OWASP Mobile Security Testing Guide
“Define the industry standard for mobile application security.”
This OWASP flagship project provides a security standard for mobile apps (OWASP MASVS) and a comprehensive testing guide (OWASP MSTG) that covers the processes, techniques, and tools used during a mobile app security test, as well as an exhaustive set of test cases that enables testers to deliver consistent and complete results.
Trusted by …
The OWASP MASVS and MSTG are trusted by the following platform providers and standardization, governmental and educational institutions. Learn more.
OWASP Mobile Application Security Verification Standard (MASVS)
The OWASP MASVS is a standard for mobile app security. It can be used by mobile software architects and developers seeking to develop secure mobile applications, as well as security testers to ensure completeness and consistency of test results.
- GitHub Repo
- 📖 Read the MASVS on Gitbook (English Version, see more languages here)
- ⬇️ Download the latest PDF
OWASP Mobile Security Testing Guide (MSTG)
The OWASP MSTG is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the controls listed in the OWASP Mobile Application Verification Standard (MASVS).
Feel free to download the EPUB or Mobi for any amount you like. All funds raised through sales of this book go directly into the project budget and will be used to for technical editing and designing the book and fund production of future releases.
Mobile App Security Checklist
A checklist is available for use in security assessments based on the MASVS and MSTG. It contains links to the MSTG test case for each MASVS requirement.
Its features include:
- Unifies all MASVS categories into a single sheet
- Traceable via exact MASVS and MSTG versions and commit IDs
- Always up to date with the latest MSTG and MASVS versions
- Enables user to add more columns or sheets as needed
- Multi language
Below you can find a list of upcoming and previous talks:
|June 2022||OWASP Tunisia||Securing Mobile Apps with the MASVS. Our Journey to v2.0||Recording||Slides|
|June 2022||OWASP AppSec EU||“Mobile Wanderlust”! Our journey to Version 2.0!||N/A||Slides|
|February 2022||OWASP Toronto||Insider’s Guide to Mobile AppSec with OWASP MASVS||Recording||N/A|
|November 2021||NSConnect||MASVS & MSTG Refactoring||Recording||Slides|
|September 2021||OWASP 20th Anniversary||MASVS & MSTG Refactoring||Recording||Slides|
|September 2020||Ekoparty Security Conference||(Spanish) OWASP Mobile Project and how to use it for white hat hacking||Recording||Slides|
|May 2020||OWASP Dutch Virtual chapther meetup||MSTG Update||Recording||N/A|
|February 2020||OWASP New Zealand Day||Building Secure Mobile Apps (you don’t have to learn it the hard way!)||info|
|January 2020||iOS Conf Singapore||Building Secure iOS Apps (you don’t have to learn it the hard way!)||Recording||Slides|
|October 2019||OWASP AppSec Day Melbourne||Fixing Mobile AppSec Recording|
|September 2019||OWASP Global AppSec Amsterdam||Fast Forwarding mobile security with the OWASP Mobile Security Testing Guide|
|September 2019||r2con in Barcelona||radare2 and Frida in the OWASP Mobile Security Testing Guide||Recording||Slides|
|Summer 2019||Open Security summit 2019||Outcomes|
|April 2019||OWASP Kyiv||OWASP MSTG in real life|
|March 2019||AppDevcon (Amsterdam)||Securing your mobile app with the OWASP Mobile Security Testing Guide||info|
|November 2018||OWASP BeNeLux days 2018||Fast forwarding mobile security with the MSTG||N/A||Slides|
|November 2018||OWASP Germany Day 2018||Introduction to Mobile Security Testing: Approaches and Examples using OWASP MSTG||Recording (in German)||Slides|
|October 2018||DBS AppSecCon (Singapore)||Fixing Mobile AppSec||N/A||N/A|
|October 2018||OWASP Bay Area Chapter||Mobile Testing Workshop||N/A||N/A|
|October 2018||OWASP AppSec USA||Fixing Mobile AppSec||N/A||N/A|
|October 2018||CSC 2018||A Perspective on Mobile Security in IoT and how OWASP can Help||N/A||Slides|
|January 2018||OWASP North Sweden Umea||Mobile Security Essentials||N/A||N/A|
|January 2018||OWASP Gotentburg||Mobile Security Essentials||Introduction into OMTG, All about the keying material|
|2017||OWASP Day Indonesia 2017||Fixing Mobile AppSec||N/A||N/A|
|2017||OWASP Poland Day 2017||Pawel Rzepa||Testing Mobile Applications||N/A||Slides|
|2017||OWASP AppSec EU 2017||Fixing Mobile AppSec info||Slides||Recording|
Using the OWASP Mobile App Security Verification Standard, Testing Guide and Checklist
The documents produced in this project cover many aspects of mobile application security, from the high-level requirements to the nitty-gritty implementation details and test cases. They can be used to plan and verify security controls during any phase of mobile app development, as well as during pre-release code review and penetration testing.
