├── .gitattributes ├── .github ├── FUNDING.yml ├── ISSUE_TEMPLATE │ ├── bug-report-app.yml │ ├── bug-report.yml │ └── make-donation.yml ├── labeler.yml ├── release.yml └── workflows │ ├── build-website.yml │ ├── codeql-analysis.yml │ ├── config │ └── mlc_config.json │ ├── docgenerator.yml │ ├── labeler.yml │ ├── markdown-linter.yml │ ├── spell-checker.yml │ ├── url-checker-pr.yml │ └── url-checker.yml ├── .gitignore ├── .markdownlinkcheck.json ├── .markdownlint.jsonc ├── .python-version ├── .vscode ├── extensions.json └── settings.json ├── CHANGELOG.md ├── CITATION.cff ├── CODE_OF_CONDUCT.md ├── CONTRIBUTING.md ├── Crackmes ├── Android │ ├── Level_01 │ │ └── UnCrackable-Level1.apk │ ├── Level_02 │ │ └── UnCrackable-Level2.apk │ ├── Level_03 │ │ └── UnCrackable-Level3.apk │ ├── Level_04 │ │ ├── r2pay-v0.9.apk │ │ └── r2pay-v1.0.apk │ └── License_01 │ │ └── validate ├── README.md └── iOS │ ├── Level_01 │ └── UnCrackable-Level1.ipa │ └── Level_02 │ └── UnCrackable-Level2.ipa ├── Document ├── 0x01-Foreword.md ├── 0x02a-Frontispiece.md ├── 0x02b-MASVS-MASTG-Adoption.md ├── 0x02c-Acknowledgements.md ├── 0x03-Overview.md ├── 0x04a-Mobile-App-Taxonomy.md ├── 0x04b-Mobile-App-Security-Testing.md ├── 0x04c-Tampering-and-Reverse-Engineering.md ├── 0x04e-Testing-Authentication-and-Session-Management.md ├── 0x04f-Testing-Network-Communication.md ├── 0x04g-Testing-Cryptography.md ├── 0x04h-Testing-Code-Quality.md ├── 0x04i-Testing-User-Privacy-Protection.md ├── 0x05a-Platform-Overview.md ├── 0x05b-Basic-Security_Testing.md ├── 0x05c-Reverse-Engineering-and-Tampering.md ├── 0x05d-Testing-Data-Storage.md ├── 0x05e-Testing-Cryptography.md ├── 0x05f-Testing-Local-Authentication.md ├── 0x05g-Testing-Network-Communication.md ├── 0x05h-Testing-Platform-Interaction.md ├── 0x05i-Testing-Code-Quality-and-Build-Settings.md ├── 0x05j-Testing-Resiliency-Against-Reverse-Engineering.md ├── 0x06a-Platform-Overview.md ├── 0x06b-Basic-Security-Testing.md ├── 0x06c-Reverse-Engineering-and-Tampering.md ├── 0x06d-Testing-Data-Storage.md ├── 0x06e-Testing-Cryptography.md ├── 0x06f-Testing-Local-Authentication.md ├── 0x06g-Testing-Network-Communication.md ├── 0x06h-Testing-Platform-Interaction.md ├── 0x06i-Testing-Code-Quality-and-Build-Settings.md ├── 0x06j-Testing-Resiliency-Against-Reverse-Engineering.md ├── 0x08a-Testing-Tools.md ├── 0x08b-Reference-Apps.md ├── 0x09-Suggested-Reading.md ├── CHANGELOG.md ├── Images │ ├── CC-license.png │ ├── Chapters │ │ ├── 0x03 │ │ │ └── owasp-mobile-overview.png │ │ ├── 0x04 │ │ │ └── frida.png │ │ ├── 0x04b │ │ │ ├── DevSecOpsProcess.JPG │ │ │ ├── ExampleOfADevSecOpsProcess.jpg │ │ │ └── SDLCOverview.jpg │ │ ├── 0x04c │ │ │ ├── Ghidra_elf_import.png │ │ │ ├── Ghidra_function_graph.png │ │ │ ├── Ghidra_import_binary.png │ │ │ ├── Ghidra_main_window.png │ │ │ ├── Ghidra_new_project.png │ │ │ └── Ghidra_string_window.png │ │ ├── 0x04e │ │ │ ├── BurpIntruderInputList.gif │ │ │ ├── BurpIntruderInputList.png │ │ │ ├── BurpIntruderSuccessfulAttack.png │ │ │ ├── abstract_oath2_flow.png │ │ │ └── zxcvbn.png │ │ ├── 0x04f │ │ │ ├── BURP.png │ │ │ ├── architecture_MITM_AP.png │ │ │ ├── bettercap.png │ │ │ └── burp_xamarin.png │ │ ├── 0x04i │ │ │ └── masa_framework.png │ │ ├── 0x05a │ │ │ ├── Selection_003.png │ │ │ ├── android_software_stack.png │ │ │ ├── apk-validation-process-v3-scheme.png │ │ │ ├── apk-validation-process.png │ │ │ ├── binder.jpg │ │ │ ├── java2oat.png │ │ │ └── java_vs_dalvik.png │ │ ├── 0x05b │ │ │ ├── Android_Wireshark.png │ │ │ ├── FCM-notifications-overview.png │ │ │ ├── FCM-notifications-overview.svg │ │ │ ├── FCM_Intercept.png │ │ │ ├── android-advanced-options.png │ │ │ ├── android-cert-install.png │ │ │ ├── android-confirm.png │ │ │ ├── android-downloads-app.png │ │ │ ├── android-modify-network.png │ │ │ ├── android-proxy-hostname-port.png │ │ │ ├── android-proxy-manual.png │ │ │ ├── android-settings.png │ │ │ ├── android-studio-file-device-explorer.png │ │ │ ├── android-wifi-on.png │ │ │ ├── android-wifi-settings.png │ │ │ ├── android_ssl_pinning_bypass.png │ │ │ ├── burp-add-proxy.png │ │ │ ├── burp-bind-port-and-address.png │ │ │ ├── burp-ca-certificate.png │ │ │ ├── burp-https-intercepted.png │ │ │ ├── burp-intercepted-request.png │ │ │ ├── burp-running-proxy.png │ │ │ ├── emulator-proxy.jpg │ │ │ ├── emulator-proxy.png │ │ │ ├── log_output_Android_Studio.png │ │ │ ├── mail-cert-download.png │ │ │ ├── mobsf_android.png │ │ │ ├── mstg-network.png │ │ │ ├── r2_graphmode.png │ │ │ ├── r2_pd_10.png │ │ │ ├── r2_visualmode_disass.png │ │ │ ├── r2_visualmode_hex.png │ │ │ ├── server.png │ │ │ ├── sftp-with-filezilla.png │ │ │ ├── string.png │ │ │ └── tcpdump_and_wireshard_on_android.png │ │ ├── 0x05c │ │ │ ├── Choose_Process.png │ │ │ ├── Force_Step_Into.png │ │ │ ├── Ghidra_decompiled_function.png │ │ │ ├── IDA_open_file.jpg │ │ │ ├── JNI_interface.png │ │ │ ├── MainActivity_verify.png │ │ │ ├── anti_debug_anti_tamper_defeated.png │ │ │ ├── archs.jpg │ │ │ ├── check_input.jpg │ │ │ ├── crackme-1.jpg │ │ │ ├── crackme-1.png │ │ │ ├── crackme-2.jpg │ │ │ ├── crackme-frida-1.png │ │ │ ├── custom_kernel.jpg │ │ │ ├── debugger_detection.jpg │ │ │ ├── debugger_detection.png │ │ │ ├── delete_package.jpg │ │ │ ├── developer-options.jpg │ │ │ ├── developer-options.png │ │ │ ├── disass_main_1874.png │ │ │ ├── drag_code.jpg │ │ │ ├── file_exists_false.png │ │ │ ├── final_structure.jpg │ │ │ ├── frida_trace_native_functions.png │ │ │ ├── fucntion_a_of_class_sg_vantagepoint_a.png │ │ │ ├── ghidra_dex_strings.png │ │ │ ├── graph_1874.png │ │ │ ├── graph_ifelse_1760.png │ │ │ ├── helloworld.jpg │ │ │ ├── helloworld.png │ │ │ ├── helloworld_stringfromjni.jpg │ │ │ ├── intellij_new_project.jpg │ │ │ ├── jni_tracing_helloworldjni.png │ │ │ ├── loop_1784.png │ │ │ ├── method_breakpoint.jpg │ │ │ ├── modified_binary_name.png │ │ │ ├── patching-sslpinning.jpg │ │ │ ├── pseudocode_1760.png │ │ │ ├── refactored.jpg │ │ │ ├── sdk_manager.jpg │ │ │ ├── secret_code.png │ │ │ ├── set_breakpoint_and_attach_debugger.png │ │ │ ├── set_value.png │ │ │ ├── sg_vantagepoint_uncrackable1_a_function_a.png │ │ │ ├── step_out.png │ │ │ ├── step_over.png │ │ │ ├── success.png │ │ │ ├── syscall_hooking.jpg │ │ │ ├── values_compare_17dc.png │ │ │ ├── variables.png │ │ │ └── waitfordebugger.png │ │ ├── 0x05d │ │ │ ├── 1.png │ │ │ ├── 2.png │ │ │ ├── 3.png │ │ │ ├── Android9_secure_key_import_to_keystore.jpg │ │ │ ├── Android9_secure_key_import_to_keystore.png │ │ │ ├── Dump_Java_Heap.png │ │ │ ├── FirebaseScannerImage.png │ │ │ └── Package_Tree_View.png │ │ ├── 0x05f │ │ │ └── biometricprompt-architecture.png │ │ ├── 0x05h │ │ │ ├── MobSF_Show_Components.png │ │ │ └── app-disambiguation.png │ │ ├── 0x05j │ │ │ └── proguard.jpg │ │ ├── 0x06a │ │ │ ├── code_signing.png │ │ │ ├── iOS_Folder_Structure.png │ │ │ ├── iOS_Security_Architecture.png │ │ │ └── iOS_project_folder.png │ │ ├── 0x06b │ │ │ ├── HopperDecompile.png │ │ │ ├── HopperDisassembling.png │ │ │ ├── Passionfruit.png │ │ │ ├── Passionfruit_Keychain.png │ │ │ ├── Passionfruit_files.png │ │ │ ├── cydia.png │ │ │ ├── device_console.png │ │ │ ├── finder_ipad_view.png │ │ │ ├── finder_unveil_udid.png │ │ │ ├── fridaStockiOS.png │ │ │ ├── install_agent_1.jpg │ │ │ ├── install_agent_2.jpg │ │ │ ├── install_needle_agent.jpg │ │ │ ├── install_needle_agent.png │ │ │ ├── ios_ssl_pinning_bypass.png │ │ │ ├── mobsf_ios.png │ │ │ ├── needle_agent.jpg │ │ │ ├── needle_agent.png │ │ │ ├── open_device_console.png │ │ │ ├── passionfruit_bundle_dir.png │ │ │ ├── passionfruit_classes.png │ │ │ ├── passionfruit_classes_detail.png │ │ │ ├── passionfruit_console_logs.png │ │ │ ├── passionfruit_data_dir.png │ │ │ ├── passionfruit_db_view.png │ │ │ ├── passionfruit_file_download.png │ │ │ ├── passionfruit_installed_apps.png │ │ │ ├── passionfruit_modules.png │ │ │ ├── passionfruit_modules_detail.png │ │ │ ├── passionfruit_plist_view.png │ │ │ ├── passionfruit_userdefaults.png │ │ │ ├── setBurpProxy.png │ │ │ ├── setProxyiDevice.png │ │ │ └── wireshark_filters.png │ │ ├── 0x06c │ │ │ ├── Cycript_Jailbreak.png │ │ │ ├── Cycript_Jailbreak_Passed.png │ │ │ ├── Cycript_bypass_Jailbreak.png │ │ │ ├── cycript_sample.png │ │ │ ├── debugging_ghidra_breakpoint.png │ │ │ ├── debugging_ghidra_image_base_address.png │ │ │ ├── debugging_lldb_breakpoint_solution.png │ │ │ ├── debugging_lldb_image_list.png │ │ │ ├── frida-xcode-log.png │ │ │ ├── ida_macho_import.png │ │ │ ├── ida_main_window.png │ │ │ ├── manual_reversing_app_home_screen.png │ │ │ ├── manual_reversing_app_home_screen2.png │ │ │ ├── manual_reversing_app_wrong_input.png │ │ │ ├── manual_reversing_ghidra_buttonclick_decompiled.png │ │ │ ├── manual_reversing_ghidra_function_graph.png │ │ │ ├── manual_reversing_ghidra_native_disassembly.png │ │ │ ├── manual_reversing_ghidra_objc_runtime_strings.png │ │ │ ├── manual_reversing_ghidra_strings.png │ │ │ ├── manual_reversing_ghidra_symbol_tree.png │ │ │ ├── manual_reversing_ghidra_viewdidload_decompile.png │ │ │ └── uncrackable_sections.png │ │ ├── 0x06d │ │ │ ├── bither_demo_enable_pin.png │ │ │ ├── bither_demo_imazing_1.png │ │ │ ├── bither_demo_pin_screen.png │ │ │ ├── bither_demo_plist.png │ │ │ └── key_hierarchy_apple.jpg │ │ ├── 0x06g │ │ │ └── manual-server-trust-evaluation.png │ │ ├── 0x06h │ │ │ ├── URL_scheme.png │ │ │ ├── airdrop_openwith.png │ │ │ ├── allowed_universal_link.png │ │ │ ├── app_extensions_communication.png │ │ │ ├── app_extensions_container_restrictions.png │ │ │ ├── apple-app-site-association-file_validation.png │ │ │ ├── exploit_javascript_bridge.png │ │ │ ├── forbidden_universal_link.png │ │ │ ├── iGoat_opened_via_url_scheme.jpg │ │ │ ├── open_in_telegram_via_universallink.png │ │ │ ├── open_in_telegram_via_urlscheme.png │ │ │ ├── permission_request_alert.png │ │ │ ├── purpose_strings_xcode.png │ │ │ ├── settings_allow_screen.png │ │ │ ├── sfsafariviewcontroller.png │ │ │ ├── share_activity_sheet.png │ │ │ ├── telegram_add_stickers_universal_link.png │ │ │ ├── telegram_share_extension.png │ │ │ ├── telegram_share_something.png │ │ │ └── xcode_embed_app_extensions.png │ │ ├── 0x06j │ │ │ ├── Android9_secure_key_import_to_keystore.jpg │ │ │ ├── control-flow-flattening.png │ │ │ ├── deviceISjailbroken.png │ │ │ ├── deviceisNOTjailbroken.png │ │ │ ├── no_obfuscation.jpg │ │ │ ├── no_obfuscation.png │ │ │ ├── ptraceDisassembly.png │ │ │ ├── ptracePatched.png │ │ │ ├── swiftshield_obfuscated.jpg │ │ │ ├── swiftshield_obfuscated.png │ │ │ ├── sysctlOriginal.png │ │ │ └── sysctlPatched.png │ │ ├── 0x07b │ │ │ ├── blackbox-resiliency-testing.png │ │ │ ├── boxplot.png │ │ │ └── multiprocess-fork-ptrace.png │ │ ├── 0x07c │ │ │ ├── ECB.png │ │ │ └── EncryptionMode.png │ │ ├── 0x08a │ │ │ └── jadx_copy_frida_snippet.png │ │ ├── 0x5e │ │ │ ├── EncryptionMode.png │ │ │ └── static_encryption_key.png │ │ └── 0x6f │ │ │ ├── biometric_auth_try_again.jpg │ │ │ └── boimetric_auth.jpg │ ├── Donators │ │ └── donators.png │ ├── GitHub_logo.png │ ├── ISBN.png │ ├── OWASP_logo-bw.png │ ├── OWASP_logo_white.png │ ├── Other │ │ ├── GitHub_logo.png │ │ ├── android-logo.png │ │ ├── bsi-logo.png │ │ ├── crest_logo.jpg │ │ ├── ioxt-logo.png │ │ ├── nist-logo.png │ │ ├── nowsecure-logo.png │ │ ├── trusted-by-logos.png │ │ └── uncrackable-logo.png │ ├── checklist_en_filled.png │ ├── license.jpg │ ├── logo_circle.png │ ├── masvs_cover.png │ ├── masvs_refactor.png │ ├── mstg-cover-release-small.jpg │ ├── mstg_cover.png │ ├── open_website.png │ ├── owasp_mas_header.png │ ├── slack_logo.png │ ├── summit-team.jpg │ ├── summit_preview.jpg │ ├── titlepage-small.jpg │ └── twitter_logo.png ├── LANGUAGE-METADATA ├── SUMMARY.md ├── cover.md ├── metadata.md └── metadata.yml ├── License.md ├── OWASP_logo.png ├── PULL_REQUEST_TEMPLATE.md ├── README.md ├── Samples └── Android │ ├── 01_HelloWorld-JNI │ └── HelloWord-JNI.apk │ └── 02_CertificatePinning │ ├── certificatePinningXamarin.apk │ └── readme.md ├── Templates └── testcase.md ├── book.json ├── cover.pdf ├── cover.png ├── docs ├── CNAME ├── MASTG.md ├── MASVS.md ├── MAS_checklist.md ├── assets │ ├── GitHub_logo.png │ ├── OWASP_logo_white.png │ ├── carlos.jpg │ ├── checklist_en_filled.png │ ├── comment-marked-as-answer.png │ ├── data │ │ └── talks.yaml │ ├── donations │ │ ├── donators.png │ │ ├── mastg_donation_form.png │ │ └── owasp_donation_form.png │ ├── hover-comment-icon.gif │ ├── logo.png │ ├── logo_circle.png │ ├── mastg_cover.png │ ├── masvs_cover.png │ ├── news │ │ └── mas-rebranding.png │ ├── release_header.png │ ├── starring.png │ ├── suggestion-block.png │ ├── sven.jpg │ └── trusted-by-logos.png ├── contact.md ├── contributing.md ├── contributing │ ├── 1_How_Can_You_Contribute.md │ ├── 2_Getting_Started.md │ ├── 3_PRs_and_Reviews.md │ ├── 4_Add_new_Language.md │ ├── 5_Style_Guide.md │ └── 6_Add_a_Crackme.md ├── crackmes.md ├── crackmes │ ├── Android.md │ └── iOS.md ├── donate.md ├── donate │ ├── packages.md │ └── steps.md ├── images │ └── release_header.png ├── index.md ├── javascripts │ └── tablesorts.js ├── news.md ├── stylesheets │ └── extra.css └── talks.md ├── mkdocs.yml ├── requirements.txt └── tools ├── Apply_Link_Check.sh ├── Apply_Linter_Check.sh ├── README.md ├── base_images ├── mstg-cover-hugo.psd ├── mstg-cover-hugo.xcf ├── mstg-cover.jpg ├── mstg-cover.png └── mstg-cover.xcf ├── contributors.py ├── custom-reference.docx ├── docker ├── README.md ├── SourceSansPro-It.otf ├── cover.tex ├── first_page.tex ├── imagereplace.sed ├── latex-header.tex └── pandoc_makedocs.sh ├── scripts ├── excel_styles_and_validation.py ├── gen_all_excel.sh ├── mstg_to_html.sh ├── parse_html.py ├── populate_dynamic_pages.py ├── requirements.txt ├── structure_mastg.sh ├── structure_masvs.sh ├── testcase_diff.py ├── transform_files.py └── yaml_to_excel.py ├── updateLeanpub.sh └── updateLulu.sh /.gitattributes: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/.gitattributes -------------------------------------------------------------------------------- /.github/FUNDING.yml: -------------------------------------------------------------------------------- 1 | custom: https://www.icrc.org/en/donate/ukraine 2 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/bug-report-app.yml: -------------------------------------------------------------------------------- 1 | name: 🪲📲 Bug in MASTG crackmes / challenges Apps 2 | description: Create a report to help us improve the MASTG. 3 | title: "[Bug] " 4 | labels: ["bug"] 5 | 6 | body: 7 | 8 | - type: markdown 9 | id: intro 10 | attributes: 11 | value: | 12 | Thanks for taking the time to fill out this bug! If you need real-time help, join us on our [Slack channel](https://owasp.slack.com/messages/project-mobile_omtg/details/ "Come to our Slack!"). 13 | 14 | - type: input 15 | id: description 16 | attributes: 17 | label: Describe the issue 18 | description: A clear and concise description of what the bug is. 19 | validations: 20 | required: true 21 | 22 | - type: input 23 | id: where 24 | attributes: 25 | label: App Name 26 | description: Name of crackme or challenge app that is broken. See all apps [here](https://github.com/OWASP/owasp-mastg/tree/master/Crackmes). 27 | placeholder: e.g. UnCrackable App for Android Level 1 28 | validations: 29 | required: true 30 | 31 | - type: textarea 32 | id: repro 33 | attributes: 34 | label: Reproduction steps 35 | description: "How do you trigger this bug? Please walk us through it step by step." 36 | value: | 37 | 1. 38 | 2. 39 | 3. 40 | ... 41 | render: bash 42 | validations: 43 | required: true 44 | 45 | - type: input 46 | id: expected 47 | attributes: 48 | label: Expected behaviour 49 | description: A clear and concise description of what you expected to happen. 50 | validations: 51 | required: true 52 | 53 | - type: input 54 | id: context 55 | attributes: 56 | label: Additional context 57 | description: More context that may help us understand the bug. 58 | validations: 59 | required: false 60 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/bug-report.yml: -------------------------------------------------------------------------------- 1 | name: 🪲📘 Bug report / error in MASTG report 2 | description: Create a report to help us improve the MASTG. 3 | title: "[Bug] " 4 | labels: ["bug"] 5 | 6 | body: 7 | 8 | - type: markdown 9 | id: intro 10 | attributes: 11 | value: | 12 | Thanks for taking the time to fill out this bug! 13 | Please give below a clear and concise description of what is missing/ wrongly formulated / misspelled / lacks effectiveness (in terms of detection or remediation). 14 | If you need real-time help, join us on our [Slack channel](https://owasp.slack.com/messages/project-mobile_omtg/details/ "Come to our Slack!"). 15 | 16 | **NOTE: Please consider opening a PR directly including your fix, that'd save us a lot of time 🙏🏻 Thanks a lot!** 17 | 18 | - type: input 19 | id: chapter 20 | attributes: 21 | label: MASTG Chapter 22 | description: Which chapter contains the bug? 23 | placeholder: e.g. 0x05f-Testing-Local-Authentication.md line 30 24 | validations: 25 | required: true 26 | 27 | - type: input 28 | id: line 29 | attributes: 30 | label: File Line Number 31 | description: Which line number? 32 | placeholder: e.g. 30 33 | validations: 34 | required: true 35 | 36 | - type: input 37 | id: context 38 | attributes: 39 | label: Context 40 | description: | 41 | Please give us context about the issue here. e.g. 42 | - Example 1: there's a typo, it should be "through" not "thrugh". 43 | - Example 2: this section says that you can do XXXX but since Android XX is not possible anymore. 44 | - Example 3: this test requires the tester to do XXXX but that's not working anymore since iOS. 45 | placeholder: explain here what happens 46 | validations: 47 | required: true 48 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/make-donation.yml: -------------------------------------------------------------------------------- 1 | name: 💲 Donate to the OWASP Mobile Application Security Project 2 | description: Thanks for donating to the MAS project! 3 | title: "💲🎉 New Donation" 4 | labels: ["org", "donation"] 5 | assignees: 6 | - cpholguera 7 | - sushi2k 8 | body: 9 | 10 | - type: markdown 11 | id: intro 12 | attributes: 13 | value: | 14 | **IMPORTANT**: Before opening this issue please go to our [**Donations page**](https://mas.owasp.org/donate) and read all the information. 15 | 16 | 🙏🏻 Thanks a lot! 17 | 18 | - type: input 19 | id: name 20 | attributes: 21 | label: 🙂 Your Name 22 | validations: 23 | required: true 24 | 25 | - type: input 26 | id: company 27 | attributes: 28 | label: 🏢 Company Name 29 | description: What's the name of your company? 30 | placeholder: ex. Nice Security Ltd. 31 | validations: 32 | required: false 33 | 34 | - type: input 35 | id: contact 36 | attributes: 37 | label: 📧 E-Mail Address 38 | description: How can we get in touch with you if we need more info? 39 | placeholder: ex. email@example.com 40 | validations: 41 | required: true 42 | 43 | - type: input 44 | id: amount 45 | attributes: 46 | label: 💵 Donation Amount 47 | description: How much would you like to donate? 48 | placeholder: ex. USD 2000, EUR 1000 49 | validations: 50 | required: false 51 | 52 | - type: dropdown 53 | id: package 54 | attributes: 55 | label: 📦 Donation Package 56 | description: Which Donator Package would you like to request? 57 | options: 58 | - Standard Donation / No package (Donation < USD 500) 59 | - Good Samaritan (USD 500; 1 year; 1 paperback MASTG) 60 | - Honourable Benefactor (USD 2000 / 8 Available; 2 years; 3 paperback MASTGs) 61 | - God Mode Donator (USD 4000 / 5 Available; 3 years; 5 paperback MASTGs) 62 | validations: 63 | required: true 64 | 65 | - type: dropdown 66 | id: paperback 67 | attributes: 68 | label: 📘 MASTG Paperback Copies 69 | description: Would you like to receive the paperback copies of the MASTG as indicated in your Donation Package? 70 | options: 71 | - 🌱 No, please save the money for the project and help the environment and climate. 72 | - 📮 Yes, please send them to me. 73 | validations: 74 | required: true 75 | 76 | - type: checkboxes 77 | id: terms 78 | attributes: 79 | label: 📋 Code of Conduct and Donation Conditions 80 | description: | 81 | By submitting this request, you agree to follow our [**Code of Conduct**](CODE_OF_CONDUCT.md) 82 | and have read and agree to the [**Donation Conditions**](https://mas.owasp.org/donate). 83 | > Some important points to consider: 84 | > These types of public recognition shall be online no less than one year, 85 | > or in the case of Project no less than the next major release, whichever is greater. 86 | > Some Donation Packages have a maximum duration. Once reached, the logos will be removed 87 | > and the donator will still be listed as supporter on the project website, 88 | > GitHub and in the printed and digital versions. This can be renewed anytime. 89 | options: 90 | - label: I agree to follow this project's Code of Conduct and Donation conditions. 91 | required: true 92 | -------------------------------------------------------------------------------- /.github/labeler.yml: -------------------------------------------------------------------------------- 1 | # LABEL List for Workflow labeler.yml job triage 2 | "iOS": 3 | - Document/0x06* 4 | 5 | "Android": 6 | - Document/0x05* 7 | 8 | "MASVS-STORAGE": 9 | - Document/0x0[5-6]d* 10 | 11 | "MASVS-CRYPTO": 12 | - Document/0x0[5-6]e* 13 | 14 | "MASVS-AUTH": 15 | - Document/0x0[5-6]f* 16 | 17 | "MASVS-NETWORK": 18 | - Document/0x0[5-6]g* 19 | 20 | "MASVS-PLATFORM": 21 | - Document/0x0[5-6]h* 22 | 23 | "MASVS-CODE": 24 | - Document/0x0[5-6]i* 25 | 26 | "MASVS-RESILIENCE": 27 | - Document/0x0[5-6]j* 28 | 29 | "tests": 30 | - Document/0x0[5-6][d-j]* 31 | 32 | "fundamentals": 33 | - Document/0x0[5-6][a-b]* 34 | 35 | "techniques": 36 | - Document/0x0[5-6]c* 37 | 38 | "tools": 39 | - Document/0x08* 40 | -------------------------------------------------------------------------------- /.github/release.yml: -------------------------------------------------------------------------------- 1 | changelog: 2 | exclude: 3 | labels: 4 | - "ignore-for-release" 5 | categories: 6 | - title: 📢 News 7 | labels: 8 | - "news" 9 | - title: 🧪 MASTG Test Cases 10 | labels: 11 | - "tests" 12 | - title: 📖 MASTG Testing Fundamentals 13 | labels: 14 | - "fundamentals" 15 | - title: ✨ MASTG Testing Techniques 16 | labels: 17 | - "techniques" 18 | - title: 🪄 MASTG Testing Tools 19 | labels: 20 | - "tools" 21 | - title: ⚡ Automation 22 | labels: 23 | - "automation" 24 | - title: 📜 Mobile Security Checklists 25 | labels: 26 | - "checklists" 27 | - title: 🎉 New Donators 28 | labels: 29 | - "donation" 30 | - title: 🐞 Errata Corrections 31 | labels: 32 | - "errata" 33 | - title: Other Changes 34 | labels: 35 | - "*" 36 | 37 | -------------------------------------------------------------------------------- /.github/workflows/build-website.yml: -------------------------------------------------------------------------------- 1 | name: Build GitHub Pages 2 | on: 3 | workflow_dispatch: 4 | push: 5 | branches: 6 | - master 7 | jobs: 8 | deploy: 9 | runs-on: ubuntu-latest 10 | steps: 11 | - uses: actions/checkout@v2 12 | - uses: actions/setup-python@v2 13 | with: 14 | python-version: 3.x 15 | - run: pip install -r requirements.txt 16 | 17 | - run: ./tools/scripts/structure_mastg.sh 18 | - run: python3 tools/scripts/transform_files.py 19 | 20 | - run: mv Document/Images/ docs/assets/Images/ 21 | - run: sed -i "s# 6 | -------------------------------------------------------------------------------- /CITATION.cff: -------------------------------------------------------------------------------- 1 | # YAML 1.2 2 | --- 3 | abstract: "The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the controls listed in the OWASP Mobile Application Verification Standard (MASVS)." 4 | authors: 5 | - 6 | family-names: Holguera 7 | given-names: Carlos 8 | - 9 | family-names: Schleier 10 | given-names: Sven 11 | - 12 | family-names: Mueller 13 | given-names: Bernhard 14 | - 15 | family-names: Willemsen 16 | given-names: Jeroen 17 | cff-version: "1.1.0" 18 | date-released: 2022-09-05 19 | identifiers: 20 | - 21 | type: isbn 22 | value: "978-1-257-96636-3" 23 | keywords: 24 | - "mobile security" 25 | - "Android security" 26 | - "iOS security" 27 | - "mobile pentesting" 28 | license: "CC-BY-SA-4.0" 29 | message: "If you use the MASTG, please cite it using these metadata." 