OWASP Mobile Security Testing Guide

This is the official Github Repository of the OWASP Mobile Security Testing Guide (MSTG). The MSTG is a comprehensive manual for testing the security of mobile apps. It describes technical processes for verifying the controls listed in the OWASP Mobile Application Verification Standard (MASVS). The MSTG provides a baseline set of test cases for black-box and white-box security tests, ensuring completeness and consistency of the tests.

Reading the Mobile Security Testing Guide

The MSTG doesn't have an official release. There are, however, several options to convert it into an easily readable format:

1. Read it on Gitbook. The book is auto-synced with the main repo. You can use Gitbook to generate PDF, epub, and other e-book formats.

2. Clone the repository and run the document generator (requires pandoc). This produces docx and html files in the "Generated" subdirectory.

You can also use the document index to navigate the master branch of the MSTG.

Contributions and Feedback

We need more authors! The best way to get started is to browse the existing content. Also, check the Project dashboard for a list of open tasks including authoring, review and technical editing. To sign up for any of those tasks, simply comment on the respective issue and/or contact us on Slack. You can create a Slack account here:

http://owasp.herokuapp.com/

Before you start contributing, please also read our brief style guide which contains a few basic writing rules.

You can also suggest improvements by creating an issue on GitHub or a pull request (actually, pull requests are the preferred choice).

Authoring Credit

Contributors are added to the acknowledgements table based on their contributions logged by GitHub. The list of names is sorted by the number of lines added. Authors are categorized as follows:

• Project Leader / Author: Manage development of the guide continuosly and write a large amount of content.
• Co-Author: Consistently contribute quality content, at least 500 additions logged.
• Top Contributor: Consistently contribute quality content, at least 100 additions logged.
• Contributor: Any form of contribution, at least 1 addition logged.
• Reviewer: People that haven't submitted their own pull requests, but have created issues or given useful feedback in other ways.

Please ping us or create a pull request if you are missing from the table or in the wrong column (note that we update the table frequently, but not in realtime).

If you are willing to write a large portion of the guide and help consistently drive the project forward, you can join as an author. Be aware that you'll be expected to invest lots of time over several months. Contact Bernhard Mueller (Slack: bernhardm) for more information.

High-Level Structure

The following lists contain the individual sections of the MSTG, along with the main contacts responsible for each section. For a detailed lists of all headings see the document index. If all you desire is a checklist, download the magic Excel sheet.

Introductionary

• Header
• Foreword
• Frontispiece

Main Contact: Bernhard Mueller - Slack: bernhardm

Overview

• Introduction to the Mobile Security Testing Guide
• Testing Processes and Techniques

Main Contacts: Bernhard Mueller - Slack: bernhardm

Android Testing Guide

• Platform Overview -- Romuald Szkudlarek - romualds
• Basic Security Testing on Android -- Luander Ribeiro - luander, Sven Schleier - sushi2k
• Tampering and Reverse Engineering on Android -- Bernhard Mueller - bernhardm
• Testing Data Storage -- Francesco Stillavato - litsnarf, Sven Schleier - sushi2k
• Testing Cryptography -- Alexander Antukh - alex
• Testing Authentication and Session Management -- Daniel Ramirez - ramirez
• Testing Network Communication -- Pawel Rzepa - xep624
• Testing Platform Interaction -- Sven Schleier - sushi2k
• Testing Code Quality and Build Settings -- Abdessamad Temmar - temmar
• Testing Resiliency Against Reverse Engineering -- Bernhard Mueller - bernhardm

iOS Testing Guide

• Platform Overview -- Help Wanted
• Basic Security Testing on iOS -- Sven Schleier - sushi2k
• Tampering and Reverse Engineering on iOS -- Bernhard Mueller - bernhardm
• Testing Data Storage -- Gerhard Wagner - bernhardm
• Testing Cryptography -- Alexander Anthuk - alex, Gerhard Wagner - gerhard
• Testing Authentication and Session Management -- Daniel Ramirez - ramirez
• Testing Network Communication -- Pawel Rzepa
• Testing Platform Interaction -- Sven Schleier - sushi2k
• Testing Code Quality and Build Settings -- Abdessamad Temmar - temmar
• Testing Resiliency Against Reverse Engineering -- Bernhard Mueller - bernhardm

Appendix

• Security Testing in the Application Development Lifecycle -- Romuald Szkudlarek - romualds, Stefan Streichsbier- stefan
• Testing Tools -- Prathan Phongthiproek - tan_prathan
• Suggested Reading - N/A