- The Mobile Application Security Verification Standard (MASVS) contains generic security requirements along with mappings to verification levels that can be chosen depending on the overall need for security.
- The Mobile Security Testing Guide (MSTG) provides verification instructions for each requirement in the MASVS, as well as security best practices for apps on each supported mobile operating system (currently Android and iOS). It is also useful as a standalone learning resource and reference guide for mobile application security testers.
- The Mobile App Security Checklist can be used to apply the MASVS requirements during practical assessments. It also conveniently links to the MSTG test case for each requirement, making mobile penetration testing a breeze.
It is important to note that the security standard, testing guide and checklists are closely related: They all map to the same basic set of requirements. Depending on the context, the documents can be used stand-alone or in combination to achieve different objectives.
For example, the MASVS requirements may be used in the planning and architecture design stages, while the checklist and testing guide may serve as a baseline for manual security testing or as a template for automated security tests.
Mobile App Security Testing
The checklist works great as a reference during mobile app security assessments. You can walk through the requirements one-by-one - for more information on how to test each requirement, simply click on the links in the “Android” and “iOS” columns. Or, fill out the checklist at the end of an assessment to ensure completeness.
Security Engineering in the SDLC
Properly defined security requirements are an important part of the Secure SDLC. The MASVS levels can be used along with threat modeling to determine the appropriate set of security controls for a particular mobile app. MASVS V1 also lists requirements pertaining to the architecture and design of the mobile apps, as well as general processes and activities that should be part of the development process.
Mobile App Security Education
The Mobile Security Testing Guide can be used as a standalone learning resource. Its main chapters contain general how-tos and tutorials that cover a variety of topics from mobile OS internals to advanced reverse engineering techniques.
If you’d like to support the Mobile Security Testing project we’ll be happy to accept your donations. You may donate 5, 500, 5000 (USD/EUR/GBP) or any custom amount. Certain amounts allow you to opt-in for a “Donation Package” (see below).
100% of the funds raised go directly to the OWASP foundation and allow us to ask for budget to fund our project activities:
- Editing and proofreading by professional editors.
- Graphic design and layout improvements.
- Improving our automated delivery pipelines.
- Acquiring new test devices if certain tests can not be executed on existing emulators/simulators/test devices.
Make your Donation
Make your donation directly from the OWASP website by clicking the DONATE button above.
When you click on the DONATE button and fill in the form be sure to verify that it has the line:
“Publicly list me as a supporter of OWASP Mobile Security Testing Guide”
Register your Donation Package (optional)
If you’d like to opt-in for a Donation Package please fill out the MSTG Donation Form (which will create a new Issue in the MSTG).
Please note that the OWASP Donation Policy has changed since 22-Sept-2020. All details can be found in OWASP Donations Policy page.
These types of public recognition shall be online no less than one year, or in the case of Project no less than the next major release, whichever is greater. Some Donation Packages have a maximum duration, once reached the logos will be removed and the donator will still be listed as supporter on the project website, GitHub and in the printed and digital versions. This can be renewed anytime.
Good Samaritan (USD 500)
- Listed as a supporter on the project website and GitHub.
- Listed as a supporter in the printed and digital versions (without logo).
- Duration: 1 year
- Optional: 1 Paperback Book
Honorable Benefactor (USD 2,000 / 8 Available)
- Small company logo in the “Honorable Benefactors” section on project website and Github.
- Small company logo on the supporter page of the printed and digital versions.
- Duration: 2 years
- Optional: 3 Paperback Books
God Mode Donator (USD 4,000 / 5 Available)
- Large company logo in the “God mode donators section on project website and Github.
- Large company logo on the supporter page of the printed and digital versions.
- Duration: 3 years
- Optional: 5 Paperback Books
Other Forms of Donation
If you still want to help out the project you can always contribute with content for the MASVS or the MSTG and end up at our acknowledgement section or you can buy digital copies of the MSTG at Leanpub. Donators can be mentioned in the acknowledgement section as well, from 25 USD onward. Note that you are anonymous to us when you buy via Leanpub. Therefore, if you want to get listed, submit your payment receipt to Sven Schleier or Carlos Holguera.