30 | repository-code: "https://github.com/OWASP/owasp-mastg/" 31 | title: "OWASP Mobile Application Security Testing Guide" 32 | version: "1.5.0" 33 | ... -------------------------------------------------------------------------------- /CODE_OF_CONDUCT.md: -------------------------------------------------------------------------------- 1 | # Contributor Covenant Code of Conduct 2 | 3 | ## Our Pledge 4 | 5 | In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation. 6 | 7 | ## Our Standards 8 | 9 | Examples of behavior that contributes to creating a positive environment include: 10 | 11 | - Using welcoming and inclusive language 12 | - Being respectful of differing viewpoints and experiences 13 | - Gracefully accepting constructive criticism 14 | - Focusing on what is best for the community 15 | - Showing empathy towards other community members 16 | 17 | Examples of unacceptable behavior by participants include: 18 | 19 | - The use of sexualized language or imagery and unwelcome sexual attention or advances 20 | - Trolling, insulting/derogatory comments, and personal or political attacks 21 | - Public or private harassment 22 | - Publishing others' private information, such as a physical or electronic address, without explicit permission 23 | - Misusing the context of the Mobile Application Security project for commercial goals (e.g. adding sales pitches to the guide or to communication channels used by the project, such as Slack). 24 | - Other conduct which could reasonably be considered inappropriate in a professional setting 25 | 26 | ## Our Responsibilities 27 | 28 | Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. 29 | 30 | Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. 31 | 32 | ## Disclaimer 33 | 34 | The OWAPS MAS and its materials are conceived for educational and research purposes only, or if you are a professional security tester that is analyzing mobile apps with approval of the app owner (e.g. as part of a penetration test or a bug bounty program). 35 | 36 | Refrain from violating the laws in your country by carefully consulting them before executing any tests against mobile apps when utilizing the OWAPS MAS materials. 37 | 38 | The OWAPS MAS project is also NOT supporting unethical activities in any way. If you come across such requests, please reach out to the project leaders and raise this to them. 39 | 40 | Neither OWASP, the OWAPS MAS project leaders, authors or anyone else involved in this project is going to take responsibility for your actions. 41 | 42 | The intention of the OWAPS MAS project is not to encourage hacking or malicious activities! Instead, the goal of the project is to document different attacks against mobile apps and its risk, and offer ways to reduce or mitigate that risk. 43 | 44 | ## Scope 45 | 46 | This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community includes using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. 47 | 48 | ## Enforcement 49 | 50 | Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at sven.schleier@owasp.org and carlos.holguera@owasp.org. 51 | 52 | All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately. 53 | 54 | Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. 55 | 56 | ## Attribution 57 | 58 | This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org "Contributor Covenant homepage"), [version 1.4](https://www.contributor-covenant.org/version/1/4/code-of-conduct.html "Code of Conduct version 1.4"). 59 | 60 | For answers to common questions about this code of conduct, see [the Contributor Covenant FAQ](https://www.contributor-covenant.org/faq) 61 | -------------------------------------------------------------------------------- /CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | # Contributing 2 | 3 | Learn how you can contribute to the OWASP Application Mobile Security Project [in our official website](https://mas.owasp.org/contributing). 4 | -------------------------------------------------------------------------------- /Crackmes/Android/Level_01/UnCrackable-Level1.apk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Crackmes/Android/Level_01/UnCrackable-Level1.apk -------------------------------------------------------------------------------- /Crackmes/Android/Level_02/UnCrackable-Level2.apk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Crackmes/Android/Level_02/UnCrackable-Level2.apk -------------------------------------------------------------------------------- /Crackmes/Android/Level_03/UnCrackable-Level3.apk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Crackmes/Android/Level_03/UnCrackable-Level3.apk -------------------------------------------------------------------------------- /Crackmes/Android/Level_04/r2pay-v0.9.apk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Crackmes/Android/Level_04/r2pay-v0.9.apk -------------------------------------------------------------------------------- /Crackmes/Android/Level_04/r2pay-v1.0.apk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Crackmes/Android/Level_04/r2pay-v1.0.apk -------------------------------------------------------------------------------- /Crackmes/Android/License_01/validate: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Crackmes/Android/License_01/validate -------------------------------------------------------------------------------- /Crackmes/README.md: -------------------------------------------------------------------------------- 1 | # UnCrackable Mobile Apps 2 | 3 | 4 | 5 | These are the UnCrackable Apps for Android and iOS, a collection of mobile reverse engineering challenges. These challenges are used as examples throughout the OWASP MASTG. Of course, you can also solve them for fun. 6 | 7 | See for more information. 8 | -------------------------------------------------------------------------------- /Crackmes/iOS/Level_01/UnCrackable-Level1.ipa: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Crackmes/iOS/Level_01/UnCrackable-Level1.ipa -------------------------------------------------------------------------------- /Crackmes/iOS/Level_02/UnCrackable-Level2.ipa: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Crackmes/iOS/Level_02/UnCrackable-Level2.ipa -------------------------------------------------------------------------------- /Document/0x01-Foreword.md: -------------------------------------------------------------------------------- 1 | # Foreword 2 | 3 | Welcome to the OWASP Mobile Application Security Testing Guide. Feel free to explore the existing content, but do note that it may change at any time. New APIs and best practices are introduced in iOS and Android with every major (and minor) release and also vulnerabilities are found every day. 4 | 5 | If you have feedback or suggestions, or want to contribute, create an issue on GitHub or ping us on Slack. See the README for instructions: 6 | 7 | 8 | 9 | **squirrel (noun plural): Any arboreal sciurine rodent of the genus Sciurus, such as S. vulgaris (red squirrel) or S. carolinensis (grey squirrel), having a bushy tail and feeding on nuts, seeds, etc.** 10 | 11 | On a beautiful summer day, a group of ~7 young men, a woman, and approximately three squirrels met in a Woburn Forest villa during the OWASP Security Summit 2017. So far, nothing unusual. But little did you know, within the next five days, they would redefine not only mobile application security, but the very fundamentals of book writing itself (ironically, the event took place near Bletchley Park, once the residence and work place of the great Alan Turing). 12 | 13 | Or maybe that's going too far. But at least, they produced a proof-of-concept for an unusual security book. The Mobile Application Security Testing Guide (MASTG) is an open, agile, crowd-sourced effort, made of the contributions of dozens of authors and reviewers from all over the world. 14 | 15 | Because this isn't a normal security book, the introduction doesn't list impressive facts and data proving importance of mobile devices in this day and age. It also doesn't explain how mobile application security is broken, and why a book like this was sorely needed, and the authors don't thank their beloved ones without whom the book wouldn't have been possible. 16 | 17 | We do have a message to our readers however! The first rule of the OWASP Mobile Application Security Testing Guide is: Don't just follow the OWASP Mobile Application Security Testing Guide. True excellence at mobile application security requires a deep understanding of mobile operating systems, coding, network security, cryptography, and a whole lot of other things, many of which we can only touch on briefly in this book. Don't stop at security testing. Write your own apps, compile your own kernels, dissect mobile malware, learn how things tick. And as you keep learning new things, consider contributing to the MASTG yourself! Or, as they say: "Do a pull request". 18 | 19 | 20 | -------------------------------------------------------------------------------- /Document/0x08b-Reference-Apps.md: -------------------------------------------------------------------------------- 1 | # Reference applications 2 | 3 | The applications listed below can be used as training materials. Note: only the MASTG apps and Crackmes are tested and maintained by the MAS project. 4 | 5 | ## Android 6 | 7 | ### Android Crackmes 8 | 9 | A set of apps to test your Android application hacking skills - 10 | 11 | #### Android UnCrackable L1 12 | 13 | Available at 14 | 15 | #### Android UnCrackable L2 16 | 17 | Available at 18 | 19 | #### Android UnCrackable L3 20 | 21 | Available at 22 | 23 | #### Android UnCrackable L4 24 | 25 | Available at 26 | 27 | #### Android License Validator 28 | 29 | Available at 30 | 31 | ### AndroGoat 32 | 33 | An open source vulnerable/insecure app using Kotlin. This app has a wide range of vulnerabilities related to certificate pinning, custom URL schemes, Android Network Security Configuration, WebViews, root detection and over 20 other vulnerabilities - 34 | 35 | ### DVHMA 36 | 37 | A hybrid mobile app (for Android) that intentionally contains vulnerabilities - 38 | 39 | ### Digitalbank 40 | 41 | A vulnerable app created in 2015, which can be used on older Android platforms - 42 | 43 | ### DIVA Android 44 | 45 | An app intentionally designed to be insecure which has received updates in 2016 and contains 13 different challenges - 46 | 47 | ### DodoVulnerableBank 48 | 49 | An insecure Android app from 2015 - 50 | 51 | ### InsecureBankv2 52 | 53 | A vulnerable Android app made for security enthusiasts and developers to learn the Android insecurities by testing a vulnerable application. It has been updated in 2018 and contains a lot of vulnerabilities - 54 | 55 | ### MASTG Hacking Playground 56 | 57 | A vulnerable Android app with vulnerabilities similar to the test cases described in this document 58 | 59 | #### MASTG Hacking Playground (Java) 60 | 61 | Available at 62 | 63 | #### MASTG Hacking Playground (Kotlin) 64 | 65 | Available at 66 | 67 | ### OVAA 68 | 69 | An Android app that aggregates all the platform's known and popular security vulnerabilities - 70 | 71 | ## iOS 72 | 73 | ### iOS Crackmes 74 | 75 | A set of applications to test your iOS application hacking skills - 76 | 77 | #### iOS UnCrackable L1 78 | 79 | Available at 80 | 81 | #### iOS UnCrackable L2 82 | 83 | Available at 84 | 85 | ### Myriam 86 | 87 | A vulnerable iOS app with iOS security challenges - 88 | 89 | ### DVIA 90 | 91 | A vulnerable iOS app written in Objective-C which provides a platform to mobile security enthusiasts/professionals or students to test their iOS penetration testing skills - 92 | 93 | ### DVIA-v2 94 | 95 | A vulnerable iOS app, written in Swift with over 15 vulnerabilities - 96 | 97 | ### iGoat 98 | 99 | An iOS Objective-C app serving as a learning tool for iOS developers (iPhone, iPad, etc.) and mobile app pentesters. It was inspired by the WebGoat project, and has a similar conceptual flow to it - 100 | 101 | ### iGoat-Swift 102 | 103 | A Swift version of original iGoat project - 104 | 105 | ### OVIA 106 | 107 | An iOS app that aggregates all the platform's known and popular security vulnerabilities - 108 | 109 | ### UnSAFE Bank 110 | 111 | UnSAFE Bank is a core virtual banking application designed with the aim to incorporate the cybersecurity risks and various test cases such that newbie, developers, and security analysts can learn, hack and improvise their vulnerability assessment and penetration testing skills. - 112 | -------------------------------------------------------------------------------- /Document/0x09-Suggested-Reading.md: -------------------------------------------------------------------------------- 1 | # Suggested Reading 2 | 3 | ## Mobile App Security 4 | 5 | ### Android 6 | 7 | - Dominic Chell, Tyrone Erasmus, Shaun Colley, Ollie Whitehous (2015) _Mobile Application Hacker's Handbook_. Wiley. Available at: 8 | - Joshua J. Drake, Zach Lanier, Collin Mulliner, Pau Oliva, Stephen A. Ridley, Georg Wicherski (2014) _Android Hacker's Handbook_. Wiley. Available at: 9 | - Godfrey Nolan (2014) _Bulletproof Android_. Addison-Wesley Professional. Available at: 10 | - Nikolay Elenkov (2014) _Android Security Internals: An In-Depth Guide to Android's Security Architecture_. No Starch Press. Available at: 11 | - Jonathan Levin (2015) _Android Internals :: A confectioners cookbook - Volume I: The power user's view_. Technologeeks.com. Available at: 12 | 13 | ### iOS 14 | 15 | - Charlie Miller, Dionysus Blazakis, Dino Dai Zovi, Stefan Esser, Vincenzo Iozzo, Ralf-Philipp Weinmann (2012) _iOS Hacker's Handbook_. Wiley. Available at: 16 | - David Thiel (2016) _iOS Application Security, The Definitive Guide for Hackers and Developers_. no starch press. Available at: 17 | - Jonathan Levin (2017), _Mac OS X and iOS Internals_, Wiley. Available at: 18 | 19 | ## Reverse Engineering 20 | 21 | - Bruce Dang, Alexandre Gazet, Elias Backaalany (2014) _Practical Reverse Engineering_. Wiley. Available at: 22 | - Skakenunny, Hangcom _iOS App Reverse Engineering_. Online. Available at: 23 | - Bernhard Mueller (2016) _Hacking Soft Tokens - Advanced Reverse Engineering on Android_. HITB GSEC Singapore. Available at: 24 | - Dennis Yurichev (2016) _Reverse Engineering for Beginners_. Online. Available at: 25 | - Michael Hale Ligh, Andrew Case, Jamie Levy, Aaron Walters (2014) _The Art of Memory Forensics._ Wiley. Available at: 26 | - Jacob Baines (2016) _Programming Linux Anti-Reversing Techniques_. Leanpub. Available at: 27 | -------------------------------------------------------------------------------- /Document/CHANGELOG.md: -------------------------------------------------------------------------------- 1 | # Changelog 2 | 3 | All our Changelogs are available online at the OWASP MASTG GitHub repository, see the Releases page: 4 | 5 | 6 | -------------------------------------------------------------------------------- /Document/Images/CC-license.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/CC-license.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x03/owasp-mobile-overview.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x03/owasp-mobile-overview.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04/frida.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04/frida.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04b/DevSecOpsProcess.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04b/DevSecOpsProcess.JPG -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04b/ExampleOfADevSecOpsProcess.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04b/ExampleOfADevSecOpsProcess.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04b/SDLCOverview.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04b/SDLCOverview.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04c/Ghidra_elf_import.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04c/Ghidra_elf_import.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04c/Ghidra_function_graph.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04c/Ghidra_function_graph.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04c/Ghidra_import_binary.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04c/Ghidra_import_binary.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04c/Ghidra_main_window.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04c/Ghidra_main_window.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04c/Ghidra_new_project.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04c/Ghidra_new_project.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04c/Ghidra_string_window.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04c/Ghidra_string_window.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04e/BurpIntruderInputList.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04e/BurpIntruderInputList.gif -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04e/BurpIntruderInputList.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04e/BurpIntruderInputList.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04e/BurpIntruderSuccessfulAttack.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04e/BurpIntruderSuccessfulAttack.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04e/abstract_oath2_flow.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04e/abstract_oath2_flow.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04e/zxcvbn.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04e/zxcvbn.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04f/BURP.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04f/BURP.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04f/architecture_MITM_AP.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04f/architecture_MITM_AP.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04f/bettercap.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04f/bettercap.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04f/burp_xamarin.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04f/burp_xamarin.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x04i/masa_framework.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x04i/masa_framework.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05a/Selection_003.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05a/Selection_003.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05a/android_software_stack.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05a/android_software_stack.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05a/apk-validation-process-v3-scheme.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05a/apk-validation-process-v3-scheme.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05a/apk-validation-process.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05a/apk-validation-process.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05a/binder.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05a/binder.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05a/java2oat.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05a/java2oat.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05a/java_vs_dalvik.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05a/java_vs_dalvik.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/Android_Wireshark.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/Android_Wireshark.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/FCM-notifications-overview.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/FCM-notifications-overview.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/FCM_Intercept.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/FCM_Intercept.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/android-advanced-options.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/android-advanced-options.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/android-cert-install.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/android-cert-install.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/android-confirm.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/android-confirm.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/android-downloads-app.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/android-downloads-app.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/android-modify-network.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/android-modify-network.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/android-proxy-hostname-port.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/android-proxy-hostname-port.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/android-proxy-manual.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/android-proxy-manual.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/android-settings.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/android-settings.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/android-studio-file-device-explorer.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/android-studio-file-device-explorer.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/android-wifi-on.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/android-wifi-on.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/android-wifi-settings.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/android-wifi-settings.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/android_ssl_pinning_bypass.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/android_ssl_pinning_bypass.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/burp-add-proxy.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/burp-add-proxy.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/burp-bind-port-and-address.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/burp-bind-port-and-address.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/burp-ca-certificate.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/burp-ca-certificate.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/burp-https-intercepted.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/burp-https-intercepted.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/burp-intercepted-request.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/burp-intercepted-request.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/burp-running-proxy.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/burp-running-proxy.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/emulator-proxy.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/emulator-proxy.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/emulator-proxy.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/emulator-proxy.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/log_output_Android_Studio.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/log_output_Android_Studio.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/mail-cert-download.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/mail-cert-download.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/mobsf_android.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/mobsf_android.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/mstg-network.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/mstg-network.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/r2_graphmode.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/r2_graphmode.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/r2_pd_10.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/r2_pd_10.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/r2_visualmode_disass.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/r2_visualmode_disass.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/r2_visualmode_hex.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/r2_visualmode_hex.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/server.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/server.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/sftp-with-filezilla.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/sftp-with-filezilla.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/string.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/string.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05b/tcpdump_and_wireshard_on_android.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05b/tcpdump_and_wireshard_on_android.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/Choose_Process.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/Choose_Process.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/Force_Step_Into.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/Force_Step_Into.