in Storage/Transmission | Wireshark | Open | Test not yet performed. |
---
## Telemetry
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|--------|---------------|------|------|--------|--------|
| TELE-01 | ISTG-APP-PRIV-005 | Telemetry Data Collection | Wireshark | Open | Test not yet performed. |
| TELE-02 | ISTG-APP-PRIV-006 | Telemetry Transparency to User | manual | Open | Test not yet performed. |
---
## Stability & Resilience
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|--------|---------------|------|------|--------|--------|
| STAB-01 | ISTG-SYS-REL-001 | Device Behavior After Power Failure | manual | Open | Test not yet performed. |
| STAB-02 | ISTG-SYS-REL-002 | Device Behavior After Network Failure | manual | Open | Test not yet performed. |
| STAB-03 | ISTG-SYS-REL-003 | Device Reconnection After Network Failure | manual | Open | Test not yet performed. |