May 23rd 2020: New build system and release upcoming!
As already shared during the virtual Dutch Chapter meetup: we are going to release a new version of the MSTG soon. We have been quite busy with moving it to the new build system first as the document got too large for our old tooling. This is a great incentive as well to think of how we can make the guide more focused so that the size does not matter ;-)
More news on the new release will follow soon…
April 10th 2020: #StayHome and share your knowledge!
we are all in more or less restrictive lock-down situations, but the guideline is always #StayHome. This is definitely a challenging time for you, but also us. But luckily it was also never easier to collaborate and share, through so many different tools and platforms.
The OWASP Mobile Security Testing Guide (MSTG) project team wants to encourage people to #StayHome and also use this time to share your knowledge with the community. So if you want to either share your knowledge in mobile security or are just keen in doing some research in this area, we have many open issues where we are still looking for volunteers.
If you can close 5 issues that we marked with the tag #StayHome we will sent you in return a hard copy of the OWASP MSTG! We are giving away a total of 5 books on a first come first serve basis.
If you are interested, do the following:
Go through the open issues in our Github repo with the tag #StayHome.
Make a comment on the issue that you would like to take care of, which will be assigned on a first come first serve basis. For any clarifications you can ping either Carlos or Sven in OWASP Slack. If you don’t have an account yet, please check here on how to register.
Work on the issue and create a Pull Request (PR). If you are new to Git(hub), check out our contribution guide for further details.
We will review the PR and merge once all comments are addressed/resolved.
Start at 1. :-)
We would love to have you as a contributor. Feel free to share the mail or like our tweet
Stay safe, take care and #StayHome!
Sven, Jeroen and Carlos
March 17th, 2020: International release of MASVS 1.2
A new version of the OWASP Mobile Application Security Standard (MASVS) was released! The MASVS establishes baseline security requirements for mobile apps and summarizes them in one standard. With this new release we achieved a significant alignment and coverage with existing mobile security documents from ENISA, older NIST documents, OWASP Mobile top 10, and others. The new version 1.2 is available in Github Releases: https://github.com/OWASP/owasp-masvs/releases/tag/v1.2. For more details please look into our Changelog for Version 1.2 and Version 1.2-RC https://github.com/OWASP/owasp-masvs/blob/master/Document/CHANGELOG.md.
Thanks to the great support of our community we have now 9 different languages available in total for the MASVS and would like to thank all of our translators for their great work and support throughout:
- Chinese (traditional) - Peter Chi, Lex Chien, Henry Hu and Leo Wang
- Chinese (simplified) - Bob Peng, Harold Zang and Jack S
- English - Jeroen Willemsen, Sven Schleier, Carlos Holguera and Jeroen Beckers
- French - Romuald Szkudlarek, Abderrahmane Aftahi and Christian Dong (Review)
- German - Rocco Gränitz and Sven Schleier
- Japanese - Koki Takeyama and Riotaro Okada (Review)
- Korean - Youngjae Jeon, Jeongwon Cho, Jiyou Han and Jiyeon Sung
- Russian - Eugen Martynov, Gall Maxim, Chelnokov Vladislav (Review), Oprya Egor (Review) and Tereshin Dmitry (Review)
- Spanish - Martin Marsicano and Carlos Holguera
The MASVS and its translations are available in PDF, Mobile, ePub, docx and you can also read it via Gitbook. See here for details: https://github.com/OWASP/owasp-masvs#getting-the-masvs
The project team (Sven Schleier, Jeroen Willemsen and Carlos Holguera) would like to thank all the contributors, translators and those who build the improved automation around it and all their hard work and support in the last few months! New releases will be much faster thanks to our GitHub actions and Docker containers. Next to that, we are happy to add Korean and Chinese Simplified to our ever growing list of translations! We will finalize the document generation system and then apply the same build system to the Mobile Security Testing Guide (MSTG) in order to speed up the release process and release more frequently.
October 4th, 2019: Pre-release of MASVS 1.2!
We have a pre-release of MASVS Version 1.2. This will be the reference document for further translations.
October 2nd, 2019: MSTG Playground Release!