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/Ghidra_decompiled_function.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/Ghidra_decompiled_function.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/IDA_open_file.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/IDA_open_file.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/JNI_interface.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/JNI_interface.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/MainActivity_verify.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/MainActivity_verify.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/anti_debug_anti_tamper_defeated.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/anti_debug_anti_tamper_defeated.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/archs.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/archs.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/check_input.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/check_input.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/crackme-1.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/crackme-1.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/crackme-1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/crackme-1.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/crackme-2.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/crackme-2.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/crackme-frida-1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/crackme-frida-1.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/custom_kernel.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/custom_kernel.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/debugger_detection.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/debugger_detection.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/debugger_detection.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/debugger_detection.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/delete_package.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/delete_package.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/developer-options.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/developer-options.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/developer-options.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/developer-options.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/disass_main_1874.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/disass_main_1874.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/drag_code.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/drag_code.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/file_exists_false.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/file_exists_false.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/final_structure.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/final_structure.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/frida_trace_native_functions.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/frida_trace_native_functions.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/fucntion_a_of_class_sg_vantagepoint_a.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/fucntion_a_of_class_sg_vantagepoint_a.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/ghidra_dex_strings.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/ghidra_dex_strings.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/graph_1874.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/graph_1874.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/graph_ifelse_1760.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/graph_ifelse_1760.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/helloworld.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/helloworld.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/helloworld.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/helloworld.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/helloworld_stringfromjni.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/helloworld_stringfromjni.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/intellij_new_project.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/intellij_new_project.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/jni_tracing_helloworldjni.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/jni_tracing_helloworldjni.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/loop_1784.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/loop_1784.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/method_breakpoint.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/method_breakpoint.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/modified_binary_name.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/modified_binary_name.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/patching-sslpinning.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/patching-sslpinning.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/pseudocode_1760.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/pseudocode_1760.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/refactored.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/refactored.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/sdk_manager.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/sdk_manager.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/secret_code.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/secret_code.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/set_breakpoint_and_attach_debugger.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/set_breakpoint_and_attach_debugger.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/set_value.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/set_value.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/sg_vantagepoint_uncrackable1_a_function_a.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/sg_vantagepoint_uncrackable1_a_function_a.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/step_out.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/step_out.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/step_over.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/step_over.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/success.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/success.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/syscall_hooking.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/syscall_hooking.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/values_compare_17dc.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/values_compare_17dc.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/variables.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/variables.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05c/waitfordebugger.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05c/waitfordebugger.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05d/1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05d/1.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05d/2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05d/2.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05d/3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05d/3.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05d/Android9_secure_key_import_to_keystore.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05d/Android9_secure_key_import_to_keystore.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05d/Android9_secure_key_import_to_keystore.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05d/Android9_secure_key_import_to_keystore.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05d/Dump_Java_Heap.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05d/Dump_Java_Heap.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05d/FirebaseScannerImage.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05d/FirebaseScannerImage.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05d/Package_Tree_View.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05d/Package_Tree_View.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05f/biometricprompt-architecture.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05f/biometricprompt-architecture.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05h/MobSF_Show_Components.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05h/MobSF_Show_Components.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05h/app-disambiguation.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05h/app-disambiguation.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x05j/proguard.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x05j/proguard.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06a/code_signing.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06a/code_signing.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06a/iOS_Folder_Structure.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06a/iOS_Folder_Structure.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06a/iOS_Security_Architecture.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06a/iOS_Security_Architecture.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06a/iOS_project_folder.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06a/iOS_project_folder.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/HopperDecompile.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/HopperDecompile.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/HopperDisassembling.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/HopperDisassembling.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/Passionfruit.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/Passionfruit.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/Passionfruit_Keychain.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/Passionfruit_Keychain.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/Passionfruit_files.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/Passionfruit_files.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/cydia.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/cydia.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/device_console.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/device_console.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/finder_ipad_view.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/finder_ipad_view.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/finder_unveil_udid.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/finder_unveil_udid.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/fridaStockiOS.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/fridaStockiOS.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/install_agent_1.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/install_agent_1.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/install_agent_2.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/install_agent_2.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/install_needle_agent.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/install_needle_agent.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/install_needle_agent.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/install_needle_agent.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/ios_ssl_pinning_bypass.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/ios_ssl_pinning_bypass.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/mobsf_ios.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/mobsf_ios.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/needle_agent.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/needle_agent.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/needle_agent.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/needle_agent.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/open_device_console.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/open_device_console.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/passionfruit_bundle_dir.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/passionfruit_bundle_dir.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/passionfruit_classes.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/passionfruit_classes.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/passionfruit_classes_detail.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/passionfruit_classes_detail.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/passionfruit_console_logs.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/passionfruit_console_logs.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/passionfruit_data_dir.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/passionfruit_data_dir.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/passionfruit_db_view.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/passionfruit_db_view.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/passionfruit_file_download.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/passionfruit_file_download.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/passionfruit_installed_apps.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/passionfruit_installed_apps.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/passionfruit_modules.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/passionfruit_modules.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/passionfruit_modules_detail.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/passionfruit_modules_detail.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/passionfruit_plist_view.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/passionfruit_plist_view.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/passionfruit_userdefaults.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/passionfruit_userdefaults.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/setBurpProxy.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/setBurpProxy.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/setProxyiDevice.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/setProxyiDevice.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06b/wireshark_filters.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06b/wireshark_filters.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/Cycript_Jailbreak.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/Cycript_Jailbreak.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/Cycript_Jailbreak_Passed.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/Cycript_Jailbreak_Passed.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/Cycript_bypass_Jailbreak.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/Cycript_bypass_Jailbreak.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/cycript_sample.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/cycript_sample.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/debugging_ghidra_breakpoint.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/debugging_ghidra_breakpoint.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/debugging_ghidra_image_base_address.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/debugging_ghidra_image_base_address.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/debugging_lldb_breakpoint_solution.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/debugging_lldb_breakpoint_solution.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/debugging_lldb_image_list.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/debugging_lldb_image_list.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/frida-xcode-log.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/frida-xcode-log.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/ida_macho_import.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/ida_macho_import.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/ida_main_window.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/ida_main_window.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/manual_reversing_app_home_screen.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/manual_reversing_app_home_screen.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/manual_reversing_app_home_screen2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/manual_reversing_app_home_screen2.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/manual_reversing_app_wrong_input.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/manual_reversing_app_wrong_input.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/manual_reversing_ghidra_buttonclick_decompiled.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/manual_reversing_ghidra_buttonclick_decompiled.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/manual_reversing_ghidra_function_graph.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/manual_reversing_ghidra_function_graph.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/manual_reversing_ghidra_native_disassembly.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/manual_reversing_ghidra_native_disassembly.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/manual_reversing_ghidra_objc_runtime_strings.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/manual_reversing_ghidra_objc_runtime_strings.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/manual_reversing_ghidra_strings.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/manual_reversing_ghidra_strings.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/manual_reversing_ghidra_symbol_tree.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/manual_reversing_ghidra_symbol_tree.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/manual_reversing_ghidra_viewdidload_decompile.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/manual_reversing_ghidra_viewdidload_decompile.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06c/uncrackable_sections.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06c/uncrackable_sections.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06d/bither_demo_enable_pin.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06d/bither_demo_enable_pin.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06d/bither_demo_imazing_1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06d/bither_demo_imazing_1.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06d/bither_demo_pin_screen.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06d/bither_demo_pin_screen.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06d/bither_demo_plist.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06d/bither_demo_plist.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06d/key_hierarchy_apple.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06d/key_hierarchy_apple.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06g/manual-server-trust-evaluation.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06g/manual-server-trust-evaluation.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/URL_scheme.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/URL_scheme.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/airdrop_openwith.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/airdrop_openwith.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/allowed_universal_link.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/allowed_universal_link.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/app_extensions_communication.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/app_extensions_communication.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/app_extensions_container_restrictions.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/app_extensions_container_restrictions.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/apple-app-site-association-file_validation.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/apple-app-site-association-file_validation.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/exploit_javascript_bridge.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/exploit_javascript_bridge.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/forbidden_universal_link.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/forbidden_universal_link.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/iGoat_opened_via_url_scheme.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/iGoat_opened_via_url_scheme.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/open_in_telegram_via_universallink.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/open_in_telegram_via_universallink.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/open_in_telegram_via_urlscheme.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/open_in_telegram_via_urlscheme.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/permission_request_alert.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/permission_request_alert.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/purpose_strings_xcode.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/purpose_strings_xcode.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/settings_allow_screen.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/settings_allow_screen.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/sfsafariviewcontroller.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/sfsafariviewcontroller.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/share_activity_sheet.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/share_activity_sheet.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/telegram_add_stickers_universal_link.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/telegram_add_stickers_universal_link.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/telegram_share_extension.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/telegram_share_extension.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/telegram_share_something.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/telegram_share_something.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06h/xcode_embed_app_extensions.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06h/xcode_embed_app_extensions.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06j/Android9_secure_key_import_to_keystore.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06j/Android9_secure_key_import_to_keystore.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06j/control-flow-flattening.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06j/control-flow-flattening.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06j/deviceISjailbroken.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06j/deviceISjailbroken.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06j/deviceisNOTjailbroken.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06j/deviceisNOTjailbroken.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06j/no_obfuscation.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06j/no_obfuscation.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06j/no_obfuscation.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06j/no_obfuscation.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06j/ptraceDisassembly.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06j/ptraceDisassembly.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06j/ptracePatched.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06j/ptracePatched.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06j/swiftshield_obfuscated.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06j/swiftshield_obfuscated.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06j/swiftshield_obfuscated.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06j/swiftshield_obfuscated.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06j/sysctlOriginal.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06j/sysctlOriginal.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x06j/sysctlPatched.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x06j/sysctlPatched.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x07b/blackbox-resiliency-testing.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x07b/blackbox-resiliency-testing.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x07b/boxplot.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x07b/boxplot.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x07b/multiprocess-fork-ptrace.