Port MASTG-TEST-0067: Testing Endpoint Identity Verification (iOS) to v2

[Copilot]

This PR closes #3446

Description

Ports MASTG-TEST-0067 (Testing Endpoint Identity Verification) from v1 to v2 format for iOS platform.

New v2 test (tests-beta/ios/MASVS-NETWORK/MASTG-TEST-0067.md):

• Maps to MASWE-0052 (certificate validation weakness, consistent with Android network tests)
• Profiles: L1, L2
• Type: static, dynamic
• References best practice: MASTG-BEST-0025
• Covers three attack vectors:
  • ATS exceptions in Info.plist (global disables, insecure domain configs)
  • Lower-level networking APIs bypassing ATS (CFStream, BSD Sockets, Network framework)
  • Custom URLSessionDelegate implementations that bypass certificate checks
• References: @MASTG-KNOW-0071 (ATS), @MASTG-TECH-0092 (Info.plist), @MASTG-TECH-0058 (reverse engineering), @MASTG-TECH-0062 (network interception)
• Testing approach: static analysis of config/code + dynamic traffic interception with/without proxy certificates

V1 test deprecation (tests/ios/MASVS-NETWORK/MASTG-TEST-0067.md):

• Added deprecation metadata pointing to v2 test

New best practice (best-practices/MASTG-BEST-0025.md): "Properly Configure App Transport Security"

• Explains ATS security features and benefits
• Provides guidance on minimizing ATS exceptions
• Shows secure vs insecure configuration examples
• References official Apple documentation

New demo (demos/ios/MASVS-NETWORK/MASTG-DEMO-0068): "Insecure App Transport Security Configuration"

• Demonstrates Info.plist with NSAllowsArbitraryLoads enabled (fails MASTG-TEST-0067)
• Includes working run.sh script to extract ATS configuration
• Provides clear evaluation of security implications
• References MASTG-BEST-0025

---

[x] I have read the contributing guidelines.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>MASTG v1->v2 MASTG-TEST-0067: Testing Endpoint Identity Verification (ios)</issue_title>
<issue_description>
Create a new MASTG v2 test covering for":

• Title: Testing Endpoint Identity Verification
• ID: MASTG-TEST-0067
• Link: https://mas.owasp.org/MASTG/tests/ios/MASVS-NETWORK/MASTG-TEST-0067/
• Platform: ios
• MASVS v1: ['MSTG-NETWORK-3']
• MASVS v2: ['MASVS-NETWORK-1']

Follow the guidelines
</issue_description>

<agent_instructions>While doing this task, follow the instructions in .github/instructions/porting-mastg-v1-tests-to-v2.instructions.md</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes MASTG v1->v2 MASTG-TEST-0067: Testing Endpoint Identity Verification (ios) #2954

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[cpholguera]

@copilot please also create a best practice file and at least one demo for this test.

[Copilot]

@copilot please also create a best practice file and at least one demo for this test.

Done! I've added:

Best Practice (MASTG-BEST-0025): "Properly Configure App Transport Security"

• Explains how to use ATS securely
• Provides guidance on minimizing exceptions
• Shows secure vs insecure configuration examples

Demo (MASTG-DEMO-0068): "Insecure App Transport Security Configuration"

• Demonstrates Info.plist with NSAllowsArbitraryLoads enabled
• Includes working run.sh script
• Shows clear evaluation of the security issue

The test now references the best practice. Commit: 349d260