Skip to content

Releases: OWASP/mastg

Release list

v2.0.0

v2.0.0 Latest
Latest

Choose a tag to compare

View all tags
@cpholguera cpholguera released this 30 Jun 07:08
v2.0.0
990472d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v2.0.0 Release Notes

This release spans January – June 2026 and marks the official completion of the MASTG v2 refactor — a multi-year effort to modularize the guide into individually referenceable, machine-readable components with structured metadata, automated demos, and full cross-linking across MASVS, MASWE, tests, techniques, tools, and best practices. v2.0.0 is the first stable, non-beta release of the new framework.

MASTG v2 couldn't have been completed without the tireless contributions of the MAS Task Force and our MAS Advocates. We'd like to thank them for their dedication, technical expertise, and commitment to improving mobile app security for the entire community. Their contributions have been invaluable in shaping the MASTG into a comprehensive and practical resource for mobile app security testing.

image

Special thanks to:

  • NowSecure (via @cpholguera), who celebrates 4 years of MAS Advocate contributions.
  • Guardsquare (via @serek8), who celebrates 2 years of MAS Advocate contributions.
  • Vulnit, who earned the OWASP MAS Advocate status with their first major contribution wave in the first half of 2026.
    • In over 6 months, @jacobocasado and @sgIOlas ported several v1 tests — focused on the technically demanding MASVS-RESILIENCE category (anti-debugging, obfuscation, emulator/simulator detection, RE tool detection, IPC) — producing 17 new atomic v2 tests and 16 runnable demos.
    • Beyond porting, they consistently performed in-depth technical reviews: restructuring test pairs, converting tests from static to dynamic, adding Frida demos with verified device output.
    • Their participation in the MAS Task Force working group has been invaluable, and their contributions are now fully integrated into the MASTG v2 release.

Would you like to become an OWASP MAS Advocate? Learn more about the program and how to get involved at mas.owasp.org.

The first OWASP MAScon: a dedicated mobile app security conference co-located with OWASP Global AppSec EU 2026 in Vienna on June 25, organized by Carlos Holguera (@cpholguera) and Sven Schleier (@sushi2k), with speakers including Jan Seredynski (Guardsquare; @serek8), Jeroen Beckers (NVISO; @TheDauntless), Sergi Alvarez (pancake / radare2, NowSecure; @trufae), and Ole André Vadla Ravnås (Frida, NowSecure; @oleavr), and Stefan Bernhardsgrütter (redguard; @bernhste).

image

Given the success of this first conference, the MAS project is now planning a second MAScon in October 2026 in Berlin, co-located with droidCon.

MASTG v2

We began the refactoring process in 2021, focusing first on the MASVS and then on the MASTG. Our primary goal was to break the MASTG v1 into modular components, including tests, techniques, tools, and applications.

image

This modular approach allows us to maintain and update each component independently, ensuring that the MASTG remains current and relevant. For example, in our previous structure, the MASTG consisted of large test cases within a single markdown file. This was not only difficult to maintain but also made it challenging to reference specific tests, and it was impossible to have metadata for each test.

image

The new structure divides tests into individual pages (Markdown files with metadata), each with its own ID (MASTG-TEST-****) and links to relevant techniques (MASTG-TECH-****) and tools (MASTG-TOOL-****). This encapsulation ensures that each test is easily referenced and promotes reusability across all MAS components. For example, you can open a test and see what tools and techniques are being used, and soon you'll be able to do the same in reverse: open a tool or technique and see all the tests that use it. This deep cross-referencing can be extremely powerful when exploring the MASTG.

Now MASVS, MASWE, and MASTG are all seamlessly connected. We start with the high-level requirements, zoom in on the specific weaknesses, and then go low-level to the tests and hands-on with the demos. Here's how it works:

  1. MASVS Controls: High-level platform-agnostic requirements.

    For example, "The app employs current cryptography and uses it according to best practices." (MASVS-CRYPTO-1).

  2. MASWE Weaknesses: Specific weaknesses, typically also platform-agnostic, related to the controls.

    For example, "use of predictable pseudo-random number generation" (MASWE-0027).

  3. MASTG Tests: Each weakness is evaluated by executing tests that guide the tester in identifying and mitigating the issues using various tools and techniques on each mobile platform.

    For example, testing for "insecure random API usage on Android" (MASTG-TEST-0204).
    Tests are backed by knowledge articles (MASTG-KNOW-****) and best practices (MASTG-BEST-****) that provide additional context and guidance for testers.
    They use techniques (MASTG-TECH-****) to perform the test steps.

  4. MASTG Demos: Practical demonstrations that include working code samples and test scripts to ensure reproducibility and reliability.

    For example, a sample using Java's Random() instead of SecureRandom() (MASTG-DEMO-0007).
    Demos use specific tools (MASTG-TOOL-****) to perform the test steps.

📊 By the Numbers

Component New in v2.0.0 Total
Tests +77 193
Demos +72 152
Techniques +34 167
Knowledge Articles +34 140
Best Practices +45 72
Tools +9 135
Total +271 ~860

Note: Each port of a v1 test typically creates multiple v2 atomic tests and multiple runnable demos. For example, the port of MASTG-TEST-0018 (Biometric Authentication) produced 5 atomic tests and 5 demos; the port of MASTG-TEST-0026 (Implicit Intents) produced 4 tests and 6 demos. The 40+ v1 test ports in this release alone account for most of the +271 new components.

📢 News

  • First OWASP MAScon announced — dedicated mobile app security conference at OWASP Global AppSec EU 2026, Vienna, June 25–26 — mas.owasp.org/news

🧪 MASTG Tests

This release completes the largest single wave of v1→v2 test ports. Each v1 test produced one or more atomic v2 tests and demos, shown below. Ports are grouped by contributing organization.

All v1 tests are still available for a limited time on our website (click on "Show Deprecated"), but are no longer maintained. The v2 tests are now the canonical reference for OWASP MAS testing. When opening a deprecated v1 test, a banner will link to the corresponding v2 tests.

v1 → v2 Ports (by @nowsecure)

Port MASTG-TEST-0018 — Testing Biometric Authentication by @cpholguera with @Copilot — #3560

→ MASTG-TEST-0326 · MASTG-TEST-0327 · MASTG-TEST-0328 · MASTG-TEST-0329 · MASTG-TEST-0330
→ MASTG-DEMO-0089 · MASTG-DEMO-0090 · MASTG-DEMO-0091 · MASTG-DEMO-0092 · MASTG-DEMO-0093

Port MASTG-TEST-0065 — Testing Data Encryption on the Network (ios) by @cpholguera with @Copilot — #3564

→ MASTG-TEST-0321 · MASTG-TEST-0322 · MASTG-TEST-0323
→ MASTG-DEMO-0083 · MASTG-DEMO-0084 · MASTG-DEMO-0085 · MASTG-DEMO-0086

Port MASTG-TEST-0066 — Testing TLS Settings (ios) by @cpholguera with @Copilot — #3792

→ MASTG-TEST-0342 · MASTG-TEST-0343 · MASTG-TEST-0344 · MASTG-TEST-0345
→ MASTG-DEMO-0109 · MASTG-DEMO-0110 · MASTG-DEMO-0111
→ MASTG-BEST-0042 · MASTG-BEST-0043 · MASTG-TECH-0149

Port MASTG-TEST-0067 — Testing Endpoint Identity Verification (ios) by @cpholguera with @Copilot — #3522; updated (pending merge) by @cpholguera — #3880

→ MASTG-TEST-0322 · MASTG-TEST-0342 (shared with 0065/0066 ports)

Port MASTG-TEST-0068 — Testing Certificate Pinning (ios) by @cpholguera with @Copilot — #3732

→ MASTG-TEST-0385
→ MASTG-DEMO-0148

Port MASTG-TEST-0070 — Testing Universal Links (ios) by @cpholguera — #3904

→ MASTG-TEST-0395
→ MASTG-DEMO-0153

Port MASTG-TEST-0071 — Testing UIActivity Sharing (ios) by @cpholguera with @Copilot — #3780

→ MASTG-TECH-0167 · MASTG-TECH-0168 (new iOS techniques)

Port MASTG-TEST-0072 — Testing App Extensions (ios) by @cpholguera with @Copilot — #3523

→ MASTG-TEST-0388 · MASTG-TEST-0389 · MASTG-TEST-0390

Port MASTG-TEST-0077 — Testing WebView Protocol Handlers (ios) ...

Read more

Contributors

oleavr, TheDauntless, and 18 other contributors
Assets 2
Loading

v1.9.0

v1.9.0

Choose a tag to compare

View all tags
@cpholguera cpholguera released this 24 Jun 08:58
v1.9.0
a1e000c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.9.0 Release Notes

This release spans January – December 2025 and is the largest in the project's history by volume: over 2,000 commits, dozens of v1→v2 test ports, a complete CWE mapping across all MASVS categories, new knowledge and best practice content, and several major structural milestones — including MASTG v2 graduating from beta, the MAS website moving to its own repository, and Guardsquare joining NowSecure as an OWASP MAS Advocate.

The year opened with the three-year anniversary of NowSecure as an OWASP MAS Advocate, reflecting on more than 320 pull requests, 230 reviews, and 42,000+ additions to the MASTG — a partnership that has been instrumental in driving the v2 refactor forward. Alongside this, the MAS Task Force (launched in February 2024) continued to meet monthly, coordinating the porting effort and shaping the project roadmap.

In May 2025, Guardsquare officially achieved MAS Advocate status — the highest recognition in the project. Their sustained contributions, including the bulk of the v1→v2 test ports in this release, and their key role in the OWASP Project Summit 2024, made them a natural fit. This release contains the most visible result of that commitment: a major wave of tests fully ported to the v2 format by Dennis Titze, Jan Seredynski, Nuno Antunes, and Pascal Jungblut.

The defining technical milestone of the year was the removal of the beta label from MASTG v2 and the deprecation of the legacy PDF format — a signal that the new modular structure is now the primary and stable reference. Alongside this, two major extractions reshaped the project structure: MASWE was temporarily moved to its own OWASP/maswe repository (and later re-integrated), and the MAS website was extracted to OWASP/mas-website, allowing each to evolve independently.

📢 News

🏛️ Major Structural Milestones

🐛 MASWE — MAS Weaknesses

New Weaknesses

CWE Mapping

Complete CWE mapping added across all MASVS categories by @truerick and @poffo-mobisec:

🧪 MASTG Tests

v1 → v2 Ports (by @Guardsquare)

v1 → v2 Ports (by @appknox)

v1 → v2 Ports (community)

New v2 Tests

  • MASTG-TEST-0262, MASTG-TEST-0263: Android backup testing by @cpholguera — #3217
  • MASTG-TEST-0264, MASTG-TEST-0265: StrictMode detection by @cpholguera — #3246
  • MASTG-TEST-0278, MASTG-TEST-0279, MASTG-TEST-0280: iOS UIPasteboard by @cpholguera — #3289
  • iOS ECB insecure encryption modes test and demo by @Diolor — #3547
  • New Android privacy test case drafts by @cpholguera — #3228

Updates & Fixes

Deprecations

  • MASTG-TEST-0031: Testing JavaScript Execution in WebViews — deprecated by @cpholguera — #3419
  • Memory corruption and sensitive data tests deprecated for Android and iOS by @cpholguera — #3506
  • EncryptedFile / EncryptedSharedPreferences deprecation warnings added by @AndrewScull — #3158

🎬 MASTG Demos

  • MASTG-DEMO-0034, MASTG-DEMO-0035:...
Read more

Contributors

nmsa, pascalj, and 35 other contributors
Loading

v1.8.0

v1.8.0

Choose a tag to compare

View all tags
@cpholguera cpholguera released this 24 Jun 08:34
v1.8.0
dee0701
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.8.0 Release Notes

This release spans October 2023 – December 2024 and lays the groundwork for MASTG v2: new component types (MASWE Weaknesses, MASTG Demos, MASTG Best Practices), a cross-reference system linking all MAS components, the first wave of v1→v2 test ports (by Guardsquare), and MASVS v2.1.0 with the new MASVS-PRIVACY category.

