AwesomeREA.org

Learning resource

OWASP Mobile Application Security Testing Guide (MASTG)

OWASP’s open manual for Android and iOS app security testing and reverse engineering, published at mas.owasp.org. Chapters on platform internals, test setup and app tampering and reverse engineering sit beside modular, individually referenced tests, techniques, tool pages, knowledge articles, best practices and runnable demos, all mapped to MASVS controls and MASWE weaknesses. OWASP’s UnCrackable crackme apps serve as practice targets and examples.

Requirements and limitations

  • Reviewed at the 2026-09-30 master commit. The latest release, v2.0.0 of 2026-06-30, is described as completing the refactor into modular, machine-readable components and as the first stable release of that framework, while CITATION.cff still names version 1.5.0 of 2022. The pin holds 92 v1 tests and 200 atomic tests, 167 techniques, 135 tool pages, 157 demos, 141 knowledge articles and 74 best practices.
  • Reading needs only a browser; OWASP’s separate mas-website workflow builds the site. Following the techniques needs a Windows, Linux or macOS host with the tools each page names, such as the Android SDK platform tools, plus test devices or emulators. The guide recommends a rooted Android test device or jailbroken iOS device for dynamic analysis, warns against using a personal device, and describes fallbacks for testers without one.
  • The UnCrackable apps for Android and iOS are OWASP’s own reverse-engineering challenges, used as examples throughout the guide. Sample-app pages describe third-party apps, and tool pages describe external software; both keep their own terms. Demo results are written up from the guide’s sample code, not from tests of production apps.
  • The repository is licensed CC BY-SA 4.0, so adapted text needs attribution and the same license. The guide establishes no REA connection; this entry records it as a testing and reverse-engineering reference, and this review ran none of its demos.

About this entry

Type
Learning resource
Category
Learning resources
Relationship
Learning resource
Targets
App

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · OWASP/mastg · Revision 02ffd85
  2. Document/0x04c-Tampering-and-Reverse-Engineering.md GitHub · OWASP/mastg · Revision 02ffd85
  3. Document/0x05b-Android-Security-Testing.md GitHub · OWASP/mastg · Revision 02ffd85
  4. Document/0x06b-iOS-Security-Testing.md GitHub · OWASP/mastg · Revision 02ffd85
  5. tests-beta/index.md GitHub · OWASP/mastg · Revision 02ffd85
  6. demos/index.md GitHub · OWASP/mastg · Revision 02ffd85
  7. Crackmes/README.md GitHub · OWASP/mastg · Revision 02ffd85
  8. CITATION.cff GitHub · OWASP/mastg · Revision 02ffd85
  9. License.md GitHub · OWASP/mastg · Revision 02ffd85
  10. https://github.com/OWASP/mastg/releases/tag/v2.0.0