hax0rgb/owasp-mstg

The Mobile Security Testing Guide (MSTG) is a manual for testing the security of mobile apps. It describes technical processes for verifying the controls listed in the OWASP Mobile Application Verification Standard (MASVS). The MSTG is meant to provide a baseline set of test cases for black-box and white-box security tests, and to help ensure completeness and consistency of the tests.

OWASP Mobile Security Testing Guide

This is the official Github Repository of the OWASP Mobile Security Testing Guide (MSTG). The MSTG is a comprehensive manual for testing the security of mobile apps. It describes technical processes for verifying the controls listed in the OWASP Mobile Application Verification Standard (MASVS). The MSTG is meant to provide a baseline set of test cases for black-box and white-box security tests, and to help ensure completeness and consistency of the tests.

Reading the Mobile Security Testing Guide

The MSTG doesn't have an official release yet. There are however several options to convert the it into an easily readable format:

1. Read it on Gitbook. The book is auto-synced with the main repo. You can also use Gitbook to generate PDF, epub, and other e-book formats.

2. Clone the repository and run the document generator (requires pandoc). This produces docx and html files in the "Generated" subdirectory.

You can also use the document index to navigate the master branch of the MSTG.

Contributions and Feedback

We need more authors! The best way of to get started is by browsing the existing content. You'll find a lot of places that still lack content, are incomplete, or need improvements, and you'll most likely start feeling a strong urge to contribute. The high-level chapter list below has contact data for the people responsible for each section. PM them on Slack to coordinate the work (otherwise, you might start working on something that's already in progress). You can sign up for Slack here:

http://owasp.herokuapp.com/

Before you start contribution, please also read our brief style guide which contains a few basic writing rules.

You can also suggest improvements by creating an issue on GitHub or creating a pull request (actually, pull request are the preferred choice).

High-Level Structure

The following lists contains the individual sections of the MSTG, along with the main contacts responsible for each section. Please contact them directly to join as an author or give feedback. Another good place to start browsing is the document index. If all you desire is a checklist, you can also download the magic Excel sheet.

Introductionary

• Header
• Foreword
• Frontispiece

Main Contact: Bernhard Mueller - Slack: bernhardm

Overview

• Introduction to the Mobile Security Testing Guide
• Testing Processes and Techniques

Main Contacts: Pishu Mahtani - Slack: pmahtani, Bernhard Mueller - Slack: bernhardm

Android Testing Guide

• Platform Overview -- Cláudio André - clviper, Romuald Szkudlarek - romualds
• Basic Security Testing on Android -- Luander Ribeiro - luander, Sven Schleier - sushi2k
• Tampering and Reverse Engineering on Android -- Bernhard Mueller - bernhardm
• Testing Data Storage -- Francesco Stillavato - litsnarf, Sven Schleier - sushi2k
• Testing Cryptography -- Alexander Antukh - alex, Gerhard Wagner - gerhard
• Testing Authentication and Session Management -- Daniel Ramirez - ramirez
• Testing Network Communication -- Pawel Rzepa - xep624, Jeroen Willemsen - jeroenwillemsen
• Testing Platform Interaction -- Sven Schleier - sushi2k
• Testing Code Quality and Build Settings -- Abdessamad Temmar - temmar
• Testing Resiliency Against Reverse Engineering -- Bernhard Mueller - bernhardm

iOS Testing Guide

• Platform Overview -- Pishu Mahtani - pmahtani
• Basic Security Testing on iOS -- Sven Schleier - sushi2k
• Tampering and Reverse Engineering on iOS -- Bernhard Mueller - bernhardm
• Testing Data Storage -- Gerhard Wagner - bernhardm
• Testing Cryptography -- Alexander Anthuk - alex, Gerhard Wagner - gerhard
• Testing Authentication and Session Management -- Daniel Ramirez - ramirez
• Testing Network Communication -- Pawel Rzepa, Jeroen Willemsen - jeroenwillemsen
• Testing Platform Interaction -- Sven Schleier - sushi2k
• Testing Code Quality and Build Settings -- Abdessamad Temmar - temmar
• Testing Resiliency Against Reverse Engineering -- Bernhard Mueller - bernhardm

Appendix

• Security Testing in the Application Development Lifecycle -- Stefan Streichsbier- stefan
• Testing Tools -- Prathan Phongthiproek - tan_prathan
• Suggested Reading - N/A

Authoring Credit

Contributors are added to the acknowledgements table based on their contributions logged by GitHub. The list of names sorted by the quantity of contributions, in the order generated by GitHub's algorithm. Commit more than 1,000 total lines of content and you'll move to the "authors" column, otherwise you'll be listed in the "contributors" column.

The "Reviewers" column is for people that haven't submitted their own pull requests, but created issues or given useful feedback in other ways. Please ping us if you are one of those people and haven't already been added.

Style Rules

A few basic rules, such as title capitalization and references, are listed in the style guide. By following these rules, and matching your contribution to the general writing style of the MSTG, you can help us to minimize the effort for re-formatting and rephrasing the content.