Repolode
Submit
OWASP

OWASP/mastg

A comprehensive OWASP manual describing technical processes for mobile app security testing and reverse engineering on Android and iOS.

View on GitHubWebsite
Stars
13,318
Forks
2,846
Open issues
252
Last commit
9 hours ago

What is it?

The OWASP Mobile Application Security Testing Guide (MASTG) is a detailed manual for testing the security of mobile applications. It documents the technical processes used to verify the weaknesses enumerated in the OWASP MASWE, which align with the controls of the OWASP MASVS.

The guide covers static analysis, dynamic analysis, runtime analysis, network analysis, cryptography testing and reverse engineering techniques for Android and iOS apps. It is published as a web book at mas.owasp.org and also serves as the basis for the project's downloadable security checklists.

Security engineers, penetration testers and developers who need a structured reference for mobile app assessment can use it as a shared methodology and checklist source.

Key features

  • 01Covers static, dynamic, runtime and network analysis for mobile apps
  • 02Maps test procedures to OWASP MASWE weaknesses and MASVS controls
  • 03Includes testing guidance for cryptography and reverse engineering
  • 04Provides downloadable mobile app security checklists
  • 05Published as an online web book at mas.owasp.org

Use cases

  • Planning and executing a security assessment of an Android or iOS app
  • Building a standardized mobile security test checklist for a team
  • Learning the methodology behind mobile app penetration testing
  • Aligning app testing with MASVS compliance requirements

Things to know

  • Licensed under CC BY-SA 4.0, so derivative works must be shared under the same license.

In collections

Android apps & phone tools

Topics

#mobile-security#pentesting#reverse-engineering#android#ios#owasp#security-testing#android-application#compliancy-checklist#dynamic-analysis

FAQ

What is mastg?
A comprehensive OWASP manual describing technical processes for mobile app security testing and reverse engineering on Android and iOS. The OWASP Mobile Application Security Testing Guide (MASTG) is a detailed manual for testing the security of mobile applications. It documents the technical processes used to verify the weaknesses enumerated in the OWASP MASWE, which align with the controls of the OWASP MASVS.
Is mastg free to use? What license does it have?
mastg is open source under the CC-BY-SA-4.0 license. Check the license terms before using it in commercial products.
Is mastg still maintained?
Actively maintained. The last commit to mastg was on Nov 7, 2026.
What can I use mastg for?
Planning and executing a security assessment of an Android or iOS app Building a standardized mobile security test checklist for a team Learning the methodology behind mobile app penetration testing Aligning app testing with MASVS compliance requirements
Where can I get mastg?
The source code and installation instructions are on GitHub: https://github.com/OWASP/mastg

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects