OWASP Mobile Security Testing Guide

This is the official Github Repository of the OWASP Mobile Security Testing Guide (MSTG). The MSTG is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the controls listed in the OWASP Mobile Application Verification Standard (MASVS). The current master branch can also be read on Gitbook.

Join the MSTG Working Session at the OWASP Summit 2017

The OWASP Summit 2017 will have a whole 5-days track dedicated to the the Mobile Testing Guide! This will be a great opportunity to meet other mobile appsec experts and participate in the creation of the industry standard. Our ambitious goal for the summit to complete the MSTG. The summit will take place in Woburn Forest Center Parcs, Bedfordshir, 50 minutes from London, from June 12th to June 16th. Sign up here.

Table-of-Contents

Introduction

• Header
• Foreword
• Frontispiece

Overview

• Introduction to the Mobile Security Testing Guide
• Testing Processes and Techniques

Android Testing Guide

• Platform Overview
• Android Security Testing Basics
• Testing Data Storage
• Testing Cryptography
• Testing Local Authentication
• Testing Network Communication
• Testing Platform Interaction
• Testing Code Quality and Build Settings
• Tampering and Reverse Engineering on Android
• Testing Anti-Reversing Defenses

iOS Testing Guide

• Platform Overview
• iOS Security Testing Basics
• Testing Data Storage
• Testing Cryptography
• Testing Local Authentication
• Testing Network Communication
• Testing Platform Interaction
• Testing Code Quality and Build Settings
• Tampering and Reverse Engineering on iOS
• Testing Anti-Reversing Defenses

Appendix

• Testing Authentication and Session Management on Endpoints
• Testing Network Communication
• Testing Cryptography
• Assessing Software Protection Schemes
• Testing Tools
• Suggested Reading

Reading the Mobile Security Testing Guide

The MSTG hasn't been officially released yet. There are several options for converting it into an easily readable format:

1. Read it on Gitbook. The book is automatically synchronized with the main repo. You can use the gitbook command line tool to generate PDF, epub, and other e-book formats. Please note that we have disabled the ebook export features on gitbook.com for the time being - they will be enabled once the project reaches beta status.

2. Clone the repository and run the document generator (requires pandoc). This produces docx and html files in the "Generated" subdirectory.

$ git clone https://github.com/OWASP/owasp-mstg/
$ cd owasp-mstg/Tools/
$ ./generate_document.sh

You can also use the document index to navigate the master branch of the MSTG.

Contributions, feature requests and feedback

We are searching for additional authors, reviewers and editors. The best way to get started is to browse the existing content. Also, check the project dashboard for a list of open tasks.

Drop a us line on the Slack channel before you start working on a topic. This helps us to keep track of what everyone is doing and prevent conflicts. You can create a Slack account here:

http://owasp.herokuapp.com/

Before you start contributing, please read our brief style guide which contains a few basic writing rules.

If there's something you really want to see in the guide, or you want to suggest an improvement, create an issue issue or ping us on Slack.

Authoring Credit

Contributors are added to the acknowledgements table based on their contributions logged by GitHub. The list of names is sorted by the number of lines added. Authors are categorized as follows:

• Project Leader / Author: Manage development of the guide continuosly and write a large amount of content.
• Co-Author: Consistently contribute quality content, at least 500 additions logged.
• Top Contributor: Consistently contribute quality content, at least 100 additions logged.
• Contributor: Any form of contribution, at least 1 addition logged.
• Reviewer: People that haven't submitted their own pull requests, but have created issues or given useful feedback in other ways.

Please ping us or create a pull request if you are missing from the table or in the wrong column (note that we update the table frequently, but not in realtime).

If you are willing to write a large portion of the guide and help consistently drive the project forward, you can join as an author. Be aware that you'll be expected to invest lots of time over several months. Contact Bernhard Mueller (Slack: bernhardm) for more information.