The period opened with a major standards milestone: the MASVS-PRIVACY proposal in October 2023, introducing four new privacy controls (MASVS-PRIVACY-1 through -4) and the MAS-P profile for holistic privacy assessment alongside security. After community review, MASVS v2.1.0 shipped in January 2024 with MASVS-PRIVACY formally included and CycloneDX/SBOM support added, enabling easier integration into DevSecOps pipelines.

External adoption continued to grow: in February 2024, the Cyber Security Agency of Singapore (CSA) published its "Safe App Standard", a national guideline for mobile app security based directly on the OWASP MASVS, covering MASVS-AUTH, MASVS-STORAGE, and MASVS-RESILIENCE.

The architectural highlight of the release came in July 2024 with the public introduction of MASWE — the Mobile App Security Weakness Enumeration. MASWE fills the gap between the high-level MASVS controls and the low-level MASTG tests, completing the full chain: MASVS control → MASWE weakness → MASTG test → MASTG demo. This release also introduced the MAS Test Apps (Android and iOS), purpose-built skeleton apps that embed code samples directly to make every demo reproducible and verifiable on a real device.

🏔️ OWASP Project Summit 2024

In November 2024, we hosted the OWASP Project Summit, where NowSecure led the mobile app security track. This five-day event brought together experts from various companies to discuss the future of mobile security, share insights, and collaborate on innovative solutions. During the summit, approximately 40 pull requests were created, and countless discussions were held. Special thanks to Jeroen Beckers (@TheDauntless) and especially to Guardsquare, who contributed the majority of PRs: Dennis Titze (@titze), Jan Seredynski (@serek8), Nuno Antunes (@nmsa), and Pascal Jungblut (@pascalj), with reviews by @cpholguera and @TheDauntless. This was a key moment for the MASTG v2 porting effort.

📢 News

🆕 New MASTG v2 Components

🐛 MASWE — MAS Weaknesses

Note: MASWE started in this repo but was later moved to OWASP/maswe as a separate project (see v1.9.0 release notes).

A new component type linking MASVS controls to testable weaknesses. First entries added this release:

🎬 MASTG Demos

A new component type providing concrete, reproducible test demonstrations with real app binaries:

🛡️ MASTG Best Practices

A new component type providing actionable remediation guidance (previously called "Mitigations"):

🧪 MASTG Tests

v1 → v2 Ports (by @Guardsquare)

First wave of tests ported to the new v2 format with structured metadata, demos and evaluation criteria:

New v2 Tests

Updates & Fixes

Deprecations

  • Add deprecation notes and status for MASTG v1 tests by @cpholguera — #3089
  • Remove MASTG-TEST-0074 (coverage duplicated by other tests) by @cpholguera — #2556

✨ MASTG Techniques

🪄 MASTG Tools

New tools:

Read more

Contributors

nmsa, pascalj, and 37 other contributors
Loading

v1.7.0

v1.7.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 31 Oct 08:36
v1.7.0
7172dfa
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

MASTG Refactor Part 2: Techniques, Tools & Reference Apps: This release introduces the second phase of the MASTG (Mobile Application Security Testing Guide) refactor. These changes aim to enhance the usability and accessibility of the MASTG.

The primary focus of this new refactor is the reorganization of the MASTG content into different components, each housed in its dedicated section/folder and existing now as individual pages in our website (markdown files with metadata/frontmatter in GitHub):

image

image

NOTE: You may find broken links on the website and in the PDF/eBook. This is a consequence of these massive changes and we expect to be able to fix them soon.