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x07b/multiprocess-fork-ptrace.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x07c/ECB.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x07c/ECB.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x07c/EncryptionMode.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x07c/EncryptionMode.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x08a/jadx_copy_frida_snippet.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x08a/jadx_copy_frida_snippet.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x5e/EncryptionMode.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x5e/EncryptionMode.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x5e/static_encryption_key.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x5e/static_encryption_key.png -------------------------------------------------------------------------------- /Document/Images/Chapters/0x6f/biometric_auth_try_again.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x6f/biometric_auth_try_again.jpg -------------------------------------------------------------------------------- /Document/Images/Chapters/0x6f/boimetric_auth.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Chapters/0x6f/boimetric_auth.jpg -------------------------------------------------------------------------------- /Document/Images/Donators/donators.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Donators/donators.png -------------------------------------------------------------------------------- /Document/Images/GitHub_logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/GitHub_logo.png -------------------------------------------------------------------------------- /Document/Images/ISBN.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/ISBN.png -------------------------------------------------------------------------------- /Document/Images/OWASP_logo-bw.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/OWASP_logo-bw.png -------------------------------------------------------------------------------- /Document/Images/OWASP_logo_white.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/OWASP_logo_white.png -------------------------------------------------------------------------------- /Document/Images/Other/GitHub_logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Other/GitHub_logo.png -------------------------------------------------------------------------------- /Document/Images/Other/android-logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Other/android-logo.png -------------------------------------------------------------------------------- /Document/Images/Other/bsi-logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Other/bsi-logo.png -------------------------------------------------------------------------------- /Document/Images/Other/crest_logo.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Other/crest_logo.jpg -------------------------------------------------------------------------------- /Document/Images/Other/ioxt-logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Other/ioxt-logo.png -------------------------------------------------------------------------------- /Document/Images/Other/nist-logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Other/nist-logo.png -------------------------------------------------------------------------------- /Document/Images/Other/nowsecure-logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Other/nowsecure-logo.png -------------------------------------------------------------------------------- /Document/Images/Other/trusted-by-logos.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Other/trusted-by-logos.png -------------------------------------------------------------------------------- /Document/Images/Other/uncrackable-logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/Other/uncrackable-logo.png -------------------------------------------------------------------------------- /Document/Images/checklist_en_filled.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/checklist_en_filled.png -------------------------------------------------------------------------------- /Document/Images/license.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/license.jpg -------------------------------------------------------------------------------- /Document/Images/logo_circle.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/logo_circle.png -------------------------------------------------------------------------------- /Document/Images/masvs_cover.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/masvs_cover.png -------------------------------------------------------------------------------- /Document/Images/masvs_refactor.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/masvs_refactor.png -------------------------------------------------------------------------------- /Document/Images/mstg-cover-release-small.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/mstg-cover-release-small.jpg -------------------------------------------------------------------------------- /Document/Images/mstg_cover.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/mstg_cover.png -------------------------------------------------------------------------------- /Document/Images/open_website.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/open_website.png -------------------------------------------------------------------------------- /Document/Images/owasp_mas_header.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/owasp_mas_header.png -------------------------------------------------------------------------------- /Document/Images/slack_logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/slack_logo.png -------------------------------------------------------------------------------- /Document/Images/summit-team.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/summit-team.jpg -------------------------------------------------------------------------------- /Document/Images/summit_preview.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/summit_preview.jpg -------------------------------------------------------------------------------- /Document/Images/titlepage-small.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/titlepage-small.jpg -------------------------------------------------------------------------------- /Document/Images/twitter_logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Document/Images/twitter_logo.png -------------------------------------------------------------------------------- /Document/LANGUAGE-METADATA: -------------------------------------------------------------------------------- 1 | export LANGUAGE="en" 2 | export LANGUAGETEXT="" 3 | export TOC_TITLE="Table of Contents" -------------------------------------------------------------------------------- /Document/SUMMARY.md: -------------------------------------------------------------------------------- 1 | # Summary 2 | 3 | - [Frontispiece](0x02a-Frontispiece.md) 4 | - [OWASP MASVS and MASTG Adoption](0x02b-MASVS-MASTG-Adoption.md) 5 | - [Acknowledgments](0x02c-Acknowledgements.md) 6 | 7 | ## Overview 8 | 9 | - [Introduction to the OWASP Mobile Application Security Project](0x03-Overview.md) 10 | - [Mobile Application Taxonomy](0x04a-Mobile-App-Taxonomy.md) 11 | - [Mobile Application Security Testing](0x04b-Mobile-App-Security-Testing.md) 12 | 13 | ## General Mobile App Testing Guide 14 | 15 | - [Mobile App Authentication Architectures](0x04e-Testing-Authentication-and-Session-Management.md) 16 | - [Testing Network Communication](0x04f-Testing-Network-Communication.md) 17 | - [Cryptography in Mobile Apps](0x04g-Testing-Cryptography.md) 18 | - [Testing Code Quality](0x04h-Testing-Code-Quality.md) 19 | - [Tampering and Reverse Engineering](0x04c-Tampering-and-Reverse-Engineering.md) 20 | - [Testing User Privacy Protection](0x04i-Testing-User-Privacy-Protection.md) 21 | 22 | ## Android Testing Guide 23 | 24 | - [Platform Overview](0x05a-Platform-Overview.md) 25 | - [Android Basic Security Testing](0x05b-Basic-Security_Testing.md) 26 | - [Data Storage on Android](0x05d-Testing-Data-Storage.md) 27 | - [Android Cryptographic APIs](0x05e-Testing-Cryptography.md) 28 | - [Local Authentication on Android](0x05f-Testing-Local-Authentication.md) 29 | - [Android Network Communication](0x05g-Testing-Network-Communication.md) 30 | - [Android Platform APIs](0x05h-Testing-Platform-Interaction.md) 31 | - [Code Quality and Build Settings for Android Apps](0x05i-Testing-Code-Quality-and-Build-Settings.md) 32 | - [Tampering and Reverse Engineering on Android](0x05c-Reverse-Engineering-and-Tampering.md) 33 | - [Android Anti-Reversing Defenses](0x05j-Testing-Resiliency-Against-Reverse-Engineering.md) 34 | 35 | ## iOS Testing Guide 36 | 37 | - [Platform Overview](0x06a-Platform-Overview.md) 38 | - [iOS Basic Security Testing](0x06b-Basic-Security-Testing.md) 39 | - [Data Storage on iOS](0x06d-Testing-Data-Storage.md) 40 | - [iOS Cryptographic APIs](0x06e-Testing-Cryptography.md) 41 | - [Local Authentication on iOS](0x06f-Testing-Local-Authentication.md) 42 | - [iOS Network Communication](0x06g-Testing-Network-Communication.md) 43 | - [iOS Platform APIs](0x06h-Testing-Platform-Interaction.md) 44 | - [Code Quality and Build Settings for iOS Apps](0x06i-Testing-Code-Quality-and-Build-Settings.md) 45 | - [Tampering and Reverse Engineering on iOS](0x06c-Reverse-Engineering-and-Tampering.md) 46 | - [iOS Anti-Reversing Defenses](0x06j-Testing-Resiliency-Against-Reverse-Engineering.md) 47 | 48 | ## Appendix 49 | 50 | - [Testing Tools](0x08a-Testing-Tools.md) 51 | - [Reference Applications](0x08b-Reference-Apps.md) 52 | - [Suggested Reading](0x09-Suggested-Reading.md) 53 | -------------------------------------------------------------------------------- /Document/cover.md: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /Document/metadata.md: -------------------------------------------------------------------------------- 1 | --- 2 | # This is the main metadata file. 3 | # Variables below can be overwritten by the local metadata 4 | # file (e.g. Document-fr/metadata.md) 5 | 6 | # Custom Template variables (cover, first page, etc.) 7 | version: 'SNAPSHOT' # this will overridden at build time 8 | languagetext: '' 9 | 10 | mainfont: 'DejaVu Sans' 11 | sansfont: 'DejaVu Sans' 12 | monofont: 'DejaVu Sans Mono' 13 | 14 | # General variables 15 | toc: true 16 | toc-depth: 2 17 | # numbersections: true 18 | # secnumdepth: 2 19 | linkcolor: blue 20 | 21 | # Language variables 22 | lang: 'en' 23 | 24 | # Latex variables 25 | 26 | # Eisvogel Latex variables 27 | # https://github.com/Wandmalfarbe/pandoc-latex-template#custom-template-variables 28 | code-block-font-size: '\tiny' 29 | 30 | table-use-row-colors: true 31 | geometry: "top=1cm,left=1cm,right=2cm,bottom=4cm" 32 | --- 33 | -------------------------------------------------------------------------------- /Document/metadata.yml: -------------------------------------------------------------------------------- 1 | language: 'en' 2 | languagetext: '' 3 | toc_title: 'Table of Contents' 4 | -------------------------------------------------------------------------------- /OWASP_logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/OWASP_logo.png -------------------------------------------------------------------------------- /PULL_REQUEST_TEMPLATE.md: -------------------------------------------------------------------------------- 1 | Thank you for submitting a Pull Request to the OWASP MASTG. Please make sure that: 2 | 3 | - [ ] Your contribution is written in the 2nd person (e.g. you) 4 | - [ ] Your contribution is written in an active present form for as much as possible. 5 | - [ ] You have made sure that the reference section is up to date (e.g. please add sources you have used, make sure that the references to MITRE/MASVS/etc. are up to date) 6 | - [ ] Your contribution has proper formatted markdown and/or code 7 | - [ ] Any references to website have been formatted as [TEXT](URL “NAME”) 8 | - [ ] You verified/tested the effectiveness of your contribution (e.g.: is the code really an effective remediation? Please verify it works!) 9 | 10 | If your PR is related to an issue. Please end your PR test with the following line: 11 | This PR closes #< insert number here >. 12 | -------------------------------------------------------------------------------- /Samples/Android/01_HelloWorld-JNI/HelloWord-JNI.apk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Samples/Android/01_HelloWorld-JNI/HelloWord-JNI.apk -------------------------------------------------------------------------------- /Samples/Android/02_CertificatePinning/certificatePinningXamarin.apk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/Samples/Android/02_CertificatePinning/certificatePinningXamarin.apk -------------------------------------------------------------------------------- /Samples/Android/02_CertificatePinning/readme.md: -------------------------------------------------------------------------------- 1 | Samples APKs for Certificate Pinning implementations. 2 | -------------------------------------------------------------------------------- /Templates/testcase.md: -------------------------------------------------------------------------------- 1 | ### OMTG-[IDENTIFIER]:[Name] 2 | 3 | #### Overview 4 | 5 | [Provide a general description of the issue.] 6 | 7 | #### Static Analysis 8 | 9 | [Describe how to assess this given either the source code or installer package (APK/IPA/etc.), but without running the app. Tailor this to the general situation (e.g., in some situations, having the decompiled classes is just as good as having the original source, in others it might make a bigger difference). If required, include a subsection about how to test with or without the original sources.] 10 | [Describe the best practices that developers should follow to prevent this issue.] 11 | 12 | #### Dynamic Analysis 13 | 14 | [Describe how to test for this issue by running and interacting with the app. This can include everything from simply monitoring network traffic or aspects of the app’s behavior to code injection, debugging, instrumentation, etc.] 15 | [Describe the best practices that developers should follow to prevent this issue.] 16 | 17 | 18 | #### References 19 | 20 | ##### OWASP Mobile Top 10 2016 21 | 22 | - MX - Title - Link 23 | - M3 - Insufficient Transport Layer Protection - 24 | 25 | ##### OWASP MASVS 26 | 27 | - VX.Y: "Requirement text, e.g. 'the keyboard cache is disabled on text inputs that process sensitive data'." 28 | 29 | ##### CWE 30 | 31 | - CWE-XXX - Title 32 | - CWE-312 - Cleartext Storage of Sensitive Information 33 | -------------------------------------------------------------------------------- /book.json: -------------------------------------------------------------------------------- 1 | { 2 | "root" : "./Document", 3 | "plugins" : [ "anchors" ], 4 | 5 | "structure": { 6 | "readme": "0x01-Foreword.md" 7 | }, 8 | "title" : "OWASP Mobile Application Security Testing Guide", 9 | "language": "en", 10 | "description" : "The MASTG is a comprehensive manual for mobile app security testing and reverse engineering for iOS and Android mobile security testers with the following content: 1. Mobile platform internals 2. Security testing in the mobile app development life cycle 3. Basic static and dynamic security testing 4. Mobile app reverse engineering and tampering 5. Assessing software protections 6. Detailed test cases that map to the requirements in the MASVS." 11 | 12 | 13 | } 14 | -------------------------------------------------------------------------------- /cover.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/cover.pdf -------------------------------------------------------------------------------- /cover.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/cover.png -------------------------------------------------------------------------------- /docs/CNAME: -------------------------------------------------------------------------------- 1 | mas.owasp.org -------------------------------------------------------------------------------- /docs/MASTG.md: -------------------------------------------------------------------------------- 1 | # OWASP MASTG 2 | 3 | 4 | 5 | :material-github: GitHub Repo 6 | 7 | Previously known as OWASP MSTG (Mobile Security Testing Guide) 8 | 9 | The **OWASP Mobile Application Security Testing Guide (MASTG)** is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the controls listed in the [OWASP MASVS](MASVS.md). 10 | 11 |
12 | 13 | [:material-download: Download the MASTG](https://github.com/OWASP/owasp-mastg/releases/latest/download/OWASP_MASTG-v1.5.0.pdf){ .md-button .md-button--primary } 14 | 15 |
16 | 17 | :blue_heart:{ .pump } Support the project by purchasing the [OWASP MASTG on leanpub.com](https://leanpub.com/owasp-mastg). All funds raised through sales of this book go directly into the project budget and will be used to for technical editing and designing the book and fund production of future releases. 18 | 19 | > :material-translate: The OWASP MASTG is only available in English but you can get both the [OWASP MASVS](MASVS.md) and the [MAS Checklist](MAS_checklist.md) in other languages. 20 | 21 |
22 | -------------------------------------------------------------------------------- /docs/MASVS.md: -------------------------------------------------------------------------------- 1 | # OWASP MASVS 2 | 3 | 4 | 5 | :material-github: GitHub Repo 6 | 7 | The **OWASP MASVS (Mobile Application Security Verification Standard)** is the industry standard for mobile app security. It can be used by mobile software architects and developers seeking to develop secure mobile applications, as well as security testers to ensure completeness and consistency of test results. 8 | 9 |
10 | 11 | [:material-download: Download the MASVS](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-en.pdf){ .md-button .md-button--primary } 12 | 13 |
14 | 15 | :warning: HELP WANTED: We're currently refactoring the MASVS to bring it to version 2.0. This is a community effort and you can also participate. Take a look at it and give your feedback using the button below. 16 | 17 | [:material-open-in-new: MASVS Refactoring](https://github.com/OWASP/owasp-masvs/discussions/categories/big-masvs-refactoring){ .md-button } 18 | 19 |
20 | 21 | > :material-translate: The OWASP MASVS is also available in [other languages](https://github.com/OWASP/owasp-masvs#masvs-translations). Is your language not here? We'd love to [add it](contributing/4_Add_new_Language.md)! 22 | > 23 | > :material-download: Download international PDFs: 24 | > 25 | > [Deutsch](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-de.pdf) | 26 | > [Español](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-es.pdf) | 27 | > [François](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-fr.pdf) | 28 | > [فارسى](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-fa.pdf) | 29 | > [हिन्दी](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-hi.pdf) | 30 | > [日本語](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-ja.pdf) | 31 | > [한국어](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-ko.pdf) | 32 | > [português (br)](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-ptbr.pdf) | 33 | > [português (pt)](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-ptpt.pdf) | 34 | > [Русский](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-ru.pdf) | 35 | > [中文 (cn)](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-zhcn.pdf) | 36 | > [中文 (tw)](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-zhtw.pdf) 37 | 38 |
39 | -------------------------------------------------------------------------------- /docs/MAS_checklist.md: -------------------------------------------------------------------------------- 1 | --- 2 | hide: 3 | - navigation 4 | - toc 5 | --- 6 | 7 | # OWASP MAS Checklist 8 | 9 | 10 | 11 | The OWASP Mobile Application Security Checklist contains links to the MASTG test case for each MASVS requirement. 12 | 13 | - **Security Assessments / Pentests**: ensure you're at least covering the standard attack surface and start exploring. 14 | - **Standard Compliance**: includes MASVS and MASTG versions and commit IDs 15 | - **Learn & practice** your mobile security skills. 16 | - **Bug Bounties**: go step by step covering the mobile attack surface. 17 | 18 |
19 | 20 | [:material-download: Download the MAS Checklist](https://github.com/OWASP/owasp-mastg/releases/latest/download/Mobile_App_Security_Checklist_en.xlsx){ .md-button .md-button--primary } 21 | 22 |
23 | 24 | > :material-translate: The OWASP MAS Checklist is also available in [other languages](https://github.com/OWASP/owasp-masvs#masvs-translations). Is your language not here? We'd love to [add it](contributing/4_Add_new_Language.md)! 25 | > 26 | > :material-download: Download international PDFs: 27 | > 28 | > [Deutsch](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-de.pdf) | 29 | > [Español](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-es.pdf) | 30 | > [François](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-fr.pdf) | 31 | > [فارسى](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-fa.pdf) | 32 | > [हिन्दी](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-hi.pdf) | 33 | > [日本語](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-ja.pdf) | 34 | > [한국어](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-ko.pdf) | 35 | > [português (br)](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-ptbr.pdf) | 36 | > [português (pt)](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-ptpt.pdf) | 37 | > [Русский](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-ru.pdf) | 38 | > [中文 (cn)](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-ptbr.pdf) | 39 | > [中文 (tw)](https://github.com/OWASP/owasp-masvs/releases/latest/download/OWASP_MASVS-v1.4.2-ptpt.pdf) 40 | 41 |
42 | -------------------------------------------------------------------------------- /docs/assets/GitHub_logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/assets/GitHub_logo.png -------------------------------------------------------------------------------- /docs/assets/OWASP_logo_white.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/assets/OWASP_logo_white.png -------------------------------------------------------------------------------- /docs/assets/carlos.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/assets/carlos.jpg -------------------------------------------------------------------------------- /docs/assets/checklist_en_filled.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/assets/checklist_en_filled.png -------------------------------------------------------------------------------- /docs/assets/comment-marked-as-answer.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/assets/comment-marked-as-answer.png -------------------------------------------------------------------------------- /docs/assets/donations/donators.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/assets/donations/donators.png -------------------------------------------------------------------------------- /docs/assets/donations/mastg_donation_form.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/assets/donations/mastg_donation_form.png -------------------------------------------------------------------------------- /docs/assets/donations/owasp_donation_form.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/assets/donations/owasp_donation_form.png -------------------------------------------------------------------------------- /docs/assets/hover-comment-icon.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/assets/hover-comment-icon.gif -------------------------------------------------------------------------------- /docs/assets/logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/assets/logo.png -------------------------------------------------------------------------------- /docs/assets/logo_circle.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/assets/logo_circle.png -------------------------------------------------------------------------------- /docs/assets/mastg_cover.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/assets/mastg_cover.png -------------------------------------------------------------------------------- /docs/assets/masvs_cover.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/assets/masvs_cover.png -------------------------------------------------------------------------------- /docs/assets/news/mas-rebranding.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/assets/news/mas-rebranding.png -------------------------------------------------------------------------------- /docs/assets/release_header.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/assets/release_header.png -------------------------------------------------------------------------------- /docs/assets/starring.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/assets/starring.png -------------------------------------------------------------------------------- /docs/assets/suggestion-block.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/assets/suggestion-block.png -------------------------------------------------------------------------------- /docs/assets/sven.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/assets/sven.jpg -------------------------------------------------------------------------------- /docs/assets/trusted-by-logos.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/assets/trusted-by-logos.png -------------------------------------------------------------------------------- /docs/contact.md: -------------------------------------------------------------------------------- 1 | # 💬 Connect with Us 2 | 3 | 4 | 5 | You can follow and reach out to the OWASP MAS team in many ways. 6 | 7 | - Send us your questions and ideas to GitHub Discussions 8 | - Stay always up-to-date by following us on Twitter. 9 | - Join our Slack community 10 | 11 | If you'd like to contribute, take a look at our [Contributions page](contributing.md) or reach out to the project leaders Carlos or Sven. 12 | 13 | [:material-github:](https://github.com/OWASP/owasp-mastg/discussions) 14 | [:material-twitter:](https://twitter.com/OWASP_MAS) 15 | [:material-slack:](https://owasp.slack.com/archives/C1M6ZVC6S) 16 | 17 | > [Request an invitation](https://owasp.slack.com/join/shared_invite/zt-g398htpy-AZ40HOM1WUOZguJKbblqkw#) to join our Slack channel `#project-mobile-app-security` 18 | 19 |