Want more training apps? We hear you! We just released the MSTG-Android-Java & MSTG-Android-Kotlin for Android and the MSTG-JWT app for iOS. Come and check it out at the release page! With special thanks to Sven Schleier(@sushi2k), Wen Bin Kong (@kongwenbin), Nikhil Soni (@nikhil), and Ryan Teoh (@ryantzj).
October 2nd, 2019: MSTG Project joins Hacktoberfest!
September 17th, 2019: Xamarin experiment!
We have launched a react-native experiment based on our compliance checklist. Want to teach others how to validate React Native apps against the MASVS? Check this Google sheet!
September 6th, 2019: Flutter experiment!
We have launched a react-native experiment based on our compliance checklist. Want to teach others how to validate React Native apps against the MASVS? Check this Google sheet!
September 6th, 2019: React native experiment!
We have launched a react-native experiment based on our compliance checklist. Want to teach others how to validate React Native apps against the MASVS? Check this Google sheet!
August 29th, 2019: Carlos Holguera joins the leader team
We are happy to announce that Carlos Holguera joins us as an official MSTG Author and co-leader! With a team of 3 we hope to march further as that would make our lives easier given that all of this hard work is done by volunteers!
August 4th, 2019: OSS Release!
After a lot of work, we finally have a new release of the MSTG! Want to know more? Head over to the Github release page.
August 2nd, 2019: Project promoted to Flagship status!
We have been awarded Flagship status! We are very grateful and excited about this! We could not have done this without our team of awesome volunteers that have committed to the project, wrote issues, and supported us in many other ways. A special thanks goes out to OWASP and especially Harold Blankenship for facilitating us to function as a project and for leading the project review at OWASP Appsec Tel-Aviv! Thank you!
June 5th, 2019: New release of the MASVS
As the summit is progressing, so are we! We have just released a new version of the MASVS (1.1.4). Want to know more? Head over to the Github release page!
May 21nd, 2019: New release of the MSTG
As part of the preparations for the Open Security Summit, we have released a new version of the MSTG. Want to know more? Head over to the Github release page!
May 7th, 2019: New release of the MSTG
After many changes, we decided it was time to create a new release in order to improve the book version! Want to know more? Head over to the Github release page.
April 15th, 2019: Book version, project promotion & preparation for the summit
Given that most news is already shared via OWASP Slack over the last quarter, we still see that it is good to share a summary of all of the good things outside of Slack using this news section. In this update we have a lot to share! While we started off this year with an improved version of the MASVS and MSTG, things have not been quiet: there has been a huge development in master of the MSTG and many issues have been raised and fixed. In the meantime, we have worked on an actual print of the book! While an early version is available through Hulu (no link supplied, google and buy at your own risk), we are working on making a better version of that book. In the mean time we have filed for a project promotion to Flagship! Next a lot more cool things happened: with the now official publication of NIST Special Publication (SP) 800-163 Revision 1, the MASVS and MSTG are getting more mainstream ;-). The MASVS & MSTG are mentioned in various other upcoming programs/standards/recommendations as well, which is really a recognition of the hard work put in by the community. We are proud to be part of such a great project! Next, we are preparing to join the Open Security Summit again! Already three people will be on site, and at least one remote, but we would love to work with more people at the project again! Want to know more? Please get in touch via Slack and join the #project-mobile_omtg channel or follow us on Twitter.
January 15th, 2019: Release of improved checklist
We released a new version of the checklist! This version has adaptable references so that it can be used with newer versions of the MSTG as well. This version is currently available in French and English and we hope to add the Russian, Japanese, German and Spanish version soon! Want to know more? Take a look at our release page!. We would like to thank our volunteers for their effort to deliver these easy to use checklists!
January 3rd, 2019: Multilanguage Release 1.1.2 of the MASVS
We released the 1.1.2 version of the OWASP MAVS! This is the first version in Chinese, English, French, German, Japanese, Russian, and Spanish! Exactly: we just added French, German, Japanese and Chinese! Obviously this would not be possible without all the volunteers that helped us with translations, feedback, updating, and automating the release process! We are grateful for the awesome team that pulled this off! Want to see the result? Take a look at our release page!
November 39th, 2018: Release 1.1.0 of the MSTG
We released the 1.1.0 version of the OWASP MSTG! Now all requirements of the MASVS have at least one covering testcase. We would like to thank all of our contributors for their hard work! Want to check it out? Check the releases!.
