DOCSEARCHbyAlgolia
Submit Docs

OWASP Mobile Application Security Testing Guide (MASTG)

repository·master·Indexed 11 days ago

https://github.com/owasp/mastg

A technical manual for mobile application security testing and reverse engineering. It provides practical implementation guidance for the OWASP Mobile Application Verification Standard (MASVS) and Mobile Security Weakness Enumeration (MASWE), including security checklists, reverse engineering challenges (Crackmes), and best practices for Android and iOS development.

Tokens
305.3K
Snippets
679
Records
1.3K
Agent score
95%

What's inside OWASP MASTG

  1. Overview of drozer security testing framework

    master

    drozer is a security testing framework for Android designed to discover and interact with the attack surface exposed by apps. It allows you to assume the role of an app interacting with the Android runtime, IPC endpoints, and the underlying OS.

    Key capabilities include:

    • Discovering and interacting with app attack surfaces.
    • Executing dynamic Java code on a device without needing to compile/install scripts.
    • Running on both emulators and real devices (even in production states without USB debugging enabled).
    • Extending functionality via additional modules for automated regression testing.

  2. Overview of Corellium for Mobile Security Testing

    master

    Corellium is a cloud-based device virtualization platform used for creating and managing virtual iOS and Android devices. It is designed for dynamic analysis, security testing, and application research.

    Key features available via the Corellium GUI include:

    • Built-in file browser: For interacting with the device filesystem.
    • Built-in Frida server: For dynamic instrumentation.
    • Snapshot management: To save and revert device states.
    • Network monitor: To observe device network traffic.

    Corellium also provides APIs for automation and integration with other security testing tools.

  3. Overview of OWASP Mobile Application Security Testing Guide (MASTG)

    master

    The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual designed for mobile application security testing and reverse engineering. It provides technical processes to verify weaknesses identified in the OWASP Mobile Security Weakness Enumeration (MASWE), which are aligned with the controls defined in the OWASP Mobile Application Verification Standard (MASVS).

    The relationship between these projects is as follows: OWASP MASVS (Standards) $\rightarrow$ OWASP MASWE (Weaknesses) $\rightarrow$ OWASP MASTG (Testing Guide/Manual).

  4. Overview of Frooky capabilities

    master

    Frooky is a Frida-based dynamic analysis tool for Android and iOS that uses JSON-based hook configurations instead of custom Frida scripts.

    Key features include:

    • Method Interception: Hook Java/Kotlin methods and native C/C++ functions, including support for method overloads with specific argument signatures.
    • Data Capture: Capture stack traces with configurable depth and decode multiple argument data types.
    • Logic & Filtering: Trigger hooks conditionally based on argument values or stack patterns.
    • Output: Produces JSON Lines (NDJSON) output for easy data processing.
    • Configuration: Supports merging multiple hook files together.

  5. Overview of Scripts and Deliverable Generation

    master

    The src/ directory contains the scripts and assets required to generate the project's primary deliverables, such as the official website and security checklists.

    Key components include:

    • scripts/: A directory containing scripts for generating MAS deliverables (e.g., the website and checklists).
    • contributors.py: A Python script used to retrieve and categorize current contributors based on their contributions.

  8. Understand the GitHub Actions Workflows

    master

    The project uses GitHub Actions for automation, located in .github/workflows. These workflows handle documentation generation, website building, linting, and security scanning.

    Available workflows include:

    • Document (docgenerator.yml): Generates the MAS Checklist using src/scripts/yaml_to_excel.py.
    • Build Website (build-website.yml): Builds the website and deploys it to the gh-pages branch.
    • Markdown Linter (markdown-linter.yml): Validates markdown files using the .markdownlint.json configuration.
    • URLs Checker (url-checker.yml, url-checker-pr.yml): Checks for broken URLs using the configuration in .github/workflows/config/url-checker-config.json.
    • Spell Checker (spell-checker.yml): Performs spell checking on project content.
    • CodeQL Security Scan (codeql-analysis.yml): Scans Python code for security vulnerabilities.
    • Labeler (labeler.yml): Automatically applies labels to Pull Requests based on the rules defined in .github/labeler.yml.

  9. Use UnCrackable Mobile Apps for reverse engineering challenges

    master
    The UnCrackable Apps for Android and iOS are a collection of mobile reverse engineering challenges used as practical examples throughout the OWASP Mobile Application Security Testing Guide (MASTG). They are designed to be solved as exercises to practice mobile security testing and reverse engineering techniques.

  10. Understand the iOS Security Architecture and Platform Model

    master

    iOS is a mobile operating system based on Darwin (an open-source Unix-based OS) and uses the XNU hybrid kernel (combining Mach and FreeBSD components).

    Key security pillars of the iOS platform include:

    • Isolation: Apps are isolated from each other at the file system level using the iOS sandbox (historically called Seatbelt), which is a mandatory access control (MAC) mechanism.
    • Restricted Environment: Compared to desktop OSs or Android, iOS apps have significantly limited system API access and very few Inter-Process Communication (IPC) options to minimize the attack surface.
    • Hardware/Software Integration: Security is bolstered by uniform hardware providing features like secure boot, hardware-backed Keychain, and file system encryption (referred to as data protection).
    • Controlled Distribution: The official distribution channel is the Apple App Store. While sideloading is generally restricted, it can be achieved via USB using Xcode (on iOS 9 or higher) or through the Apple Developer Enterprise Program for enterprise distribution.

  11. Navigate the OWASP MASTG sections

    master

    The MASTG is organized into three main functional areas:

    • General Testing Guide: Contains mobile app security testing methodologies and OS-independent vulnerability analysis techniques (e.g., authentication, session management, network communications, and cryptography).
    • Android Testing Guide: Covers platform-specific security testing for Android, including security basics, test cases, reverse engineering, and tampering prevention.
    • iOS Testing Guide: Covers platform-specific security testing for iOS, including OS overview, security testing, reverse engineering, and tampering prevention.

  12. Understand MAS Testing Profiles

    master

    The OWASP Mobile App Security (MAS) Testing Profiles are structured frameworks used to evaluate mobile app security and privacy. They provide a series of security controls and tests categorized by levels of assurance.

    Developers and security professionals can use these profiles for:

    • App Security Assessment: Identifying vulnerabilities and gaps in security controls.
    • Secure-by-Design: Incorporating security controls into the development lifecycle proactively.
    • Compliance and Risk Management: Aligning with regulatory standards and industry best practices.
    • App Vetting: Establishing a foundation for organizational app vetting processes before deployment.