20 | 21 | ## OWASP MAS Project Leaders 22 | 23 | ## Carlos Holguera 24 | 25 | 26 | 27 | Carlos is a mobile security research engineer who has gained many years of hands-on experience in the field of security testing for mobile apps and embedded systems such as automotive control units and IoT devices. He is passionate about reverse engineering and dynamic instrumentation of mobile apps and is continuously learning and sharing his knowledge. 28 | 29 | [:material-github:](https://github.com/cpholguera) 30 | [:material-twitter:](https://twitter.com/grepharder) 31 | [:material-slack:](https://owasp.slack.com/team/U5LRFEGR5) 32 | [:material-email:](mailto:Carlos.Holguera@owasp.org) 33 | [:material-linkedin:](https://linkedin.com/in/carlos-holguera) 34 | 35 |
36 | 37 | ## Sven Schleier 38 | 39 | 40 | 41 | Sven is an experienced web and mobile penetration tester and assessed everything from historic Flash applications to progressive mobile apps. He is also a security engineer that supported many projects end-to-end during the SDLC to "build security in". He was speaking at local and international meetups and conferences and is conducting hands-on workshops about web application and mobile app security. 42 | 43 | [:material-github:](https://github.com/sushi2k) 44 | [:material-twitter:](https://twitter.com/bsd_daemon) 45 | [:material-slack:](https://owasp.slack.com/team/U1M6X5WCU) 46 | [:material-email:](mailto:Sven.Schleier@owasp.org) 47 | [:material-linkedin:](https://linkedin.com/in/sven-schleier) 48 | 49 |
50 | -------------------------------------------------------------------------------- /docs/contributing.md: -------------------------------------------------------------------------------- 1 | # Contributing to the MAS Project 2 | 3 | _First of all,_ [⭐ Give us a Star in GitHub](https://github.com/OWASP/owasp-mastg)! 4 | 5 | 6 | 7 |
8 | 9 | The MAS project is an open source effort and we welcome all kinds of contributions and feedback. 10 | 11 | **Help us improve & join our community:** 12 | 13 | - 🐞 [Report an error (typos, grammar)](contributing/1_How_Can_You_Contribute.md#create-issues) or [fix it on a Pull Request](contributing/1_How_Can_You_Contribute.md#open-a-pull-request). 14 | - 💬 Give feedback ([MASTG](https://github.com/OWASP/owasp-mastg/discussions/categories/general)/[MASVS](https://github.com/OWASP/owasp-masvs/discussions/categories/general)). 15 | - 🙏 Ask questions ([MASTG](https://github.com/OWASP/owasp-mastg/discussions/categories/q-a)/[MASVS](https://github.com/OWASP/owasp-masvs/discussions/categories/q-a)). 16 | 17 | **Contribute with content:** 18 | 19 | - 💡 Propose ideas or suggest improvements ([MASTG](https://github.com/OWASP/owasp-mastg/discussions/categories/ideas)/[MASVS](https://github.com/OWASP/owasp-masvs/discussions/categories/ideas)). If it qualifies we'll promote it to an Issue. 20 | - 📄 [Create a Pull Request](contributing/1_How_Can_You_Contribute.md#open-a-pull-request) for concrete fixes (e.g. grammar/typos) or content already approved by the core team. 21 | 22 | Before you start contributing, please check our pages ["How Can You Contribute?"](contributing/1_How_Can_You_Contribute.md) and ["Getting Started"](contributing/2_Getting_Started.md). If you have any doubts [please contact us](contact.md). 23 | 24 | ## Contribution Credit / Acknowledgments 25 | 26 | Contributors are added to the acknowledgments section based on their contributions logged by GitHub and/or by applying to a certain role and consistently demonstrating their commitment. Acknowledgements are visible in: 27 | 28 | - [OWASP MASTG Authors & Co-Authors sections](MASTG/Intro/0x02a-Frontispiece.md#authors) 29 | - [OWASP MASTG Contributors section](MASTG/Intro/0x02c-Acknowledgements.md#contributors) 30 | - [OWASP MASTG printed version](https://www.lulu.com/shop/jeroen-willemsen-and-sven-schleier-and-bernhard-müller-and-carlos-holguera/owasp-mobile-security-testing-guide/paperback/product-1kw4dp4k.html) 31 | 32 | Contributors are categorized as follows: 33 | 34 | - **Project Leader / Author**: Manage the development of the guide continuously and write a large amount of new content. Project Leadership cannot be achieved if any violations of the Code of Conduct occurred in the past. Be aware that you'll be expected to invest lots of time over several months. 35 | - **Reviewer**: People that continuously monitor and review our [Pull Requests](https://github.com/OWASP/owasp-mastg/pulls) or given useful feedback and suggesting changes. 36 | - **Most Helpful Discussions contributor**: actively participate in our GitHub Discussions. Contributors with the most answers marked as "The Answer" will get recognized as "Most Helpful" in our official repos. 37 | - **Co-Author**: Consistently contribute quality content, [at least 2,000 additions logged](https://github.com/OWASP/owasp-mastg/graphs/contributors "Co-author"). 38 | - **Top Contributor**: Consistently contribute quality content, [at least 500 additions logged](https://github.com/OWASP/owasp-mastg/graphs/contributors "Top Contributor"). 39 | - **Contributor**: Any form of contribution, [at least 50 additions logged](https://github.com/OWASP/owasp-mastg/graphs/contributors "Contributor"). 40 | - **Mini-contributor**: Everything below 50 additions, e.g. committing a single word or sentence. 41 | 42 | [Contact us](contact.md) if you are planning to become an Author/Co-Author/Reviewer, are missing from the acknowledgements (note that we make updates frequently, but not in realtime). 43 | 44 | ## 🚫 What not to do 45 | 46 | Although we greatly appreciate any and all contributions to the project, there are a few things that you should take into consideration: 47 | 48 | - **No advertisement**: The OWASP mobile Security Project cannot be used as a platform for advertisement of commercial tools, companies or individuals. Technical content such as the implementation of certain techniques or tests should be written with free and open-source tools in mind. Commercial tools are typically not accepted, but might be referenced in some specific cases. 49 | - **No unnecessary self-promotion of tools or blog posts**: If you have a relation with one of the URLs or tools you are referencing, please state so in the PR so that we can verify that the reference is in line with the rest of the guide. 50 | 51 | Please be sure to take a careful look at our [Code of Conduct](https://github.com/OWASP/owasp-mastg/blob/master/CODE_OF_CONDUCT.md "Code of Conduct") for all the details and [ask us](contact.md) in case of doubt. 52 | 53 |
54 | -------------------------------------------------------------------------------- /docs/contributing/1_How_Can_You_Contribute.md: -------------------------------------------------------------------------------- 1 | # How Can You Contribute? 2 | 3 | You can directly contribute to the MASVS or MASTG in many different ways! First, go ahead and create a GitHub account for free on the [GitHub homepage](https://github.com/). 4 | 5 | ## Contribution Flow 6 | 7 | ```mermaid 8 | flowchart LR 9 | A(Open Discussion) -->|discuss| C{qualifies?} 10 | C -->|Yes| D(Issue) 11 | C -->|No| E[Close] 12 | D -->|open PR| F(Pull Request) 13 | F -->|review| G{approved?} 14 | F -->|make changes| F 15 | G -->|Yes| H[Merge] 16 | G -->|No| I[Close] 17 | ``` 18 | 19 | ## 💬 Participate in Discussions 20 | 21 | Our GitHub [Discussions](https://github.com/OWASP/owasp-mastg/discussions) are the first place to go to ask questions, give feedback, and propose new ideas. If your proposal qualifies for the MASTG/MASVS, we'll convert it into an "Issue" (the discussion might take a while). 22 | 23 | ## 🎯 Create Issues 24 | 25 | Before creating a PR, first create an [Issue](https://github.com/OWASP/owasp-masvs/issues "MASVS Issues") to be discussed for missing requirements, content or errors. 26 | 27 | - To avoid multiple people duplicating effort on the same issue, project leaders will assign it to only a few that will own it. 28 | - Explain what you think is missing in the issue, including references (if available) and suggest where it could be added. 29 | 30 | ## 📝 Open a Pull Request 31 | 32 | You can contribute with content or corrections by opening a Pull Request (PR). 33 | 34 | - Your PR may be merged after review. 35 | - Be sure to follow our [style guide](5_Style_Guide.md) when writing content. 36 | 37 | > Learn how to open a PR [here](3_PRs_and_Reviews.md#how-to-open-a-pr). 38 | 39 | ## ✅ Become a Reviewer 40 | 41 | You can [Review Pull Requests (PRs)](https://github.com/OWASP/owasp-masvs/pulls) and also gain contributions. If you are a fluent speaker in any of the different languages that the MASVS is available in, feel free to give feedback on any of the submitted PRs. 42 | 43 | After your PR or issue has been submitted, we will review it as quickly as possible which typically only takes a few days. If you think we have forgotten about it, feel free to give us a nudge after 7 days have passed. 44 | 45 | > Learn how to review a PR [here](3_PRs_and_Reviews.md#how-to-review-a-pr). 46 | 47 | ## 🔎 Proof-reading 48 | 49 | If you do proof-reading, these are the things we’re looking for: 50 | 51 | - Content [cohesion & coherence](https://writing.chalmers.se/chalmers-writing-guide/writing-a-text/coherence-cohesion/) 52 | - is there a good linkage of ideas? 53 | - does the paragraph make sense? 54 | - does it make sense with the next one? think that hundreds of people have written in here, often without considering the surroundings of the text they were including). 55 | - Reducing the content to a minimum (people tend to be very verbose/wordy) and in such a document we need clear and short/concise statements 56 | - Optimize for _scannability_ (maybe instead of a big paragraph it would be better to have a bullet point list). 57 | - Any passive voice sentences? Convert to active voice. 58 | - Does each paragraph focus on a single topic? 59 | - Are key points stated at the start of each section? 60 | - Are commas, parentheses, colons, em-dashes, and semicolons used properly? 61 | 62 | Refer to Google Technical Writing trainings for more info: 63 | 64 | - [Google Technical Writing One](https://developers.google.com/tech-writing/one) 65 | - [Google Technical Writing Two](https://developers.google.com/tech-writing/two) 66 | 67 | ## 🌐 Translating the MASVS 68 | 69 | Translating the MASVS in a new language is another great way to contribute. This helps the project to reach to more people around the world. 70 | 71 | Before starting a translation please consider the following: 72 | 73 | - **First of all** contact us on Slack or via email. 74 | - We need your commitment. After the first translation is done, we will ask for your help to translate any new changes, so your translation can remain up to date. 75 | - We need a second translator who can verify that the English version of the MASVS has been translated properly. 76 | - Once you are all set, go to your fork and follow [these steps](4_Add_new_Language.md). 77 | -------------------------------------------------------------------------------- /docs/contributing/3_PRs_and_Reviews.md: -------------------------------------------------------------------------------- 1 | # Pull Requests & Reviews 2 | 3 | ## How to Open a PR 4 | 5 | You can create a Pull Request (PR) by following [these steps](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request-from-a-fork). Remember that: 6 | 7 | - The target branch should be `master`. 8 | - If your PR closes and issue, write ["Closes `#`"](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue). 9 | 10 | Your PR will be reviewed soon (refer to this page to learn more about [reviews](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews)). 11 | 12 | > Before opening a PR please **self-review your changes in GitHub** and ensure that you follow our [style guide](5_Style_Guide.md) to speed up the review process⚡ 13 | 14 | ## How to Incorporate the Reviewer's Feedback to your PR 15 | 16 | It might be directly approved and merged or one of our reviewers will send you some comments and suggested changes. 17 | 18 | When reviewers suggest changes in a pull request, you can automatically incorporate the changes into your PR. 19 | 20 | - [Apply any Suggested Changes](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/incorporating-feedback-in-your-pull-request#applying-suggested-changes) using the "Commit suggestions" button. 21 | - In order to process a comment, simply make modifications directly to your branch and push normally. GitHub will automatically detect these changes and add them to your existing PR. 22 | - As you update your PR and apply changes, mark each conversation as [resolved](https://docs.github.com/en/github/collaborating-with-issues-and-pull-requests/commenting-on-a-pull-request#resolving-conversations). 23 | - If you run into any merge issues, [refer to this page](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/addressing-merge-conflicts/about-merge-conflicts) to learn how to resolve them. 24 | 25 | > NOTE: Remember to regularly [sync your fork](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork) with the upstream repo. This gets you the latest changes and makes easier to merge your PR. 26 | > 27 | > ```bash 28 | > git pull upstream/master 29 | > ``` 30 | > 31 | 32 | ## How to Review a PR 33 | 34 | If you'd like to review an open PR please follow these steps: 35 | 36 | ### Step 1: Comment and Suggest Changes 37 | 38 | You can enter single or multi-line comments (click and drag to select the range of lines): 39 | 40 | 41 | 42 | **Always prefer making "Suggested Changes"** using the `±` button: 43 | 44 | 45 | 46 | If the suggestion you'd like to make cannot be expressed using "suggested changes" please enter a clear comment explaining what should be fixed (e.g. some paragraphs don't link properly or some essential information cannot be found and should be added). 47 | 48 | > Using "Suggested Changes" saves you as a reviewer and the PR author a lot of time. And you get _points_ (attributions) for the changes that you suggested (if the author commits them you become a co-author of those commits). If you're constant with your reviewer work you can apply to be recognize as an official reviewer in our Acknowledgements page. 49 | 50 | ### Step 2: Submit your Review 51 | 52 | Once you went through the whole PR you can [submit your review](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request#submitting-your-review) 53 | 54 | 1. Click on "Review changes". 55 | 2. Enter a comment for the contributor. 56 | 3. Select the type of review you'd like to leave (Comment, Approve or Request Changes). 57 | 4. Click on "Submit review". 58 | 59 | > Learn more: ["(GitHub Docs) Reviewing proposed changes in a pull request"](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request). 60 | -------------------------------------------------------------------------------- /docs/contributing/4_Add_new_Language.md: -------------------------------------------------------------------------------- 1 | # Add a New Language 2 | 3 | ## MASTG Translations 4 | 5 | The MASTG is a living document that changes and adapts to the most recent security recommendations every day. While we do want to reach the maximum audience possible, our past experience shows that **maintaining translations has proven to be an extremely challenging task**. Therefore, please understand that **any PRs containing MASTG translations will be declined**, but you're free to do them on your own forks. 6 | 7 | > 🇯🇵 A translation of the MASTG into Japanese is available on Github: . Thanks to @coky-t for pushing this forward! 8 | 9 | That said, we **strongly encourage further translations of the MASVS as it is much easier to maintain and you'll get a translated [Mobile App Security Checklists](https://github.com/OWASP/owasp-mastg/releases/latest) mapping to the MASTG for free. 10 | 11 | ## MASVS Translations 12 | 13 | To add a new language you have to follow the steps from both sections below. 14 | 15 | 1. Create a folder with the language of choice, e.g. `Document-ja`. 16 | 2. Copy an existing `metadata.md` from another language and modify it for the new language. 17 | 3. Add the language to the list of languages in `export.py` 18 | 4. Update `.github/workflows/docgenerator.yml` and add the action steps for the new language. 19 | 5. Update `../LANGS.md` to include the new language. 20 | 6. Extend the `../README.md` with the newly available language. 21 | 7. Release the MASVS. 22 | 23 | ## In the MASTG 24 | 25 | IMPORTANT: only after releasing the MASVS! 26 | 27 | 1. Add the new language to `tools/scripts/gen_all_excel.sh`. 28 | 2. Push and verify that the new Checklist is correctly generated for the new language. 29 | -------------------------------------------------------------------------------- /docs/contributing/6_Add_a_Crackme.md: -------------------------------------------------------------------------------- 1 | # Add a Crackme 2 | 3 | The MAS project is a powerful learning resource and the MAS Crackmes are no exception. They allow the MAS community not only to practice the MAS skills they've learned from the MASTG but also let them confirm their approaches to the used techniques, especially when performing reverse engineering. 4 | 5 | ## Who Can Contribute with a Crackme? 6 | 7 | Anyone from individuals to companies. You only have to read and accepts the Terms and Conditions listed below. 8 | 9 | **Before submitting a crackme**, first of all contact the MAS team here: 10 | 11 | ## Terms and Conditions 12 | 13 | If you want to contribute to the MAS crackmes please consider that: 14 | 15 | ☑️ The source code of the crackme apps must be made publicly available at . 16 | 17 | ☑️ The crackme apps must be reviewed and approved by the MAS project leaders. Some form of documentation and solution writeup/video must be provided for the review process. That must include a list of "features" including techniques used (e.g. obfuscation, whitebox crypto, inline assembly, etc.) 18 | 19 | ☑️ The crackme apps must not contain any company branding or advertising material (ads, company URL, etc.). 20 | 21 | ☑️ The crackme apps must align with the MASVS and MASTG in some way. 22 | 23 | ☑️ The crackme authors are fully responsible for the maintenance of the crackme in the case bugfixes or updates are needed and the MAS team is not able to perform those actions. 24 | 25 | ## Publishing and Acknowledgements 26 | 27 | When successfully adding a crackme, its authors will be credited in the corresponding crackme page in the project website at and an announcement will be made via the official MAS social media channels. 28 | 29 | ## OWASP Openness and Licencing Guidelines 30 | 31 | The OWASP projects have a strong foundation in openness and this includes all material related to the projects. 32 | 33 | > OWASP Projects must be open in all facets, including source material, contributors, organizational structure, and finances (if any). Project source code (if applicable) must be made openly available, project communication channels (e.g. mailing lists, forums) should be open and free from censorship, and all project materials must be licensed under a community friendly license as approved by the Free Software Foundation ([Appendix 8.2](https://owasp.org/www-pdf-archive/PROJECT_LEADER-HANDBOOK_2014.pdf)). 34 | 35 | Please refer to the OWASP Project Leader Handbook that we as project leaders need to comply with: https://owasp.org/www-pdf-archive/PROJECT_LEADER-HANDBOOK_2014.pdf 36 | -------------------------------------------------------------------------------- /docs/crackmes/iOS.md: -------------------------------------------------------------------------------- 1 | # iOS Crackmes 2 | 3 | ## iOS UnCrackable L1 4 | 5 | A secret string is hidden somewhere in this binary. Find a way to extract it. The app will give you a hint when started. 6 | 7 | Download 8 | 9 | ??? info "Installation" 10 | Open the "Device" window in Xcode and drag the IPA file into the list below "Installed Apps". 11 | 12 | Note: The IPA is signed with an Enterprise distribution certificate. You'll need to install the provisioning profile and trust the developer to run the app the "normal" way. Alternatively, re-sign the app with your own certificate, or run it on a jailbroken device (you'll want to do one of those anyway to crack it). 13 | 14 | ??? danger "SPOILER (Solutions)" 15 | - [Multiple solutions by David Weinstein](https://www.nowsecure.com/blog/2017/04/27/owasp-ios-crackme-tutorial-frida/ "Solutions by David Weinstein"). 16 | - [Solution by Ryan Teoh](http://www.ryantzj.com/cracking-owasp-mstg-ios-crackme-the-uncrackable.html "Solution by Ryan Teoh"). 17 | - [Solution with Angr by Vikas Gupta](https://serializethoughts.com/2019/10/28/solving-mstg-crackme-angr "Solving iOS UnCrackable 1 Crackme Without Using an iOS Device"). 18 | - [Solution by Pietro Oliva](https://0xsysenter.github.io/ios/reversing/arm64/mobile/ipa/frida/instrumentation/crackme/2021/01/09/ios-apps-reverse-engineering-solving-crackmes-part-1.html "Solution by Pietro Oliva"). 19 | 20 | 21 | By [Bernhard Mueller](https://github.com/muellerberndt "Bernhard Mueller") 22 | 23 | 24 | ## iOS UnCrackable L2 25 | 26 | This app holds a secret inside - and this time it won't be tampered with! 27 | 28 | Hint: it is related to alcoholic beverages. 29 | 30 | Download 31 | 32 | ??? info "Installation" 33 | Open the "Device" window in Xcode and drag the IPA file into the list below "Installed Apps". 34 | 35 | Note 1: The IPA is signed with an Enterprise distribution certificate. You'll need to install the provisioning profile and trust the developer to run the app the "normal" way. Alternatively, re-sign the app with your own certificate, or run it on a jailbroken device (you'll want to do one of those anyway to crack it). 36 | 37 | Note 2: Due to its anti-tampering mechanisms the app won't run correctly if the main executable is modified and/or re-signed. 38 | 39 | ??? danger "SPOILER (Solutions)" 40 | - [Solution by Ryan Teoh](http://www.ryantzj.com/cracking-owasp-mstg-ios-crackme-the-uncrackable.html "Solution by Ryan Teoh"). 41 | - [Solution by Pietro Oliva](https://0xsysenter.github.io/ios/reversing/arm64/mobile/ipa/frida/instrumentation/crackme/2021/02/08/ios-apps-reverse-engineering-solving-crackmes-part-2.html "Solution by Pietro Oliva"). 42 | 43 | 44 | By [Bernhard Mueller](https://github.com/muellerberndt "Bernhard Mueller") 45 | 46 | 47 |