October 28th, 2018: Call for Company references
We are looking for company references that are using or have used the OWASP-MSTG and/or MASVS. If you have done so and are ok with being mentioned: please email to [email protected]
October 28th, 2018: The MASVS is getting more translations
Thanks to Romuald, Koki and many others, new translations of the MASVS are popping up. We now have a Japanese translation added and the French, German and Persian translations are in development. Each of them will be released the moment our release-automation of the MASVS is completed. Until then: feel free to checkout the sources!
October 18th, 2018: The MSTG is now officially an OWASP Lab Project!
During AppSec US 2018 in San Jose the Mobile Security Testing Guide was reviewed by several volunteers to assess the maturity of the project. As a result our request for project graduation to lab status was granted. The reviews can be found here.
Thanks to Harold Blankenship for organising the project review event during AppSec US and for pushing things forward for all the OWASP projects and of course to all people that took the effort to review our project!
October 13th, 2018: MSTG 1.0.2 released & Twitter account!
While working hard towards the 1.1.0 milestone of the MSTG, we released the 1.0.2 version. From now onward we have better PDF, Epub and Mobi files! We hope to port this to the MASVS after the Github release. We now have an official Twitter account: @OWASP_MSTG!
September 21th, 2018: MASVS automation started
Now that the document generation process for the MSTG has been optimized enough for milestone 1.1.0 (and we reached #1000 in Github of issues and Pull requests), we have started to improve the MASVS releasing mechanism. This will be further improved after Appsec USA and the release of 1.1.0 of the MSTG.
September 16th, 2018: MSTG 1.0.1 released
The Mobile Security Testing Guide version 1.0.1 has been released using our automated release system (based on tagging). See the CHANGELOG.md for all the changes. We now have added pdf support and improved our .docx quiet a lot. We will further improve the release process for the pdf and epubs after milestone 1.1.0.
September 1st, 2018: Mobile Security Testing Guide mentioned in NIST SP-163r1
The Mobile Security Testing Guide is now reference in NIST SP 800-163 Revision 1 .
Augustus 2nd, 2018: Mobile App Security Verification Standard Releases
A lot has happened & we are happy to announce that version 1.1 of the MASVS got released! Not just in English, but in Spanish and Russian as well. Want to know more? check the releases!. We would like to thank our Russian and Spanish speaking volunteers that have put quite some effort in translating the document! Lastly, we would like to announce that not all minor version releases will be in this news-section, unless something really important changed. Do you want to have the latest version of the MASVS? Just check Github!
June 16th, 2018: Jeroen Willemsen joins as project lead
Jeroen Willemsen has joined as a project leader for the OMTG project.
June 15th, 2018: Mobile Security Testing Guide - Release 1.0
The Mobile Security Testing Guide is now available for download in various formats. This is the first release of the MSTG and is a great community effort. We want to thank all contributors through this great journey. Thank you!
January 13th, 2018: Mobile App Security Verification Standard Release 1.0
September 14th, 2017: Mobile App Security Verification Standard Update
Version 0.9.4 of the MASVS is now available for download. This release contains several bug fixes and modifications to security requirements.
July 5th, 2017: Sponsorship Packages Announced
We are happy to announce that a limited amount of sponsorship packages will be made available shortly through our crowdfunding campaign. With these packages, we offer companies opportunities to create brand awareness and maximize visibility in the mobile security space. 100% of the funds raised go directly into the project budget and will be used to fund production of the final release.
June 17th, 2017: The OWASP Mobile Security Testing Guide - Summit Preview
The MSTG Summit Preview is an experimental proof-of-concept book created on the OWASP Summit 2017 in London. The goal was to improve the authoring process and book deployment pipeline, as well as to demonstrate the viability of the project. Note that the content is not final and will likely change significantly in subsequent releases. Download the ebook here.
Mobile Security Testing Workshop on the OWASP Summit 2017
The OWASP MSTG team is organizing a 5-days mobile security track on the OWASP Summit 2017. The track consists of a series of book sprints, each of which focuses on producing content for a specific section in the OWASP MSTG, as well as proof-reading and editing the existing content. The goal is to make as much progress on the guide as is humanly possible. Depending on the number of participants, we’ll split into sub-groups to work on different subsections or topic areas.
How to Join
Join up for the working session(s) you like by following the link(s) on the mobile security track page, then hitting the “Edit this page here” link at the bottom, and adding yourself to the “participants” field. Signing up is not mandatory, but helps us to better organize the sessions. Don’t worry though if your session of choice happens on the “wrong” day - you can always simply stop by and we’ll brief you on your topic of choice. After all, this is the Woodstock of appsec!
