Skip to content

tamnd/mastg-index

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
src
src
 
 
.gitignore
.gitignore
 
 
LICENSE
LICENSE
 
 
README.md
README.md
 
 
go.mod
go.mod
 
 
go.sum
go.sum
 
 

Repository files navigation

OWASP Mobile Application Security Testing Guide — Index

A comprehensive, human-readable index of all tests, techniques, and tools from the OWASP Mobile Application Security Testing Guide (MASTG), organized by MASVS v2.1.0 control groups.

Generated from OWASP/mastg at commit cfdc384.

8 MASVS groups · 133 tests (81 Android, 49 iOS) · 139 techniques · 131 tools

Contents

Tests by MASVS Group

Reference

MASVS-STORAGE — Storage

  • MASVS-STORAGE-1: The app securely stores sensitive data.
  • MASVS-STORAGE-2: The app prevents leakage of sensitive data.

Android

ID Test Type Weakness Profiles
MASTG-TEST-0200 Files Written to External Storage dynamic MASWE-0007 L1, L2
MASTG-TEST-0201 Runtime Use of APIs to Access External Storage dynamic MASWE-0007 L1, L2
MASTG-TEST-0202 References to APIs and Permissions for Accessing External Storage static MASWE-0007 L1, L2
MASTG-TEST-0203 Runtime Use of Logging APIs dynamic MASWE-0001 L1, L2, P
MASTG-TEST-0207 Runtime Storage of Unencrypted Data in the App Sandbox dynamic, filesystem MASWE-0006 L2
MASTG-TEST-0216 Sensitive Data Not Excluded From Backup dynamic, filesystem MASWE-0004 L1, L2, P
MASTG-TEST-0231 References to Logging APIs static MASWE-0001 L1, L2, P
MASTG-TEST-0262 References to Backup Configurations Not Excluding Sensitive Data static MASWE-0004 L1, L2, P
MASTG-TEST-0287 Sensitive Data Stored Unencrypted via the SharedPreferences API to the App Sandbox static, dynamic MASWE-0006 L1, L2
MASTG-TEST-0304 Sensitive Data Stored Unencrypted via SQLite static, dynamic MASWE-0006 L1, L2
MASTG-TEST-0305 Sensitive Data Stored Unencrypted via DataStore static, dynamic MASWE-0006 L1, L2
MASTG-TEST-0306 Sensitive Data Stored Unencrypted via Android Room DB static, dynamic MASWE-0006 L1, L2

iOS

ID Test Type Weakness Profiles
MASTG-TEST-0215 Sensitive Data Not Marked For Backup Exclusion static MASWE-0004 L1, L2, P
MASTG-TEST-0296 Sensitive Data Exposure Through Insecure Logging dynamic MASWE-0001 L1, L2
MASTG-TEST-0297 Insertion of Sensitive Data into Logs static MASWE-0001 L1, L2
MASTG-TEST-0298 Runtime Monitoring of Files Eligible for Backup dynamic MASWE-0004 L1, L2, P
MASTG-TEST-0299 Data Protection Classes for Files in Private Storage dynamic, filesystem MASWE-0006 L1
MASTG-TEST-0300 References to APIs for Storing Unencrypted Data in Private Storage static MASWE-0006 L2
MASTG-TEST-0301 Runtime Use of APIs for Storing Unencrypted Data in Private Storage dynamic MASWE-0006 L2
MASTG-TEST-0302 Sensitive Data Unencrypted in Private Storage Files dynamic, filesystem MASWE-0006 L2
MASTG-TEST-0303 References to APIs for Storing Unencrypted Data in Shared Storage static MASWE-0007 L1, L2
MASTG-TEST-0313 References to APIs for Preventing Keyboard Caching of Text Fields static MASWE-0053 L2
MASTG-TEST-0314 Runtime Monitoring of Text Fields Eligible for Keyboard Caching dynamic MASWE-0053 L2

MASVS-CRYPTO — Cryptography

  • MASVS-CRYPTO-1: The app employs current strong cryptography and uses it according to industry best practices.
  • MASVS-CRYPTO-2: The app performs key management according to industry best practices.