48 | -------------------------------------------------------------------------------- /docs/donate.md: -------------------------------------------------------------------------------- 1 | # Donations 2 | 3 | While both the MASVS and the MASTG are created and maintained by the community on a voluntary basis, sometimes a little bit of outside help is required. 4 | 5 | **Monetary Donations:** You can donate any amount you like, no matter how small, anyone can help. From 500$ up you may select a [Donation Package](donate/packages.md) and be listed as a donator. 6 | 7 | 100% of the funds go to the OWASP Foundation and allow us funding our project activities such as contracting technical editors, graphic designers, software developers, purchasing test devices, creating swag, etc. 8 | 9 |
10 | :white_heart:{ .pump } Donate 11 | :material-book-heart: Purchase the MASTG 12 |
13 | 14 | **Effort Based:** You can instead support the project by contributing with your work and end up at our [acknowledgement section](MASTG/Intro/0x02c-Acknowledgements.md "MASTG acknowledgements"). 15 | 16 | If you're a company, consider becoming a ["MAS Advocate"](MASTG/Intro/0x02c-Acknowledgements.md#our-mas-advocates) which is the highest status that companies can achieve in the project acknowledging that they've gone above and beyond to support the project. 17 | 18 |
19 | :material-text-box-edit: Contribute 20 | :material-medal: Become a MAS Advocate 21 |
22 | 23 | ## Our Donators 24 | 25 | We thank our donators for providing the funds to support us on our project activities. 26 | 27 | **The OWASP Foundation is very grateful for the support by the individuals and organizations listed. However please note, the OWASP Foundation is strictly vendor neutral and does not endorse any of its supporters. Donations do not influence the content of the MASVS or MASTG in any way.** 28 | 29 |