Mobile security track main page:
Mobile security track schedule:
April 5th, 2017: Mobile App Security Verification Standard Update
Version 0.9.3 of the MASVS is now available for download. This release contains several bug fixes and modifications to security requirements:
* Merged requirements 7.8 and 7.9 into for simplification * Removed Anti-RE controls 8.1 and 8.2 * Updated MSTG links to current master * Section "Environmental Interaction" renamed to "Platform Interaction" * Removed To-dos * Fixed some wording & spelling issues
January 31st, 2017: Mobile App Security Verification Standard v0.9.2 Available For Download
The Mobile App Security Verification Standard (MASVS) has undergone a major revision, including a re-design of the security model and verification levels. We also revised many security requirements to address the multitude of issues raised on GitHub. The result is MASVS v0.9.2, which is now available for download in PDF format.
As the MASVS is nearing maturity, we have decided to freeze the requirements until the Mobile Testing Guide and checklists “catch up” (due to the one-to-one mapping between requirements in the MASVS and MSTG, changes to the requirements make it necessary to update the other documents as well, causing repeated effort). Unless major issues pop up, the current list will therefore remain in place until MASVS/MSTG v1.0, and further changes will be reserved for v1.1 or later releases.
The MASVS is a community effort to establish security requirements for designing, developing and testing secure mobile apps on iOS and Android. Join the OWASP Mobile Security Project Slack Channel to meet the project members! You can sign up for an account here.
January 28th, 2017: Mobile Crackmes and Reversing Tutorials
A key goal of the OWASP Mobile Testing Project is to build the ultimate learning resource and reference guide for mobile app reversers. As hands-on hacking is by far the best way to learn, we’d like to link most of the content to practical examples.
Starting now, we’ll be adding crackmes for Android and iOS to the GitHub repo that will then be used as examples throughout the guide. The goal is to collect enough resources for demonstrating the most important tools and techniques in our guide, plus additional crackmes for practicing. For starters there are three challenges:
We Need More Authors and Contributors!
Maybe you have noticed that the reverse engineering sections in the Mobile Testing Guide are incomplete. The reason: We’re still in the starting stages and don’t have a lot of authors and contributors (in fact, 99% of the reversing content was produced by one guy). We’d love to welcome you as a contributor of crackmes, tutorials, writeups, or simply new ideas for this project.
What You Can Do
The OWASP MSTG is an open project and there’s a lot of flexibility - it mostly depends on your skill set and willingness to commit your time. That said, the some areas that need help are:
- Solving crackmes and contributing a tutorial to the guide (preferable a technique that’s not already documented. Check the TOC first).
- Writing and adding new crackmes along with solutions (should also describe something not already in the guide. Cracking white-boxes, dynamic analysis using an emulator / introspection, etc. etc.).
- General reversing write-ups to describe specific processes and techniques
- Tampering and Reverse Engineering - General Overview
- Tampering and Reverse Engineering on Android
- Tampering and Reverse Engineering on iOS
How To Join
January 22nd, 2017: Mobile Testing Guide TOC Available
As of now, we’ll be auto-generating a table of contents out of the current MSTG master branch. This reflects the current state of the guide, and should make it easier to coordinate work between authors. A short-term goal is to finalize the structure of the guide so we get a clearer picture of what will be included in the final document. Lead authors are encouraged to complete the outline of their respective chapters.
On another note, we still need additional authors to help with all sections of the guide, including mobile operating system overviews, testing processes and techniques, and reverse engineering. Especially iOS authors are in short supply! As usual, ping us on the Slack Channel if you want to contribute.
December 4th, 2016: Call For Authors: The Ultimate Open-Source Mobile App Reverse Engineering Guide
Reverse engineering is an art, and describing every available facet of it would fill a whole library. The sheer range techniques and possible specializations is mind-blowing: One can spend years working on a very specific, isolated sub-problem, such as automating malware analysis or developing novel de-obfuscation methods. For mobile app security testers, it can be challenging to filter through the vast amount of information and build a working methodology. Things become even more problematic when one is tasked to assess apps that are heavily obfuscated and have anti-tampering measures built in.