Android

ID Test Type Weakness Profiles
MASTG-TEST-0204 Insecure Random API Usage static MASWE-0027 L1, L2
MASTG-TEST-0205 Non-random Sources Usage static MASWE-0027 L1, L2
MASTG-TEST-0208 Insufficient Key Sizes static MASWE-0009 L1, L2
MASTG-TEST-0212 Use of Hardcoded Cryptographic Keys in Code static MASWE-0014 L1, L2
MASTG-TEST-0221 Broken Symmetric Encryption Algorithms static, dynamic MASWE-0020 L1, L2
MASTG-TEST-0232 Broken Symmetric Encryption Modes static, dynamic MASWE-0020 L1, L2
MASTG-TEST-0307 References to Asymmetric Key Pairs Used For Multiple Purposes static MASWE-0012 L2
MASTG-TEST-0308 Runtime Use of Asymmetric Key Pairs Used For Multiple Purposes dynamic MASWE-0012 L2
MASTG-TEST-0309 References to Reused Initialization Vectors in Symmetric Encryption static MASWE-0022 L2
MASTG-TEST-0310 Runtime Use of Reused Initialization Vectors in Symmetric Encryption dynamic MASWE-0022 L2
MASTG-TEST-0312 References to Explicit Security Provider in Cryptographic APIs static MASWE-0020 L1, L2

iOS

ID Test Type Weakness Profiles
MASTG-TEST-0209 Insufficient Key Sizes static, dynamic MASWE-0009 L1, L2
MASTG-TEST-0210 Broken Symmetric Encryption Algorithms static, dynamic MASWE-0020 L1, L2
MASTG-TEST-0211 Broken Hashing Algorithms static, dynamic MASWE-0021 L1, L2
MASTG-TEST-0213 Use of Hardcoded Cryptographic Keys in Code static MASWE-0014 L1, L2
MASTG-TEST-0214 Hardcoded Cryptographic Keys in Files static MASWE-0014 L1, L2
MASTG-TEST-0311 Insecure Random API Usage static, dynamic MASWE-0027 L1, L2
MASTG-TEST-0317 Broken Symmetric Encryption Modes static, dynamic MASWE-0020 L1, L2

MASVS-AUTH — Authentication and Authorization

  • MASVS-AUTH-1: The app uses secure authentication and authorization protocols and follows the relevant best practices.
  • MASVS-AUTH-2: The app performs local authentication securely according to the platform best practices.
  • MASVS-AUTH-3: The app secures sensitive operations with additional authentication.

Android

ID Test Type Weakness Profiles
MASTG-TEST-0326 References to APIs Allowing Fallback to Non-Biometric Authentication static MASWE-0045 L2
MASTG-TEST-0327 References to APIs for Event-Bound Biometric Authentication static MASWE-0044 L2
MASTG-TEST-0328 References to APIs Detecting Biometric Enrollment Changes static MASWE-0046 L2
MASTG-TEST-0329 References to APIs Enforcing Authentication without Explicit User Action static MASWE-0044 L2
MASTG-TEST-0330 References to APIs for Keys used in Biometric Authentication with Extended Validity Duration static MASWE-0044 L2

iOS

ID Test Type Weakness Profiles
MASTG-TEST-0266 References to APIs for Event-Bound Biometric Authentication static MASWE-0044 L2
MASTG-TEST-0267 Runtime Use Of Event-Bound Biometric Authentication dynamic MASWE-0044 L2
MASTG-TEST-0268 References to APIs Allowing Fallback to Non-Biometric Authentication static MASWE-0045 L2
MASTG-TEST-0269 Runtime Use Of APIs Allowing Fallback to Non-Biometric Authentication dynamic MASWE-0045 L2
MASTG-TEST-0270 References to APIs Detecting Biometric Enrollment Changes static MASWE-0046 L2
MASTG-TEST-0271 Runtime Use Of APIs Detecting Biometric Enrollment Changes static MASWE-0046 L2

MASVS-NETWORK — Network Communication

  • MASVS-NETWORK-1: The app secures all network traffic according to the current best practices.
  • MASVS-NETWORK-2: The app performs identity pinning for all remote endpoints under the developer's control.