30 | 31 |

32 | -------------------------------------------------------------------------------- /docs/donate/packages.md: -------------------------------------------------------------------------------- 1 | # Donation Packages 2 | 3 | These types of public recognition shall be online no less than one year, or no less than the next major release, whichever is greater. 4 | 5 | :warning: The Donation Packages have a maximum duration, **once expired the logos will be removed** and the donator will still be listed as supporter on the project website, GitHub and in the printed and digital versions. This can be renewed anytime. 6 | 7 |
8 | 9 | | :package: Good Samaritan (USD 500) | :package: Honorable Benefactor (USD 2,000 / 8 Available) | :package: God Mode Donator (USD 4,000 / 5 Available) | 10 | |---|---|---| 11 | |
  • :material-check: Listed as a supporter.
  • :material-check: Small company logo.
  • :material-clock: 1 year
  • :material-book-open-variant: 1 Paperback Book (optional)
|
  • :material-check: Listed as a supporter.
  • :material-check: Medium company logo
  • :material-clock: 2 year
  • :material-book-open-variant: 3 Paperback Books (optional)
|
  • :material-check: Listed as a supporter.
  • :material-check:Large company logo.
  • :material-clock: 3 years
  • :material-book-open-variant: 5 Paperback Books (optional)
| 12 | 13 |
14 | 15 | > Please note that the OWASP Donation Policy has changed since 22-Sept-2020. All details can be found in [OWASP Donations Policy](https://owasp.org/www-policy/operational/donations) page. 16 | > 17 | > [Contact us](../contact.md) if you have any questions regarding your donation. 18 | -------------------------------------------------------------------------------- /docs/donate/steps.md: -------------------------------------------------------------------------------- 1 | # Steps 2 | 3 | ## 1. Make your Donation 4 | 5 | 6 | 7 | Click the button to make your donation directly in the official OWASP website: 8 | 9 | :warning: Fill in the form and be sure to **select the option** _"Publicly list me as a supporter of OWASP Mobile Application Security"_ 10 | 11 |
12 | :white_heart:{ .pump } Make your Donation 13 |
14 | 15 |

16 | 17 | ## 2. Register your Donation Package (optional) 18 | 19 | 20 | 21 | If your donation is above USD 500 you may opt-in for a [Donation Package](#donation-packages) by registering it. We will then, together with the OWASP Foundation, verify and process it. 22 | 23 |
24 | :material-check-all: Register your Donation 25 |
26 | 27 |


28 | -------------------------------------------------------------------------------- /docs/images/release_header.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/docs/images/release_header.png -------------------------------------------------------------------------------- /docs/index.md: -------------------------------------------------------------------------------- 1 | --- 2 | hide: 3 | - navigation 4 | - toc 5 | title: "Home" 6 | --- 7 | 8 | 9 | # OWASP Mobile Application Security 10 | 11 | ## Our Mission 12 | 13 |
14 | 15 |
16 |
"Define the industry standard for mobile application security."
17 | 18 |

The OWASP Mobile Application Security (MAS) flagship project provides a security standard for mobile apps (OWASP MASVS) and a comprehensive testing guide (OWASP MASTG) that covers the processes, techniques, and tools used during a mobile app security test, as well as an exhaustive set of test cases that enables testers to deliver consistent and complete results.

