What is this?
A comprehensive OWASP manual for mobile app security testing and reverse engineering. It gives technical processes for verifying the weaknesses listed in the OWASP Mobile Security Weakness Enumeration (MASWE).
A comprehensive OWASP manual for mobile app security testing and reverse engineering. It gives technical processes for verifying the weaknesses listed in the OWASP Mobile Security Weakness Enumeration (MASWE).Is it a book I read, or a tool I install and run?It's a reference manual you read online at the MASTG website, together with downloadable Mobile App Security Checklists — nothing to install. The repo holds the guide's source content and website tooling.
It's a reference manual you read online at the MASTG website, together with downloadable Mobile App Security Checklists — nothing to install. The repo holds the guide's source content and website tooling.Who is this guide for?Mobile security testers and pentesters verifying apps against the OWASP MAS standards. It is trusted by platform providers, standardization bodies, governmental and educational institutions.
Mobile security testers and pentesters verifying apps against the OWASP MAS standards. It is trusted by platform providers, standardization bodies, governmental and educational institutions.Does it cover both iOS and Android?Yes — both. The guide spans Android and iOS testing, and the project's CI even builds demo apps for each platform to illustrate the techniques.
Yes — both. The guide spans Android and iOS testing, and the project's CI even builds demo apps for each platform to illustrate the techniques.How do MASVS, MASWE and MASTG fit together?They form one OWASP MAS stack: MASVS is the verification standard listing the controls, MASWE enumerates the weaknesses, and the MASTG describes the technical processes to verify each of those weaknesses.
They form one OWASP MAS stack: MASVS is the verification standard listing the controls, MASWE enumerates the weaknesses, and the MASTG describes the technical processes to verify each of those weaknesses.What are the Crackmes?Practice apps published by the project that you can legally reverse engineer and attack, so you can safely try the techniques the guide teaches.
Practice apps published by the project that you can legally reverse engineer and attack, so you can safely try the techniques the guide teaches.Is it free, and can I reuse the content?It's a free, open OWASP project under the CC-BY-SA-4.0 license, so the content can be read and shared freely with attribution on share-alike terms.
It's a free, open OWASP project under the CC-BY-SA-4.0 license, so the content can be read and shared freely with attribution on share-alike terms.Is the project still active?Yes — it has been developed since 2016, counts over 13,000 GitHub stars, and its CI workflows build Android and iOS demo apps.
Yes — it has been developed since 2016, counts over 13,000 GitHub stars, and its CI workflows build Android and iOS demo apps.What are similar projects?Mobile-Security-Framework-MobSF, UniRoot, x64dbg, awesome-reverse-engineering, shannon, android-reverse-engineering-skill, FilzaSlop, V3SP3R
Mobile-Security-Framework-MobSF, UniRoot, x64dbg, awesome-reverse-engineering, shannon, android-reverse-engineering-skill, FilzaSlop, V3SP3RWhich topics is it in?dynamic-analysis, android-application, network-analysis, checklist, mobile-security, appsec, security-audit, ios-app, offensive-security, pentesting, static-analysis, penetration-testing
dynamic-analysis, android-application, network-analysis, checklist, mobile-security, appsec, security-audit, ios-app, offensive-security, pentesting, static-analysis, penetration-testing