Android

ID Test Type Weakness Profiles
MASTG-TEST-0217 Insecure TLS Protocols Explicitly Allowed in Code static MASWE-0050 L1, L2
MASTG-TEST-0233 Hardcoded HTTP URLs static MASWE-0050 L1, L2
MASTG-TEST-0234 Missing Implementation of Server Hostname Verification with SSLSockets static MASWE-0052 L1, L2
MASTG-TEST-0235 Android App Configurations Allowing Cleartext Traffic static MASWE-0050 L1, L2
MASTG-TEST-0237 Cross-Platform Framework Configurations Allowing Cleartext Traffic static MASWE-0050 L1, L2
MASTG-TEST-0238 Runtime Use of Network APIs Transmitting Cleartext Traffic dynamic MASWE-0050 L1, L2
MASTG-TEST-0239 Using low-level APIs (e.g. Socket) to set up a custom HTTP connection static MASWE-0050 L1, L2
MASTG-TEST-0242 Missing Certificate Pinning in Network Security Configuration static MASWE-0047 L2
MASTG-TEST-0243 Expired Certificate Pins in the Network Security Configuration static MASWE-0047 L2
MASTG-TEST-0282 Unsafe Custom Trust Evaluation static MASWE-0052 L1, L2
MASTG-TEST-0283 Incorrect Implementation of Server Hostname Verification static MASWE-0052 L1, L2
MASTG-TEST-0284 Incorrect SSL Error Handling in WebViews static MASWE-0052 L1, L2
MASTG-TEST-0285 Outdated Android Version Allowing Trust in User-Provided CAs static MASWE-0052 L1, L2
MASTG-TEST-0286 Network Security Configuration Allowing Trust in User-Provided CAs static MASWE-0052 L1, L2
MASTG-TEST-0295 GMS Security Provider Not Updated static MASWE-0052 L2

iOS

ID Test Type Weakness Profiles
MASTG-TEST-0321 Hardcoded HTTP URLs static MASWE-0050 L1, L2
MASTG-TEST-0322 App Transport Security Configurations Allowing Cleartext Traffic static MASWE-0050 L1, L2
MASTG-TEST-0323 Uses of Low-Level Networking APIs for Cleartext Traffic static MASWE-0050 L1, L2

MASVS-PLATFORM — Platform Interaction

  • MASVS-PLATFORM-1: The app uses IPC mechanisms securely.
  • MASVS-PLATFORM-2: The app uses WebViews securely.
  • MASVS-PLATFORM-3: The app uses the user interface securely.