  • Tests:

    • Website: Tests section.
    • GitHub: tests/ folder.
    • Identified by IDs in the format MASTG-TEST-XXXX.
    • Includes all tests originally in:
      • 0x05d/0x06d-Testing-Data-Storage.md
      • 0x05e/0x06e-Testing-Cryptography.md
      • 0x05f/0x06f-Testing-Local-Authentication.md
      • 0x05g/0x06g-Testing-Network-Communication.md
      • 0x05h/0x06h-Testing-Platform-Interaction.md
      • 0x05i/0x06i-Testing-Code-Quality-and-Build-Settings.md
      • 0x05j/0x06j-Testing-Resiliency-Against-Reverse-Engineering.md
    • ⚠️ IMPORTANT (TODO): These tests are still the original MASTG v1.6.0 tests. We will progressively split them into smaller tests, the so-called "atomic tests" in MASTG v2 and assign the new MAS profiles accordingly.

  • Techniques:

    • Website: Techniques section.
    • GitHub: techniques/ folder.
    • Identified by IDs in the format MASTG-TECH-XXXX.
    • Includes all techniques originally in:
      • 0x05b/0x06b-Basic-Security_Testing.md
      • 0x05c/0x06c-Reverse-Engineering-and-Tampering.md

  • Tools:

    • Website: Tools section.
    • GitHub: tools/ folder.
    • Identified by IDs in the format MASTG-TOOL-XXXX.
    • Includes all tools from:
      • 0x08a-Testing-Tools.md

  • Apps:

    • Website: Apps section.
    • GitHub: apps/ folder.
    • Identified by IDs in the format MASTG-APP-XXXX.
    • Includes all apps from:
      • 0x08b-Reference-Apps.md

We hope that the revamped structure enables you to navigate the MASTG more efficiently and access the information you need with ease. See below for a detailed list of changes.

We'd like to thank all of our loyal contributors and welcome our new contributors.

Special thanks to NowSecure for their consistent high-impact contributions to the project, especially for this new OWASP MASTG refactoring phase and for continuing spreading the word about the OWASP MAS project.

We'd also like to thank our new MAS Advocate applicants for waiting patiently while we get everything ready behind the scenes for them to help us efficiently.

💙 Thanks to Zimperium for their generous donation!


Carlos Holguera, Sven Schleier and Jeroen Beckers - OWASP MAS project


NOTE: the OWASP MASTG v1.7.0 relies on the latest MASVS v2.0.0

Help us improve! questions | ideas | contact


What's Changed

📢 News

🧪 MASTG Test Cases

📖 MASTG Testing Fundamentals

✨ MASTG Testing Techniques

🪄 MASTG Testing Tools

  • Replace Passionfruit with Grapefruit by @lihter in #2451
  • Update r2frida guide examples to use : instead of \ for command start by @Shiva953 in #2450

📜 Mobile Security Checklists

🎉 New Donators

Other Changes

New Contributors

Full Changelog: v1.6.0...v1.7.0

Contributors

Laancelot, sushi2k, and 9 other contributors
Loading

v1.6.0

v1.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 May 10:20
v1.6.0
1271f4b
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

Following up on the OWASP MASVS v2.0.0 Release we're excited to announce the release of the new OWASP MASTG version v1.6.0. This update includes a range of new features, including the first phase of the MASTG refactoring, MASVS color-coding, upgraded MAS Checklists (for OWASP MASVS v2.0.0 + MASTG v1.6.0), and much more. See below for a detailed list of changes.

We'd like to thank all of our loyal contributors and welcome our new contributors.

Special thanks to NowSecure for their consistent high-impact contributions to the project, especially for the MASVS refactoring, the OWASP MASTG refactoring, the OWASP MAS website and this MASTG v1.6.0 release and for continuing spreading the word about the OWASP MAS project.

💙 Thanks to dvuln, eShard, OHRUS and devoteam Cyber Trust for their generous donations!