One of the main goals in the MSTG is to build the ultimate resource for mobile reverse engineers. This includes not only basic static and dynamic analysis, but also advanced de-obfuscation, scripting and automation. Obviously, writing all this content is a lot of work, both in terms of general content and OS-specific how-tos. We’re therefore looking for talented authors that want to join the project early on. Topics include the following:
- Basic Hybrid Static/Dynamic Analysis
- Code Injection and Dynamic Instrumentation (Substrate, FRIDA)
- Dynamic Binary Instrumentation (Valgrind, PIE)
- Analysis Frameworks (Metasm / Miasm)
- Symbolic Execution
- DCA and DPA attacks on white-box crypto
- Dynamic analysis frameworks (PANDA / DroidScope,…)
- Anything else we might have missed
What is in for me?
All of this is unpaid, volunteer work. However, depending on your contribution, you will be named in the “lead authors” or “contributors” list, and you’ll be able to point to the fact that you co-authored the guide. You’ll also be contributing to the field, helping others who are just starting out, and in turn becoming a happier person yourself (reaping the full benefits of your altruism).
Where do I sign up?
First of all, have a look at the existing RE chapters outline:
You’ll probably immediately have ideas on how you can contribute. If that’s the case, read the author’s guide first.
Then contact Bernhard Mueller - ideally directly on the OWASP Mobile Security Project Slack Channel, where you’ll find all the other project members. You can sign up for an account here.
How can I participate in your project?
We are searching for additional authors, reviewers and editors. The best way to get started is to consult our Contributing Guidelines.
- If there’s something you really want to see in the guide, or you want to suggest an improvement, open a discussion.
- If it qualifies for the OWASP MSTG we’ll upgrade it into an issue.
- Simply pick up one of our issues and let us know that you want to work on it.
- Of course if you’re simply proofreading and you’ve corrected some typos please open a Pull Request (PR) directly.
Where do you need help the most?
There’s a lot of areas where you can help out:
- Writing original content, such as describing testing processes and writing test cases. We’re all doing this in our spare time, which unfortunately means that things sometimes slow down to a crawl. If you’re knowledgeable in some area and have time available, we’d be incredibly thankful to anyone who contributes, even if it’s only one or two test cases.
- Reviewing content and giving feedback. The proper channel for questions and feedback is the GitHub issues system of the respective repo, contacting us on OWASP Mobile Security Project Slack Channel is another possibility.
- Developing tools. For example, we still don’t have an automated way of generating checklists out of the GitHub repo.
- Contributing to auxiliary projects such as the Hacking playground.
If I am not a programmer can I participate in your project?
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, pentesters, translators for the OWASP MASVS, developers and graphic designers. Note that some of the people who contribute to our project have started without any knowledge, but kept on researching until they had answers that were usable.
I contributed to the original Google Doc, but I’m not credited in the new version of the MSTG?
As we migrated some of the existing content, we did our best to backtrack the original authors and credit them appropriately. We also added a revision history that lists all the authors from old Google Docs. If you are not on that list but feel you should be, please contact Sven Schleier or Carlos Holguera. Or better yet, re-join the team and start contributing to the new guide.
Bernhard is a cyber security specialist with a talent for hacking systems of all kinds. During more than a decade in the industry, he has published many zero-day exploits for software such as MS SQL Server, Adobe Flash Player, IBM Director, Cisco VOIP, and ModSecurity. If you can name it, he has probably broken it at least once. BlackHat USA commended his pioneering work in mobile security with a Pwnie Award for Best Research.
Sven is an experienced web and mobile penetration tester and assessed everything from historic Flash applications to progressive mobile apps. He is also a security engineer that supported many projects end-to-end during the SDLC to “build security in”. He was speaking at local and international meetups and conferences and is conducting hands-on workshops about web application and mobile app security.
Jeroen is a principal security architect with a passion for mobile security and risk management. He has supported companies as a security coach, a security engineer and as a full-stack developer, which makes him a jack of all trades. He loves explaining technical subjects: from security issues to programming challenges.
Carlos is a cyber security engineer with many years of hands-on experience in the field of security testing for mobile apps and embedded systems such as automotive control units and IoT devices. He is passionate about reverse engineering and dynamic instrumentation of mobile apps and is continuously learning and sharing his knowledge.
Co-authors have consistently contributed quality content and have at least 2,000 additions logged in the GitHub repository.
Romuald is a passionate cyber security & privacy professional with over 15 years of experience in the web, mobile, IoT and cloud domains. During his career, he has been dedicating his spare time to a variety of projects with the goal of advancing the sectors of software and security. He is teaching regularly at various institutions. He holds CISSP, CCSP, CSSLP, and CEH credentials.