Android

ID Test Type Weakness Profiles
MASTG-TEST-0250 References to Content Provider Access in WebViews static MASWE-0069 L1, L2
MASTG-TEST-0251 Runtime Use of Content Provider Access APIs in WebViews dynamic MASWE-0069 L1, L2
MASTG-TEST-0252 References to Local File Access in WebViews static MASWE-0069 L1, L2
MASTG-TEST-0253 Runtime Use of Local File Access APIs in WebViews dynamic MASWE-0069 L1, L2
MASTG-TEST-0258 References to Keyboard Caching Attributes in UI Elements static MASWE-0053 L2
MASTG-TEST-0289 Runtime Verification of Sensitive Content Exposure in Screenshots During App Backgrounding dynamic, manual MASWE-0055 L2
MASTG-TEST-0291 References to Screen Capturing Prevention APIs static MASWE-0055 L2
MASTG-TEST-0292 setRecentsScreenshotEnabled Not Used to Prevent Screenshots When Backgrounded static MASWE-0055 L2
MASTG-TEST-0293 setSecure Not Used to Prevent Screenshots in SurfaceViews static MASWE-0055 L2
MASTG-TEST-0294 SecureOn Not Used to Prevent Screenshots in Compose Dialogs static MASWE-0055 L2
MASTG-TEST-0315 Sensitive Data Exposed via Notifications static MASWE-0054 L2
MASTG-TEST-0316 App Exposing User Authentication Data in Text Input Fields static, manual MASWE-0053 L2
MASTG-TEST-0320 WebViews Not Cleaning Up Sensitive Data dynamic MASWE-0118 L1, L2
MASTG-TEST-0334 Native Code Exposed Through WebViews static MASWE-0069 L1, L2

iOS

ID Test Type Weakness Profiles
MASTG-TEST-0276 Use of the iOS General Pasteboard static MASWE-0053 L2
MASTG-TEST-0277 Sensitive Data in the iOS General Pasteboard at Runtime dynamic MASWE-0053 L2
MASTG-TEST-0278 Pasteboard Contents Not Cleared After Use static MASWE-0053 L2
MASTG-TEST-0279 Pasteboard Contents Not Expiring static MASWE-0053 L2
MASTG-TEST-0280 Pasteboard Contents Not Restricted to Local Device static MASWE-0053 L2
MASTG-TEST-0290 Runtime Verification of Sensitive Content Exposure in Screenshots During App Backgrounding dynamic, manual MASWE-0055 L2
MASTG-TEST-0331 Use of Deprecated WebView APIs static MASWE-0072 L1, L2
MASTG-TEST-0332 Attacker-Controlled URI in WebViews static MASWE-0071 L1, L2, P
MASTG-TEST-0333 Overly Broad File Read Access in WebViews static MASWE-0069 L1, L2

MASVS-CODE — Code Quality

  • MASVS-CODE-1: The app requires an up-to-date platform version.
  • MASVS-CODE-2: The app has a mechanism for enforcing app updates.
  • MASVS-CODE-3: The app only uses software components without known vulnerabilities.
  • MASVS-CODE-4: The app validates and sanitizes all untrusted inputs.

Android

ID Test Type Weakness Profiles
MASTG-TEST-0222 Position Independent Code (PIC) Not Enabled static MASWE-0116 L2
MASTG-TEST-0223 Stack Canaries Not Enabled static MASWE-0116 L2
MASTG-TEST-0245 References to Platform Version APIs static MASWE-0077 L2
MASTG-TEST-0272 Identify Dependencies with Known Vulnerabilities in the Android Project static MASWE-0076 L1, L2
MASTG-TEST-0274 Dependencies with Known Vulnerabilities in the App's SBOM static, developer MASWE-0076 L1, L2

iOS

ID Test Type Weakness Profiles
MASTG-TEST-0228 Position Independent Code (PIC) not Enabled static MASWE-0116 L2
MASTG-TEST-0229 Stack Canaries Not enabled static MASWE-0116 L2
MASTG-TEST-0230 Automatic Reference Counting (ARC) not enabled static MASWE-0116 L2
MASTG-TEST-0273 Identify Dependencies with Known Vulnerabilities by Scanning Dependency Managers Artifacts static MASWE-0076 L1, L2
MASTG-TEST-0275 Dependencies with Known Vulnerabilities in the App's SBOM static, developer MASWE-0076 L1, L2

MASVS-RESILIENCE — Resilience Against Reverse Engineering and Tampering

  • MASVS-RESILIENCE-1: The app validates the integrity of the platform.
  • MASVS-RESILIENCE-2: The app implements anti-tampering mechanisms.
  • MASVS-RESILIENCE-3: The app implements anti-static analysis mechanisms.
  • MASVS-RESILIENCE-4: The app implements anti-dynamic analysis techniques.

