Current MobSF Version is validated against the OWASP mobile Top 10 2016. However, OWASP Mobile Top 2023 Vulnerabilities has also been available. Therefore, Team is required to create and develop Android Security Framework or solution which performs Static Analysis of android applications, maps the vulnerabilities found towards the OWASP Mobile Top 10 Vulnerabilities. Moreover, it should include analysis of Signature, Certificates, App Components, Permissions, Native libraries, ApklD, Browsable Activities, Manifest, Code, Domain Malware, URLs, Trackers, etc. It should also include the provision of performing the dynamic analysis on Android application with the features not limited to SSL Certificate Pinning, Frida Scripts Hooking and Injection, Root Detection/Jail-breaking, Code Tampering and Reverse Engineering etc. The solution will be evaluated on any of the latest Android applications.

Most commercial phone models do not allow root privileges to the user for vulnerability analysis , but it is possible to flash the modified firmware to obtain root privileges (Magisk etc.). However there is no readymade solution to flash the phone(for models other than pixel) with gdbserver running and enabling remote kernel debugging. POC can be built for any specific phone model (which run custom ROMS such as Samsung, Xiaomi, OPPO etc.) by modifying the firmware to include GDb server and flash the phone with modified firmware and remote kernel debugging may be demonstrated. Tool may be built to automate the procedure of modifying the firmware to included debugging interface:

• Input to tool will be android firmware source. Tool should be able to build image, enable kernel debugging.
• Output expected is an firmware with debugging capabilities which can be flashed upon to phone.

Solution will be evaluated against:

• No. of phone models demonstrated.
• Efficacy of tool.

To develop a customisable browser extension with capability to read http/https session parameters (cookies & CSRF tokens) of a particular domain and post these parameters to a specified server. Further, the extension is required to find a specific hyperlink present on the current page and modify this to test.com. (Exact hyperlink will be specified later). The complete solution shall work on non-English websites also. Evaluation: The extension will be installed on a chromium based browser (latest version). After that any popular commercial web service (eg gmail) would be accessed and authenticated session would be established. Extension should be able to read authenticated session parameters and post these to the specified server. During evaluation, higher weightage would be given to those extensions which generate least warnings/permission requests from the browser. For the content modification a specific website would be accessed with the required hyperlink present. User would click the hyperlink and the website should be redirected to test.com.

Web applications form an integral component of any organisation. It might as well be termed as one of the main precursors for cyber-attacks and breaches for an organisation. While manual vulnerability identification can be tough and mundane, automated tools often focus on a single class of vulnerability or lack the depth to identify complex attack vectors. Team is supposed to develop a tool that assess a given target for a wide class of vulnerabilities. The vulnerability class should not be limited to just OWASP TOP 10 2017 and 2021. Team should emphasise vulnerability classes such as file upload leading to RCE vulnerability, NoSQL injection and deserialisation attacks. Submissions will be judged on the following criteria:

• Number of attack classes discovered.
• Report generated by the tool to ensure uniformity in assessment.

Submissions will be ran against organiser's provided target.

Linux kernel is one of the most popular OS kernels widely used globally. A vulnerability in the Linux kernel can adversely affect majority of devices out there. Code analysis and fuzz testing are one of the more prominent ways to find vulnerabilities within a software. However, kernel fuzzing is exponentially tough as compared to normal user land application fuzzing. This can primarily be attributed to large number of dependencies in kernel space and the inability of user-land fuzzers to fulfill these dependencies. For instance, a global variable defined in kernel space can be altered based on number of variations in the invocation of the branch/ syscalls. It is highly cumbersome for the userland fuzzers to map such variations to perform efficient fuzzing for such kernel codes and thus deeply limit the code coverage of the fuzzers. Team is required to develop a Linux kernel based fuzzer that has the capability of resolving unknown dependencies encountered while fuzzing. Evaluation will be based on the following factors -

• Number of dependencies identified.
• The amount of code coverage achieved.

In order to ensure uniformity Team will use the latest linux version greater than v6.0 with minimum fuzzing run time.