Carlos Holguera, Sven Schleier and Jeroen Beckers - OWASP MAS project


NOTE: the OWASP MASTG v1.6.0 relies on the latest MASVS v2.0.0

Help us improve! questions | ideas | contact


What's Changed

📢 News

Introducing the MASVS v2 Colors

We're bringing official colors to the MASVS! The new colors will be used across the MASVS v2.0.0 and MASTG v2.0.0 to help users quickly identify the different control groups. We've also revamped certain areas of our website to make them more readable and easier to navigate as well as to prepare for what's coming with the MASTSG v2.0.0 (keyword: "atomic tests").

masvs_colors

MASVS

In the MASVS home page, the new colors will be used to highlight the different control groups.

masvs_home

The individual controls will also be color-coded to help users quickly identify the different control groups. We've also redesigned the control pages to make them more readable and easier to navigate.

masvs_control

MASTG

Now, when you navigate to the MASTG tests, you'll see that they are categorized by platform (Android/iOS) as well as by MASVS category, also using our new colors in the sidebar. The colors will also be used to highlight the different control groups in the test description.

Each test now contains a header section indicating the platform, the MASVS v1.5.0 controls, and the MASVS v2.0.0 controls.

mastg_test

We've also introduced a new section called "Resources" which is automatically generated using the inline links within the MASTG pages and serve as a quick reference to the most important resources for each test.

NOTE: The MASTG tests themselves haven't changed yet, we're still working on the refactoring. For now we've simply split the tests into individual pages to make them easier to navigate and reference. This will facilitate the work on the refactoring and the introduction of the new atomic tests.

MAS Checklist

The MAS Checklist pages and the MAS checklist itself have also been updated to use the new colors to highlight the different control groups and to make them easier to navigate.

checklist_home

When you click on a MASVS group you'll see a table listing the new MASVS v2.0.0 controls as well as the corresponding MASTG tests (v1.5.0) for both the Android and the iOS platforms.

checklist_detail

NOTE: The checklist contains the old MASVS v1 verification levels (L1, L2 and R) which we are currently reworking into "security testing profiles". The levels were assigned according to the MASVS v1 ID that the test was previously covering and might differ in the upcoming version of the MASTG and MAS Checklist.

For the upcoming of the MASTG version we will progressively split the MASTG tests into smaller tests, the so-called "atomic tests" and assign the new MAS profiles accordingly.


We hope you like the new colors and the changes we've made to the website. We're looking forward to your feedback! Please use our GitHub Discussions to post any questions or ideas you might have. If you see something wrong please let us know by opening a bug issue.

More News

🧪 MASTG Test Cases

  • Add static analysis details for Android keyboard cache by @DIvanov503 in #2254
  • Recommend Using conscrypt for Old Android API Levels by @rlatapy-luna in #2340
  • Deprecate Fragment Injection Test for MSTG-PLATFORM-2 by @cpholguera in #2328
  • Proofreading fixes 0x05d part 1 by @Laancelot in #2351
  • Proofreading fixes 0x05d part 2 by @Laancelot in #2358
  • Add Test for Android Pending Intents to 0x05h by @su-vikas in #2300
  • Add Test for Implicit Intent Injection (MSTG-PLATFORM-2) by @LukasMarckmiller in #2056
  • Add codesign/ldid to the test Determining Whether the App is Debuggable (MSTG-CODE-2) by @sohsatoh in #2296
  • Add otool command to 0x06i-Testing-Code-Quality-and-Build-Settings.md by @rsenet in #2362
  • [Phase 1] Refactor 0x05h-Testing-Platform-Interaction.md (@nowsecure) by @angrymuffinx in #2286
  • [Phase 1] Refactor 0x06j-Testing-Resiliency-Against-Reverse-Engineering.md by @iotaaxel in #2321
  • [Phase 1] Refactor 0x0**-Testing-Code-Quality.md by @cpholguera in #2381
  • [Phase 1] Refactor 0x06h-Testing-Platform-Interaction.md by @TheDauntless in #2380
  • [Phase 1] Refactor 0x0**-Testing-Resiliency-Against-Reverse-Engineering.md by @sushi2k in #2382
  • [Phase 1] Refactor 0x0**-Local-authentication.md by @TheDauntless in #2377
  • [Phase 1] Refactor 0x0**-Testing-Network-Communication.md by @sushi2k in #2378
  • [Phase 1] Refactor 0x0**-Testing-Cryptography.md by @sushi2k in #2372
  • [Phase 1] Refactor 0x0**-Testing-Data-Storage.md by @cpholguera in #2379

📖 MASTG Testing Fundamentals

✨ MASTG Testing Techniques

  • Proofreading fixes part ...
Read more

Contributors

cgarst, vtourraine, and 18 other contributors
Loading
3 Join discussion

v1.5.0

v1.5.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Sep 14:56
v1.5.0
3b9278f
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

We've been very busy with the OWASP MASVS refactoring but we're very excited to be able to bring you the new OWASP MASTG in its version v1.5.0 including loads of news including new Test Cases, Testing Fundamentals, upgraded MAS Checklists and many more, see below.