Android

ID Test Type Weakness Profiles
MASTG-TEST-0224 Usage of Insecure APK Signature Version static MASWE-0104 R
MASTG-TEST-0225 Usage of Insecure APK Signature Key Size static MASWE-0104 R
MASTG-TEST-0226 Debuggable Flag Enabled in the AndroidManifest static MASWE-0067 R
MASTG-TEST-0227 Debugging Enabled for WebViews static MASWE-0067 R
MASTG-TEST-0247 References to APIs for Detecting Secure Screen Lock static MASWE-0008 L2
MASTG-TEST-0249 Runtime Use of Secure Screen Lock Detection APIs dynamic MASWE-0008 L2
MASTG-TEST-0263 Logging of StrictMode Violations dynamic MASWE-0094 R
MASTG-TEST-0264 Runtime Use of StrictMode APIs dynamic MASWE-0094 R
MASTG-TEST-0265 References to StrictMode APIs static MASWE-0094 R
MASTG-TEST-0288 Debugging Symbols in Native Binaries static MASWE-0093 R
MASTG-TEST-0324 References to Root Detection Mechanisms static MASWE-0097 R
MASTG-TEST-0325 Runtime Use of Root Detection Techniques dynamic MASWE-0097 R

iOS

ID Test Type Weakness Profiles
MASTG-TEST-0219 Testing for Debugging Symbols static MASWE-0093 R
MASTG-TEST-0220 Usage of Outdated Code Signature Format static MASWE-0104 R
MASTG-TEST-0240 Jailbreak Detection in Code dynamic MASWE-0097 R
MASTG-TEST-0241 Runtime Use of Jailbreak Detection Techniques dynamic MASWE-0097 R
MASTG-TEST-0246 Runtime Use of Secure Screen Lock Detection APIs dynamic MASWE-0008 L2
MASTG-TEST-0248 References to APIs for Detecting Secure Screen Lock static MASWE-0008 L2
MASTG-TEST-0261 Debuggable Entitlement Enabled in the entitlements.plist static MASWE-0067 R

MASVS-PRIVACY — Privacy

  • MASVS-PRIVACY-1: The app minimizes access to sensitive data and resources.
  • MASVS-PRIVACY-2: The app prevents identification of the user.
  • MASVS-PRIVACY-3: The app is transparent about data collection and usage.
  • MASVS-PRIVACY-4: The app offers user control over their data.

Android

ID Test Type Weakness Profiles
MASTG-TEST-0206 Undeclared PII in Network Traffic Capture dynamic, network MASWE-0108 P
MASTG-TEST-0254 Dangerous App Permissions static MASWE-0117 P
MASTG-TEST-0255 Permission Requests Not Minimized MASWE-0117 P
MASTG-TEST-0256 Missing Permission Rationale MASWE-0117 P
MASTG-TEST-0257 Not Resetting Unused Permissions MASWE-0117 P
MASTG-TEST-0318 References to SDK APIs Known to Handle Sensitive User Data static MASWE-0112 P
MASTG-TEST-0319 Runtime Use of SDK APIs Known to Handle Sensitive User Data dynamic MASWE-0112 P

iOS

ID Test Type Weakness Profiles
MASTG-TEST-0281 Undeclared Known Tracking Domains static, dynamic MASWE-0108 P

Techniques

Generic

Android

iOS

Tools

Generic

Android

iOS

Network

Generated by mastg-index from OWASP/mastg and MASVS v2.1.0.

About

Human-readable index of all OWASP MASTG tests, techniques, and tools, organized by MASVS control groups

mas.owasp.org/MASTG/

Resources

Readme

License

View license
Activity

Stars

1 star

Watchers

0 watching

Forks

0 forks
Report repository

Releases

No releases published

Packages

 
 
 

Contributors

Languages