Jeroen is a mobile security lead responsible for quality assurance on mobile security projects and for R&D on all things mobile. Although he started his career as a programmer, he found that it was more fun to take things apart than to put things together, and the switch to security was quickly made. Ever since his master’s thesis on Android security, Jeroen has been interested in mobile devices and their (in)security. He loves sharing his knowledge with other people, as is demonstrated by his many talks & trainings at colleges, universities, clients and conferences.
Vikas is an experienced cyber security researcher, with expertise in mobile security. In his career he has worked to secure applications for various industries including fintech, banks and governments. He enjoys reverse engineering, especially obfuscated native code and cryptography. He holds masters in security and mobile computing, and an OSCP certification. He is always open to share his knowledge and exchange ideas.
🥇 MSTG Advocates
MSTG Advocates are industry adopters of the OWASP MASVS and MSTG who have invested a significant and consistent amount of resources to push the project forward by providing consistent high-impact contributions and continuously spreading the word. Learn more.
Note: This contributor table is generated based on our GitHub contribution statistics. For more information on these stats, see the GitHub Repository README. We manually update the table, so be patient if you’re not listed immediately.
Top contributors have consistently contributed quality content and have at least 500 additions logged in the GitHub repository.
- Pawel Rzepa
- Francesco Stillavato
- Henry Hoggard
- Andreas Happe
- Kyle Benac
- Paulino Calderon
- Alexander Anthuk
- Caleb Kinney
- Abderrahmane Aftahi
- Koki Takeyama
- Wen Bin Kong
- Abdessamad Temmar
- Cláudio André
- Slawomir Kosowski
- Bolot Kerimbaev
- Lukasz Wierzbicki
Contributors have contributed quality content and have at least 50 additions logged in the GitHub repository. Their Github handle is listed below:
kryptoknight13, DarioI, luander, oguzhantopgul, Osipion, mpishu, pmilosev, isher-ux, thec00n, ssecteam, jay0301, magicansk, jinkunong, nick-epson, caitlinandrews, dharshin, raulsiles, righettod, karolpiateknet, mkaraoz, Sjord, bugwrangler, jasondoyle, joscandreu, yog3shsharma, ryantzj, rylyade1, shivsahni, diamonddocumentation, 51j0, AnnaSzk, hlhodges, legik, abjurato, serek8, mhelwig, locpv-ibl and ThunderSon.
Reviewers have consistently provided useful feedback through GitHub issues and pull request comments.
- Jeroen Beckers
- Sjoerd Langkemper
- Anant Shrivastava
- Heaven Hodges
- Caitlin Andrews
- Nick Epson
- Anita Diamond
- Anna Szkudlarek
While both the MASVS and the MSTG are created and maintained by the community on a voluntary basis, sometimes a little bit of outside help is required. We therefore thank our donators for providing the funds to support us on our project activities. The Donation Packages are described on the Donation page.
The OWASP Foundation is very grateful for the support by the individuals and organizations listed. However please note, the OWASP Foundation is strictly vendor neutral and does not endorse any of its supporters. Donations do not influence the content of the MASVS or MSTG in any way.
The Mobile Security Testing Guide was initiated by Milan Singh Thakur in 2015. The original document was hosted on Google Drive. Guide development was moved to GitHub in October 2016.
OWASP MSTG “Beta 2” (Google Doc)
|Milan Singh Thakur, Abhinav Sejpal, Blessen Thomas, Dennis Titze, Davide Cioccia, Pragati Singh, Mohammad Hamed Dadpour, David Fern, Ali Yazdani, Mirza Ali, Rahil Parikh, Anant Shrivastava, Stephen Corbiaux, Ryan Dewhurst, Anto Joseph, Bao Lee, Shiv Patel, Nutan Kumar Panda, Julian Schütte, Stephanie Vanroelen, Bernard Wagner, Gerhard Wagner, Javier Dominguez||Andrew Muller, Jonathan Carter, Stephanie Vanroelen, Milan Singh Thakur||Jim Manico, Paco Hope, Pragati Singh, Yair Amit, Amin Lalji, OWASP Mobile Team|
OWASP MSTG “Beta 1” (Google Doc)
|Milan Singh Thakur, Abhinav Sejpal, Pragati Singh, Mohammad Hamed Dadpour, David Fern, Mirza Ali, Rahil Parikh||Andrew Muller, Jonathan Carter||Jim Manico, Paco Hope, Yair Amit, Amin Lalji, OWASP Mobile Team|