We'd like to thank all of our loyal contributors and welcome our new contributors.

Special thanks to NowSecure for their consistent high-impact contributions to the project, especially for the MASVS refactoring, the OWASP MAS rebranding, the brand new OWASP MAS website and this MASTG v1.5.0 release and for continuing spreading the word about the OWASP MAS project.


Carlos Holguera & Sven Schleier - OWASP MAS project


NOTE: the OWASP MASTG v1.5.0 relies on the latest MASVS v1.4.2


What's Changed

📢 News

New "Trusted By" Section & CREST OVS

trusted-by-logos

Introducing the "MAS Advocate" Status

image

Add Google's ADA MASA

Screenshot 2022-09-06 at 10 20 22

Project Rebranding to OWASP MAS

mas-rebranding

twitter-rename

OWASP MAS New Website

mas_new_website

🧪 MASTG Test Cases

📖 MASTG Testing Fundamentals

✨ MASTG Testing Techniques

🪄 MASTG Testing Tools

⚡ Automation

📜 MAS Checklists

  • Increase Checklist Test Coverage Including Tests from the 0x04* Chapters by @fujiokayu in #2085
  • Add Common Test Case Column to Checklist by @cpholguera in #2208

Checklist test coverage changes: removed (2) added (13) updated (51)

🎉 New Donators

🐞 Errata Corrections

Other Changes

New Contributors

Read more

Contributors

TheDauntless, ichistmeinname, and 17 other contributors
Loading

v1.4.0

v1.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Jan 13:10
v1.4.0
b04750a
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

What's Changed

OWASP Mobile App Security Checklists

The highly anticipated OWASP Mobile App Security Checklists are back including very exciting news.

checklists_update

New Features of the MASVS Checklists

  • Completely automated: generated from scratch using openpyxl.
  • Multi-language: now available in all 13 MASVS languages.
  • Always up-to-date: from now on released with every new MSTG version & always using the latest MASVS.
  • New clean design: consistent with our new identity.
  • Simpler structure: all MASVS categories in one sheet.
  • Traceable: include exact MASVS and MSTG versions and commit IDs.

checklists_features

Using the Checklists

  • Use the "Status" column to:
    • Discard controls by selecting N/A
    • Set the result of a test by selecting Pass or Fail.
  • Add more columns or sheets as you wish or need. For instance:
    • Duplicate & rename sheet to test for different platforms.
    • Simply copy & paste the "Status" column to cover additional platforms (rename title accordingly).

Feedback

Your feedback is essential for the development of the project. If you have any comments or new ideas please post them here:

https://github.com/OWASP/owasp-mstg/discussions/new?category=ideas

Other Changes

New Contributors

Full Changelog: v1.3.0...v1.4.0

Contributors

Brasco, sushi2k, and 2 other contributors
Loading
0 Join discussion

v1.3.0

v1.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Dec 11:03
v1.3.0
c7d61c2
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

What's Changed

Changes in MSTG Content

Errata Corrections (typos & more)

New Donators

Other Changes

New Contributors

Full Changelog: v1.2.1...v1.3.0

Contributors

anantshri, chrihala, and 6 other contributors
Loading
0 Join discussion

v1.2.1

v1.2.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Dec 09:41
v1.2.1
12d9ffd
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

What's Changed

Minor release without relevant content changes.

Full Changelog: v1.2...v1.2.1

Contributors

cpholguera
Loading

v1.2

v1.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Jul 22:47
v1.2
e98392b

Changelog

OWASP MSTG - Release v1.2 - 25th July 2021

167 issues were closed since the last release. A full overview can be seen in Github Issues https://github.com/OWASP/owasp-mstg/issues?q=is%3Aissue+is%3Aclosed+closed%3A2019-08-03..2021-07-25.

326 pull requests were merged since the last release. A full overview can be seen in Github Pull Requests https://github.com/OWASP/owasp-mstg/pulls?q=is%3Apr+is%3Aclosed+closed%3A2019-08-03..2021-07-25

Major changes include:

  • Migrating the new document build pipeline from MASVS to MSTG. This allows us to build consistently the whole OWASP MSTG documents (PDF, docx etc.) in minutes, without any manual work.
  • Besides numerous changes for the test cases we have a new Crackme - Android Level 4 https://github.com/OWASP/owasp-mstg/tree/master/Crackmes/Android/Level_04 and also new write-ups for the Crackmes.
  • We removed all references to Needle and IDB tool, as both tools are outdated.
  • References of OWASP Mobile Top 10 and MSTG-IDs are completely moved to MASVS
  • Reworking of information gathering (static analysis) for Android Apps
  • Update of Biometric Authentication for Android Apps
  • New content and updates in the Android and iOS Reverse Engineering and Tampering chapters
  • 3 new iOS Reverse Engineering test cases
  • Translations of the MSTG are linked to the respective forks but are not part of the MSTG anymore
  • Updated English, Japanese, French, Korean and Spanish checklists to be compatible with MSTG 1.2
  • Updated Acknowledgments, with 1 new co-author and contributor
  • Added JNI Tracing for Android
  • Added dsdump for dumping Objective-C and Swift content
  • Added the procedure to sign the debugserver for iOS 12 and higher
  • Added dependency-check to verify for vulnerabilities in libraries added by iOS package managers
  • Added getppid as debugger detection (iOS)
  • Added Domain/URL Enumeration in APKs
  • Added introduction into Network.framework (iOS)
  • Added UnSAFE Bank iOS Application
  • Added information on SECCOMP (Android)
  • Added native and java method tracing (Android)
  • Added Android library injection
  • Added Android 10 TLS and cryptography updates
  • Updated code obfuscation for Android and iOS
  • Added test case for Reverse Engineering Tools Detection - MSTG-RESILIENCE-4 (iOS)
  • Added test case for Emulator Detection - MSTG-RESILIENCE-5 (iOS)
  • Added an example with truststore to bypass cert pinning (Android)
  • Added content to information gathering using frida (Android)
  • Added Sec Consult, RandoriSec and OWASP Bay area as donators
  • Added basic information gathering for Android and iOS
  • Added Simulating a Man-in-the-Middle Attack with an Access Point
  • Added gender neutrality to the MSTG
  • Extended section about dealing with Xamarin Apps
  • Updated all picture links (img tags) to be in markdown syntax
  • Updated iTunes limitations and usage since macOS Catalina
  • Added Emulation-based Analysis (iOS and Android)
  • Added Debugging iOS release applications using lldb
  • Added Korean translation of the checklist
  • Updated symbolic execution content (Android)
  • Added Ghidra for Android Reverse Engineering
  • Added section on Manual (Reversed) Code Review for iOS
  • Added explanation of more Frida APIs (iOS and Android)
  • Added Apple CryptoKit
  • Updated and simplified Frida detection methods
  • Added introduction to setup and disassembling for iOS Apps
  • Updated section about frida-ios-dump
  • Added gplaycli (Android)
  • Extended section on how to retrieve UDI (iOS)
  • Added new companies in the Users.md list with companies applying the MSTG/MASVS
  • Updated partially code samples to Swift 5
  • Adding Process Exploration (Android and iOS)
  • Updated best practices for passwords, added "Have I Been Pwned"
  • Updated SSL Pinning fallback methods
  • Updated app identifier (Android and iOS)
  • Updated permission changes for Android O, P and Q
  • Updated Broadcast Receiver section (Android)

Several other minor updates include fixing typos and markdown lint errors and updating outdated links.

We thank you all contributors for the hard work and continuously improving the document and the OWASP MSTG project!

Loading