19 |
20 | 21 |
22 | 23 |
24 | 25 |
26 | 27 |
28 | 29 |
30 | 31 |

OWASP MASVS

32 | 33 | 34 | 35 |
36 | 37 | Download the MASVS 38 | 39 |
40 |
41 | 42 |

OWASP MASTG

43 | 44 | 45 | 46 |
47 | 48 | Download the MASTG 49 | 50 |
51 | 52 |
53 | 54 |

OWASP MAS Checklist

55 | 56 |

57 | 58 | 59 | 60 |


61 | 62 | Download the Checklist 63 | 64 |
65 | 66 |
67 | 68 |
69 | 70 | ## Trusted by ... 71 | 72 | The OWASP MASVS and MASTG are trusted by the following platform providers and standardization, governmental and educational institutions. [Learn more](MASTG/Intro/0x02b-MASVS-MASTG-Adoption.md). 73 | 74 | 75 | 76 | 77 | 78 |
79 | 80 | ## 🥇 MAS Advocates 81 | 82 | 83 | 84 | 85 | 86 | MAS Advocates are industry adopters of the OWASP MASVS and MASTG who have invested a significant and consistent amount of resources to push the project forward by providing consistent high-impact contributions and continuously spreading the word. [Learn more](MASTG/Intro/0x02c-Acknowledgements.md). 87 | 88 |
89 | -------------------------------------------------------------------------------- /docs/javascripts/tablesorts.js: -------------------------------------------------------------------------------- 1 | document$.subscribe(function() { 2 | var tables = document.querySelectorAll("article table:not([class])") 3 | tables.forEach(function(table) { 4 | new Tablesort(table) 5 | }) 6 | }) -------------------------------------------------------------------------------- /docs/stylesheets/extra.css: -------------------------------------------------------------------------------- 1 | :root { 2 | --md-primary-fg-color: #499FFF; 3 | } 4 | 5 | @keyframes pump { 6 | 0%, 40%, 80%, 100% { 7 | transform: scale(1); 8 | } 9 | 20%, 60% { 10 | transform: scale(1.15); 11 | } 12 | } 13 | 14 | .mas-chip { 15 | border: solid 1px var(--md-primary-fg-color); 16 | outline:none; 17 | text-decoration:none; 18 | border-radius: 1.2em; 19 | min-width: 5.5em; 20 | max-height: 1.6em; 21 | padding-left: 0.5em; 22 | padding-right: 0.4em; 23 | } 24 | 25 | .mas-dot-blue { 26 | height: 1.5em; 27 | width: 1.5em; 28 | background-color: #33CCCC; 29 | border-radius: 50%; 30 | display: inline-block; 31 | } 32 | 33 | .mas-dot-green { 34 | height: 1.5em; 35 | width: 1.5em; 36 | background-color: #99CC00; 37 | border-radius: 50%; 38 | display: inline-block; 39 | } 40 | 41 | .mas-dot-orange { 42 | height: 1.5em; 43 | width: 1.5em; 44 | background-color: #FF9900; 45 | border-radius: 50%; 46 | display: inline-block; 47 | } 48 | 49 | .md-footer__inner:not([hidden]){ 50 | display: none; 51 | } 52 | 53 | .mas-blue-hue { 54 | filter: sepia(100%) hue-rotate(190deg) saturate(500%); 55 | } 56 | 57 | .mas-mini-app { 58 | border-radius: 5px; 59 | } 60 | 61 | .mas-app-row { 62 | display: flex; 63 | flex-direction: row; 64 | margin-top: 1em; 65 | } 66 | 67 | .mas-apps-container { 68 | display: flex; 69 | flex-direction: column; 70 | flex-basis: 100%; 71 | margin-left: 20px; 72 | } 73 | 74 | .mas-flex-container { 75 | display: flex; 76 | flex-direction: row; 77 | } 78 | 79 | @media (max-width: 800px) { 80 | .mas-flex-container { 81 | flex-direction: column; 82 | } 83 | } 84 | 85 | .pump { 86 | animation: pump 1000ms ease-out; 87 | } 88 | 89 | .grow:hover { transform: scale(1.05); transition: 0.2s;} 90 | -------------------------------------------------------------------------------- /docs/talks.md: -------------------------------------------------------------------------------- 1 | --- 2 | hide: 3 | - navigation 4 | - toc 5 | --- 6 | 7 | # 🎙 Talks 8 | 9 | -------------------------------------------------------------------------------- /mkdocs.yml: -------------------------------------------------------------------------------- 1 | site_name: OWASP Mobile Application Security 2 | repo_url: https://github.com/OWASP/owasp-mastg 3 | repo_name: OWASP/owasp-mastg 4 | # use_directory_urls: false # only set for mkdocs build 5 | edit_uri: "" # disable edit button 6 | 7 | nav: 8 | - Home: index.md 9 | - MASTG: 10 | - MASTG.md 11 | - Intro: MASTG/Intro 12 | - General Guide: MASTG/General 13 | - Android: MASTG/Android 14 | - iOS: MASTG/iOS 15 | - Tools: MASTG/Tools 16 | - References: MASTG/References 17 | - MASVS: 18 | - MASVS.md 19 | - Intro: MASVS/Intro 20 | - Controls: MASVS/Controls 21 | - Appendix: MASVS/Appendix 22 | - "MAS Checklist": MAS_checklist.md 23 | - "MAS Crackmes": 24 | - crackmes.md 25 | - crackmes 26 | - news.md 27 | - talks.md 28 | - "⭐ Contribute": 29 | - contributing.md 30 | - contributing 31 | - "💙 Donate": 32 | - donate.md 33 | - donate 34 | - contact.md 35 | 36 | copyright: | 37 |
38 | 39 |
40 | 41 | © OWASP Foundation 2022. This work is licensed under 42 | CC-BY-4.0. For any reuse or distribution, you must make clear to others the license terms of this work. 43 |
OWASP ® is a registered trademark of the OWASP Foundation, Inc. 44 |
Made with Material for MkDocs | Website designed by Carlos Holguera.
45 | 46 | theme: 47 | name: material 48 | # custom_dir: docs/overrides 49 | logo: assets/logo_circle.png 50 | favicon: assets/logo_circle.png 51 | icon: 52 | repo: fontawesome/brands/github 53 | features: 54 | - search.suggest 55 | - search.share 56 | - toc.integrate 57 | - navigation.instant 58 | # - navigation.expand 59 | - navigation.tabs 60 | - navigation.tabs.sticky 61 | - navigation.top 62 | - navigation.tracking 63 | 64 | palette: 65 | # - primary: #499FFF 66 | - scheme: default 67 | toggle: 68 | icon: material/weather-night 69 | name: Switch to dark mode 70 | - scheme: slate 71 | toggle: 72 | icon: material/weather-sunny 73 | name: Switch to light mode 74 | 75 | extra_css: 76 | - stylesheets/extra.css 77 | extra_javascript: 78 | - https://unpkg.com/tablesort@5.3.0/dist/tablesort.min.js 79 | - javascripts/tablesort.js 80 | plugins: 81 | - search 82 | - include_dir_to_nav 83 | - mermaid2 84 | markdown_extensions: 85 | - meta 86 | - toc: 87 | permalink: true 88 | - attr_list 89 | - admonition 90 | - tables 91 | - pymdownx.details 92 | - pymdownx.superfences 93 | - pymdownx.emoji: 94 | emoji_index: !!python/name:materialx.emoji.twemoji 95 | emoji_generator: !!python/name:materialx.emoji.to_svg 96 | - pymdownx.progressbar 97 | - pymdownx.superfences: 98 | custom_fences: 99 | - name: mermaid 100 | class: mermaid 101 | format: !!python/name:pymdownx.superfences.fence_code_format 102 | 103 | extra: 104 | generator: false # removed but recreated in copyright above 105 | analytics: 106 | provider: google 107 | property: G-KWZRJV0S4P 108 | social: 109 | - icon: fontawesome/brands/slack 110 | link: https://owasp.slack.com/messages/project-mobile_omtg/details/ 111 | - icon: fontawesome/brands/twitter 112 | link: https://twitter.com/OWASP_MAS 113 | - icon: fontawesome/brands/github 114 | link: https://github.com/OWASP/owasp-mastg/discussions 115 | # - icon: fontawesome/solid/paper-plane 116 | # link: mailto:carlos.holguera@owasp.org 117 | # name: Carlos Holguera 118 | # - icon: fontawesome/solid/paper-plane 119 | # link: mailto:sven.schleier@owasp.org 120 | # name: Sven Schleier 121 | -------------------------------------------------------------------------------- /requirements.txt: -------------------------------------------------------------------------------- 1 | mkdocs 2 | mkdocs-material 3 | mkdocs-mermaid2-plugin 4 | mkdocs-include-dir-to-nav 5 | pandas 6 | pyyaml 7 | tabulate 8 | requests -------------------------------------------------------------------------------- /tools/Apply_Link_Check.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # Script taken from https://github.com/OWASP/CheatSheetSeries/blob/master/scripts/Apply_Link_Check.sh 3 | # Script in charge of auditing the released MD files in order to detect dead links 4 | 5 | cd ../Document 6 | if test -f "../link-check-result.out"; then 7 | rm ../link-check-result.out 8 | fi 9 | find . -name \*.md -exec markdown-link-check -q -c ../.github/workflows/config/mlc_config.json {} \; 1>../link-check-result.out 2>&1 10 | errors=`grep -c "ERROR:" ../link-check-result.out` 11 | content=`cat ../link-check-result.out` 12 | if [[ $errors != "0" ]] 13 | then 14 | echo "[!] Error(s) found by the Links validator: $errors pages have dead links! Verbose output in /link-check-result.out" 15 | exit $errors 16 | else 17 | echo "[+] No error found by the Links validator." 18 | rm ../link-check-result.out 19 | fi 20 | -------------------------------------------------------------------------------- /tools/Apply_Linter_Check.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # Script taken from https://github.com/OWASP/CheatSheetSeries/blob/master/scripts/Apply_Linter_Check.sh 3 | # Script in charge of auditing the released MD files with the linter policy defined at project level 4 | 5 | cd ../ 6 | if test -f "linter-result.out"; then 7 | rm linter-result.out 8 | fi 9 | markdownlint -c .markdownlint.json -o linter-result.out Document 10 | errors=`wc -m linter-result.out | cut -d' ' -f1` 11 | content=`cat linter-result.out` 12 | if [[ $errors != "0" ]] 13 | then 14 | echo "[!] Error(s) found by the Linter: $content" 15 | exit $errors 16 | else 17 | echo "[+] No error found by the Linter." 18 | rm linter-result.out 19 | fi -------------------------------------------------------------------------------- /tools/README.md: -------------------------------------------------------------------------------- 1 | # Tools 2 | 3 | ## Overview 4 | 5 | This directory is for tools that are used to generate the necessary files for our release-channels. 6 | 7 | Channels: 8 | 9 | - Gitbook: currently using @sushi2k's repository () which is synced automatically via . 10 | - Github actions & Github releases: We use Github actions to build and verify the documents in an automated fashion as well as build releases. 11 | - Leanpub: The book can be bought via Leanpub as PDF to support OWASP and the MAS project financially. 12 | - Lulu: The book can be bought via Lulu as hard-copy to support OWASP and the MAS project financially. 13 | 14 | Files: 15 | 16 | - `Apply_Link_Check.sh`: Tool to inspect the links in the document folders for every language. 17 | - `Apply_Lint_Check.sh`: Tool to inspect the markdown files their markup in the document folders for every language. 18 | - `contributors.py`: Python script to retrieve current contributors and group them into our different categories according to their additions. 19 | - `custom-reference.docx`: Template file used for generating the word document. 20 | - `pandoc_makedocs.sh`: Script that is being used to generate PDF, ePub and docx version of the MASTG. This script can be used to generate the documents locally and is also used in Github Actions. 21 | - `updateLeanpub.sh` is in the making: for now it contains only instructions. 22 | 23 | ## Release process 24 | 25 | 1. Update the CHANGELOG.md in the Documents directory and add a release statement and summary of the changes since the last release. Update the RECENT_CHANGES.md in the tools folder. Add it also to the CHANGELOG.md in the root directory. 26 | 2. Commit the changes (with message `Release `) 27 | 3. Merge the PR into master 28 | 4. Checkout master and pull changes: 29 | 30 | ```bash 31 | $ git checkout master 32 | $ git pull 33 | ``` 34 | 35 | 5. Push a tag with the new version: 36 | 37 | ```bash 38 | $ git tag -a v -m "Release message" 39 | $ git push origin v 40 | ``` 41 | 42 | > The letter `v` need to be part of the tag name to trigger the release Github action. The tag name will become the version title of the release. The content of the RECENT_CHANGES file will become the body text of the release (be sure it includes the actual title of the release). 43 | 44 | 6. Verify that Github Action was triggered and successfully completed 45 | 7. Verify the new release 46 | 8. Update OWASP Wiki if necessary 47 | 9. Update the files at Lulu with the created files from the release page. 48 | 10. Update the files at Leanpub with the created files from the release page. 49 | 11. Tweet about it with @OWASP_MAS, Linkedin and OWASP Slack 50 | 51 | In case something went wrong and we need to remove the release: 52 | 53 | 1. Delete the tag locally and remotely: 54 | 55 | ```bash 56 | $ git tag -d # delete the tag locally 57 | $ git push origin :refs/tags/ # delete the tag remotely 58 | ``` 59 | 60 | 2. Go to Github release page . The release you removed is now in "draft". Click on edit and discard/delete the release. 61 | -------------------------------------------------------------------------------- /tools/base_images/mstg-cover-hugo.psd: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/tools/base_images/mstg-cover-hugo.psd -------------------------------------------------------------------------------- /tools/base_images/mstg-cover-hugo.xcf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/tools/base_images/mstg-cover-hugo.xcf -------------------------------------------------------------------------------- /tools/base_images/mstg-cover.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/tools/base_images/mstg-cover.jpg -------------------------------------------------------------------------------- /tools/base_images/mstg-cover.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/tools/base_images/mstg-cover.png -------------------------------------------------------------------------------- /tools/base_images/mstg-cover.xcf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/tools/base_images/mstg-cover.xcf -------------------------------------------------------------------------------- /tools/contributors.py: -------------------------------------------------------------------------------- 1 | import json 2 | import requests 3 | 4 | url = 'https://api.github.com/repos/OWASP/owasp-mastg/stats/contributors' 5 | headers = {'Accept' : 'application/vnd.github.v3+json'} 6 | 7 | r = requests.get(url, headers=headers) 8 | 9 | data = r.json() 10 | 11 | coAuthor = "Author/Co-Authors: " 12 | topContributors = "Top Contributors: " 13 | contributors = "Contributors: " 14 | miniContributors = "Mini Contributors: " 15 | additions = '' 16 | 17 | for authors in data[:]: 18 | # print(authors['weeks']) 19 | # print(authors['author']['login']) 20 | # print(authors['weeks']) 21 | 22 | count = 0 23 | 24 | # count additions for each author 25 | for allWeeks in authors['weeks']: 26 | count += allWeeks['a'] 27 | 28 | if (count >= 2000): 29 | # author = "Co-Author: "+authors['author']['login'] 30 | # additions = author + " Additions:" + str(count) 31 | # print(additions) 32 | coAuthor += authors['author']['login']+", " 33 | elif ((count >= 500) and (count <2000)): 34 | # author = "Top Contributors: "+authors['author']['login'] 35 | # additions = author + " Additions:" + str(count) 36 | # print(additions) 37 | topContributors += authors['author']['login']+", " 38 | elif ((count >= 50) and (count <500)): 39 | # author = "Contributors: "+authors['author']['login'] 40 | # additions = author + " Additions:" + str(count) 41 | # print(additions) 42 | contributors += authors['author']['login']+", " 43 | elif ((count >= 1) and (count <50)): 44 | # author = "Mini Contributors: "+authors['author']['login'] 45 | # additions = author + " Additions:" + str(count) 46 | # print(additions) 47 | miniContributors += authors['author']['login']+", " 48 | 49 | 50 | print(coAuthor+"\n") 51 | print(topContributors+"\n") 52 | print(contributors+"\n") 53 | print(miniContributors+"\n") -------------------------------------------------------------------------------- /tools/custom-reference.docx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/tools/custom-reference.docx -------------------------------------------------------------------------------- /tools/docker/README.md: -------------------------------------------------------------------------------- 1 | # MASTG PDFs Generation with Docker 2 | 3 | The MASTG document generation is based on pandocker: [https://github.com/dalibo/pandocker/blob/latest/LICENSE](https://github.com/dalibo/pandocker/blob/latest/LICENSE). 4 | 5 | ## On your Machine 6 | 7 | - Install Docker 8 | - `cd` to the MASTG root folder `owasp-mastg/` 9 | - Run the `pandoc_makedocs.sh` script with the language folder and an optional version number (**do not `cd` into `tools/docker` to run it**): 10 | 11 | ```sh 12 | $ ./tools/docker/pandoc_makedocs.sh Document MyVersion 13 | ``` 14 | 15 | - You can set `VERBOSE=1` for a more detailed output 16 | 17 | ## On GitHub 18 | 19 | Each time you push to GitHub the workflows in the [MASTG GitHub Actions](https://github.com/OWASP/owasp-mastg/actions "MASTG GitHub Actions") will be triggered. You can check what will be executed inside the folder `owasp-mastg/.github/workflows`, where `docgenerator.yml` takes care of building the Docker image and running the generation script once per language inside the container. 20 | 21 | See the results in: 22 | 23 | ## Generation Steps 24 | 25 | ### In case of a new Docker image 26 | 27 | - Create a PR with the new changes on the Docker generation scripts. 28 | - Once the PR is approved, create a tag: 29 | 30 | ```sh 31 | git tag -a docker- -m "Changes on docker image" 32 | ``` 33 | 34 | - Create a new image and push it to docker hub (requires being logged in to Docker hub and Docker hub membership of OWASP organization): 35 | 36 | ```sh 37 | docker build --tag owasp/masvs-docgenerator: tools/docker/ 38 | docker images 39 | #check the output and find the tag of the MASVS-generator container image you created 40 | docker tag owasp/masvs-docgenerator: 41 | docker push owasp/masvs-docgenerator: 42 | ``` 43 | 44 | - Create a new PR with the new version in the `docgenerator.yml` and `pandoc_makedocs.sh`. 45 | 46 | ### In case of a new document 47 | 48 | Given a new version: 49 | 50 | - Run Docker container which will run the generation script (`pandoc_makedocs.sh`). 51 | - The script should be self explanatory, it basically: 52 | - Reads the `metadata.md` for the Document folder 53 | - Using that metadata creates the cover dynamically including language and version (no GIMP required anymore!) 54 | - For more details, read the inline comments in `pandoc_makedocs.sh`. 55 | - The PDFs will be generated in the MASTG root folder. 56 | -------------------------------------------------------------------------------- /tools/docker/SourceSansPro-It.otf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MobSF/owasp-mstg/aec82a15a6e96b77d17074fdf1ec87f34b84d366/tools/docker/SourceSansPro-It.otf -------------------------------------------------------------------------------- /tools/docker/cover.tex: -------------------------------------------------------------------------------- 1 | % IMPORTANT NOTE this file requires latex-header.tex 2 | 3 | % The cover is created first using Google Drawings: https://docs.google.com/drawings/d/1i0NIJq3ChVrdQ-0YdqcYGeWUw9QCzd61gDBp05dP7b8/edit?usp=sharing 4 | % To best fit the PDF, in Google Drawings we go to "File > Page Setup" and set Width = 2480px and Height = 3508px. 5 | % It is exported as cover.pdf and lives in the root folder (owasp-mastg/) 6 | 7 | % The version text is written dynamically using the code in this file 8 | % The used latex overlay uses the coordinates (X,Y), where (0, 0) is the lower left corner of the page. 9 | 10 | % NOTE: For non-release versions e.g. v1.4.1-70281c8 it might look like the version string is not correctly located but it is for release versions e.g. v1.5.0. 11 | % The coordinates given below are for the release version and are correct. 12 | 13 | % This file requires the following pandoc metadata variable: $mastg_version$ 14 | 15 | \thispagestyle{empty} % remove page numbers 16 | 17 | % https://tex.stackexchange.com/questions/136900/insert-a-full-page-image 18 | \incgraph[documentpaper, 19 | overlay={\node[white] at (4.0,18.0) {\Large Version $mastg_version$};}] 20 | [width=\paperwidth,height=\paperheight]{cover.pdf} -------------------------------------------------------------------------------- /tools/docker/first_page.tex: -------------------------------------------------------------------------------- 1 | \thispagestyle{empty} % remove page numbers 2 | 3 | \textbf{OWASP Mobile Application Security Testing Guide (MASTG)} 4 | 5 | $mastg_version$ released \today \\ 6 | 7 | Release Notes: \url{https://github.com/OWASP/owasp-mastg/releases/tag/$mastg_version$} \\ 8 | 9 | Online version available at \url{https://github.com/OWASP/owasp-mastg/releases/tag/$mastg_version$} \\ \\ \\ 10 | 11 | 12 | Based on the OWASP Mobile Application Security Verification Standard (MASVS) $masvs_version$ \\ 13 | 14 | Online version available at \url{https://github.com/OWASP/owasp-masvs/releases/tag/$masvs_version$} \\ \\ \\ \\ \\ 15 | 16 | 17 | 18 | The OWASP MASTG and the MASVS are part of the OWASP Mobile Application Security (MAS) Project. \\ 19 | \url{https://mas.owasp.org} \\ \\ 20 | 21 | Copyright © The OWASP Foundation. \\ 22 | 23 | License: Creative Commons Attribution-ShareAlike 4.0 International. 24 | For any reuse or distribution, you must make clear to others the license terms of this work. \\ 25 | \url{https://creativecommons.org/licenses/by-sa/4.0/} \\ \\ 26 | 27 | ISBN: 978-1-257-96636-3 \\ \\ 28 | 29 | 30 | \emph{Cover design by Carlos Holguera} -------------------------------------------------------------------------------- /tools/docker/imagereplace.sed: -------------------------------------------------------------------------------- 1 | s//\![\2](\1){width=\3 height=\4}/g 2 | s//\![\2](\1){width=\3 height=\4}/g 3 | s//\![\2](\1){width=\3}/g 4 | s//\![\2](\1){width=\3}/g 5 | s//\![\1](\1){width=\2}/g 6 | s//\![\2](\1)/g 7 | s//\![\2](\1)/g 8 | s//\![\1](\1)/g -------------------------------------------------------------------------------- /tools/docker/latex-header.tex: -------------------------------------------------------------------------------- 1 | \usepackage{sectsty} 2 | \sectionfont{\LARGE\clearpage} 3 | 4 | \usepackage{hyperref} 5 | 6 | \hypersetup{ 7 | pdftitle={OWASP Mobile Application Security Testing Guide}, 8 | pdfauthor={Sven Schleier, Jeroen Willemsen and Carlos Holguera}, 9 | pdfsubject={The Mobile Application Security Testing Guide (MASTG) is a guide for mobile developers and penetration testers.}, 10 | pdfkeywords={Mobile Security,iOS,Android,OWASP} 11 | } 12 | 13 | \usepackage{incgraph,tikz} 14 | 15 | % Make "clones" of the commands 16 | \let\originalparagraph\paragraph 17 | \let\originalsubparagraph\subparagraph 18 | 19 | % Redefine the commands using the "clones" 20 | \renewcommand{\paragraph}[1]% 21 | {\originalparagraph{#1}\hfill} 22 | \renewcommand{\subparagraph}[1]% 23 | {\originalsubparagraph{#1}\hfill} 24 | 25 | % Remove all captions 26 | \renewcommand{\caption}[2][]{} 27 | 28 | % TODO for colored tables: add this to pandocker command -V table-use-row-colors=true 29 | 30 | \usepackage{geometry} 31 | 32 | \geometry{ 33 | a4paper, 34 | left=20mm, 35 | top=20mm, 36 | headheight=40pt, 37 | voffset=20pt, 38 | footskip=50pt %40pt gives some more space at the bottom: test it! 39 | } 40 | 41 | %%\usepackage[space]{xeCJK} 42 | %%\setCJKmainfont{Noto Sans CJK {{CJK-LANG}}} %JP,SC,TC,KR 43 | %%\renewcommand\CJKglue{}% get proper linebreaking if spaces are provided 44 | 45 | 46 | \usepackage{underscore} % Solves breaking line for **Protocol_KeyExchangeAlgorithm_WITH_BlockCipher_IntegrityCheckAlgorithm** 47 | 48 | % The next 2 block fix several issues with non-breaking texttt environments: 49 | % "The module app.package.attacksurface" 50 | % "in clear text in /data/data//shared_-" 51 | % "For example, \e search.quiet=true;" 52 | 53 | \newcommand*\justify{% 54 | \fontdimen2\font=0.4em% interword space 55 | \fontdimen3\font=0.2em% interword stretch 56 | \fontdimen4\font=0.1em% interword shrink 57 | \fontdimen7\font=0.1em% extra space 58 | \hyphenchar\font=`\-% allowing hyphenation 59 | } 60 | 61 | \renewcommand{\texttt}[1]{% 62 | \begingroup 63 | \ttfamily 64 | \begingroup\lccode`~=`/\lowercase{\endgroup\def~}{/\discretionary{}{}{}}% 65 | \begingroup\lccode`~=`[\lowercase{\endgroup\def~}{[\discretionary{}{}{}}% 66 | \begingroup\lccode`~=`.\lowercase{\endgroup\def~}{.\discretionary{}{}{}}% 67 | \catcode`/=\active\catcode`[=\active\catcode`.=\active 68 | \justify\scantokens{#1\noexpand}% 69 | \endgroup 70 | } 71 | -------------------------------------------------------------------------------- /tools/docker/pandoc_makedocs.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | set -eo pipefail 4 | 5 | # Input variables 6 | FOLDER=${1:-Document} 7 | MASTG_VERSION=${2:-SNAPSHOT} 8 | MASVS_VERSION=${3:-SNAPSHOT} 9 | 10 | rm -rf build 11 | cp -R $FOLDER "build" 12 | 13 | # You can also use the environment variables below to adapt the build process 14 | IMG=${IMG:-dalibo/pandocker} 15 | TAG=${TAG:-21.02} # /!\ use stable-full for non-european languages 16 | LATEX_TEMPLATE=${LATEX_TEMPLATE:-eisvogel} 17 | TITLE=${TITLE:-OWASP Mobile Application Security Testing Guide ${MASTG_VERSION}} 18 | 19 | PANDOC_PARAMS=${PANDOC_PARAMS:-} 20 | PANDOC_PARAMS+="--resource-path=.:build " 21 | PANDOC_PARAMS+="--metadata mastg_version=${MASTG_VERSION} --metadata masvs_version=${MASVS_VERSION}" 22 | 23 | [ ! -z "${VERBOSE}" ] && PANDOC_PARAMS+="--verbose " 24 | 25 | PANDOCKER="docker run --rm --volume `pwd`:/pandoc ${IMG}:${TAG} ${PANDOC_PARAMS}" 26 | 27 | # remove the HTML comment from \pagebreak 28 | docker run --rm --entrypoint '/bin/sh' --volume `pwd`:/pandoc ${IMG}:${TAG} -c 'sed -i "s##\1#g" build/*.md' 29 | 30 | # convert HTML images to pandoc markdown images 31 | docker run --rm --entrypoint '/bin/sh' --volume `pwd`:/pandoc ${IMG}:${TAG} -c 'sed -i -f tools/docker/imagereplace.sed build/0x*.md' 32 | 33 | # Use pandocker PANDOCKER by default, unless `export PANDOC=pandoc` 34 | # this is useful for CI, because we can run the script directly inside the container 35 | PANDOC=${PANDOC:-${PANDOCKER}} 36 | 37 | METADATA="build/metadata.md" 38 | CHAPTERS="build/0x*.md" 39 | OUTPUT_BASE_NAME="OWASP_MASTG-${MASTG_VERSION}" 40 | 41 | [ ! -z "${VERBOSE}" ] && echo "[*] Creating PDF" 42 | 43 | # header 44 | ${PANDOC} \ 45 | --output tmp_latex-header.latex \ 46 | --template tools/docker/latex-header.tex \ 47 | ${METADATA} 48 | 49 | # cover 50 | ${PANDOC} \ 51 | --output tmp_cover.latex \ 52 | --template tools/docker/cover.tex \ 53 | ${METADATA} 54 | 55 | # first_page 56 | ${PANDOC} \ 57 | --output tmp_first_page.latex \ 58 | --template tools/docker/first_page.tex \ 59 | ${METADATA} 60 | 61 | # PDF 62 | ${PANDOC} \ 63 | --template=${LATEX_TEMPLATE} \ 64 | --pdf-engine=xelatex \ 65 | --columns 50 \ 66 | --highlight-style=tango \ 67 | --metadata title="${TITLE}" \ 68 | --include-in-header tmp_latex-header.latex \ 69 | --include-before-body tmp_cover.latex \ 70 | --include-before-body tmp_first_page.latex \ 71 | --output ${OUTPUT_BASE_NAME}.pdf \ 72 | -V fontsize=10pt \ 73 | ${METADATA} \ 74 | ${CHAPTERS} 75 | 76 | # EPUB 77 | echo "[*] Creating epub" 78 | 79 | ${PANDOC} \ 80 | --metadata title="${TITLE}" \ 81 | --metadata author="Bernhard Mueller, Sven Schleier, Jeroen Willemsen, and Carlos Holguera" \ 82 | --epub-cover-image=cover.png \ 83 | -o ${OUTPUT_BASE_NAME}.epub \ 84 | ${METADATA} \ 85 | ${CHAPTERS} 86 | 87 | # clean temp files 88 | rm -f tmp_latex-header.latex tmp_cover.latex tmp_first_page.latex 89 | rm -rf build 90 | -------------------------------------------------------------------------------- /tools/scripts/excel_styles_and_validation.py: -------------------------------------------------------------------------------- 1 | from openpyxl.styles import PatternFill, Alignment, Border, Side, NamedStyle, Font 2 | from openpyxl.styles.differential import DifferentialStyle 3 | from openpyxl.styles.colors import Color 4 | from openpyxl.formatting.rule import Rule 5 | from openpyxl.worksheet.datavalidation import DataValidation 6 | 7 | styles = [] 8 | 9 | align_center = Alignment( 10 | horizontal="center", 11 | vertical="center", 12 | text_rotation=0, 13 | wrap_text=True, 14 | shrink_to_fit=True, 15 | indent=0, 16 | wrapText=True, 17 | ) 18 | align_left = Alignment( 19 | horizontal="general", 20 | vertical="center", 21 | text_rotation=0, 22 | wrap_text=True, 23 | shrink_to_fit=True, 24 | indent=0, 25 | justifyLastLine=True, 26 | wrapText=True, 27 | ) 28 | FONT = "Avenir" 29 | MSTG_BLUE = "499FFF" 30 | 31 | styles_metadata = [ 32 | {"name": "text", "font": {'name': FONT}, "alignment": "left", "background": ""}, 33 | {"name": "center", "font": {'name': FONT}, "alignment": "center", "background": ""}, 34 | {"name": "blue_link", "font": {'name': FONT, 'underline': "single", 'color': MSTG_BLUE}, "alignment": "center", "background": ""}, 35 | {"name": "gray", "font": {'name': FONT}, "alignment": "center", "background": "00C0C0C0"}, 36 | {"name": "blue", "font": {'name': FONT}, "alignment": "center", "background": "0033CCCC"}, 37 | {"name": "green", "font": {'name': FONT}, "alignment": "center", "background": "0099CC00"}, 38 | {"name": "orange", "font": {'name': FONT}, "alignment": "center", "background": "00FF9900"}, 39 | ] 40 | 41 | 42 | def create_style(params): 43 | 44 | style = NamedStyle(name=params.get("name")) 45 | style.font = Font(**params.get("font")) 46 | 47 | alignment = params.get("alignment") 48 | if alignment == "center": 49 | style.alignment = align_center 50 | else: 51 | style.alignment = align_left 52 | 53 | if params.get("background"): 54 | style.fill = PatternFill("solid", fgColor=params.get("background")) 55 | bd = Side(style="thick", color="FFFFFF") 56 | style.border = Border(left=bd, top=bd, right=bd, bottom=bd) 57 | 58 | return style 59 | 60 | 61 | def load_styles(wb): 62 | styles = [create_style(style) for style in styles_metadata] 63 | 64 | underline = NamedStyle(name="underline") 65 | underline.font = Font(name=FONT, size=15, bold=True, color=MSTG_BLUE) 66 | bd = Side(style="medium", color=MSTG_BLUE) 67 | underline.border = Border(bottom=bd) 68 | styles.append(underline) 69 | 70 | big_title = NamedStyle(name="big_title") 71 | big_title.font = Font(name=FONT, size=25) 72 | big_title.alignment = align_left 73 | styles.append(big_title) 74 | 75 | gray_header = NamedStyle(name="gray_header") 76 | gray_header.font = Font(name=FONT, bold=True, color="00C0C0C0") 77 | gray_header.alignment = align_center 78 | styles.append(gray_header) 79 | 80 | [wb.add_named_style(style) for style in styles] 81 | 82 | 83 | # Data Validation for STATUS 84 | 85 | status_validation = DataValidation(type="list", formula1='"Pass,Fail,N/A"', allow_blank=True) 86 | 87 | # Conditional Formatting for STATUS 88 | 89 | red_text = Font(color="9C0006") 90 | red_fill = PatternFill(bgColor="FFC7CE") 91 | dxf = DifferentialStyle(font=red_text, fill=red_fill, alignment=align_center) 92 | rule_fail = Rule(type="containsText", operator="containsText", text="Fail", dxf=dxf) 93 | rule_fail.formula = ['NOT(ISERROR(SEARCH("Fail",K11)))'] 94 | 95 | green_text = Font(color="38761D") 96 | green_fill = PatternFill(bgColor="B6D7A8") 97 | dxf = DifferentialStyle(font=green_text, fill=green_fill, alignment=align_center) 98 | rule_pass = Rule(type="containsText", operator="containsText", text="Pass", dxf=dxf) 99 | rule_pass.formula = ['NOT(ISERROR(SEARCH("Pass",K11)))'] 100 | 101 | gray_text = Font(color="666666") 102 | gray_fill = PatternFill(bgColor="CCCCCC") 103 | dxf = DifferentialStyle(font=gray_text, fill=gray_fill, alignment=align_center) 104 | rule_na = Rule(type="containsText", operator="containsText", text="N/A", dxf=dxf) 105 | rule_na.formula = ['NOT(ISERROR(SEARCH("N/A",K11)))'] 106 | -------------------------------------------------------------------------------- /tools/scripts/gen_all_excel.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | echo $PWD 3 | LanguageArray=( $(cd owasp-masvs && ls -1 | grep Document | sed -r 's/Document-?//g' | sed 's/^$/en/g' | tr '\n' ' ') ) 4 | for lang in ${LanguageArray[*]}; do 5 | cd owasp-masvs/tools && python3 ./export.py -f yaml -l $lang > masvs_$lang.yaml && cd - 6 | python3 parse_html.py -m owasp-masvs/tools/masvs_$lang.yaml -i generated/html -o masvs_full_$lang.yaml 7 | python3 yaml_to_excel.py -m masvs_full_$lang.yaml -l $lang -o Mobile_App_Security_Checklist_$lang.xlsx --mastgversion $1 --mastgcommit $2 --masvsversion $3 --masvscommit $4 8 | done 9 | -------------------------------------------------------------------------------- /tools/scripts/mstg_to_html.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | for filename in Document/0x04*.md Document/0x05*.md Document/0x06*.md; do 3 | docker run --rm -u `id -u`:`id -g` -v `pwd`:/pandoc dalibo/pandocker --section-divs -f markdown -t html $filename -o $(basename $filename .md).html 4 | done 5 | 6 | mkdir -p tools/scripts/generated/html 7 | mv *.html tools/scripts/generated/html -------------------------------------------------------------------------------- /tools/scripts/populate_dynamic_pages.py: -------------------------------------------------------------------------------- 1 | import pandas 2 | import yaml 3 | import requests 4 | from pathlib import Path 5 | 6 | def dict_to_md(data, column_titles=None): 7 | if column_titles is None: column_titles = {key:key.title() for (key,_) in data[0].items()} 8 | df = pandas.DataFrame.from_dict(data).rename(columns=column_titles) 9 | return df.to_markdown(index=False) 10 | 11 | def append_to_file(new_content, file_path): 12 | file = Path(file_path) 13 | content = file.read_text() + new_content 14 | file.write_text(content) 15 | 16 | # talks.md 17 | 18 | data = yaml.safe_load(open("docs/assets/data/talks.yaml")) 19 | 20 | for element in data: 21 | if element['video'].startswith("http"): 22 | element['video'] = f"[:octicons-play-24: Video]({element['video']})" 23 | if element['slides'].startswith("http"): 24 | element['slides'] = f"[:material-file-presentation-box: Slides]({element['slides']})" 25 | 26 | append_to_file(dict_to_md(data) + "\n\n
\n", "docs/talks.md") 27 | 28 | # checklists.md 29 | 30 | masvs_full_en = requests.get("https://github.com/OWASP/owasp-mastg/releases/latest/download/masvs_full_en.yaml", stream=True) 31 | data = yaml.safe_load(masvs_full_en.raw) 32 | data_list = [] 33 | for _, value in data.items(): 34 | 35 | # levels 36 | value['L1'] = "" if value['L1'] == True else "" 37 | value['L2'] = "" if value['L2'] == True else "" 38 | value['R'] = "" if value['R'] == True else "" 39 | 40 | # tests 41 | value["common"] = "" 42 | value["android"] = "" 43 | value["ios"] = "" 44 | if links:=value.get("links"): 45 | for link in value.get("links"): 46 | value["common"] += f"[Test Case]({link})
" if "0x04" in link else "" 47 | value["android"] += f"[Test Case]({link})
" if "0x05" in link else "" 48 | value["ios"] += f"[Test Case]({link})
" if "0x06" in link else "" 49 | del value["links"] 50 | data_list.append(value) 51 | 52 | append_to_file("\n
\n\n" + dict_to_md(data_list) + "\n\n
\n", "docs/MAS_checklist.md") 53 | -------------------------------------------------------------------------------- /tools/scripts/requirements.txt: -------------------------------------------------------------------------------- 1 | lxml 2 | bs4 3 | openpyxl 4 | Pillow -------------------------------------------------------------------------------- /tools/scripts/structure_mastg.sh: -------------------------------------------------------------------------------- 1 | mkdir docs/MASTG 2 | mkdir docs/MASTG/Intro 3 | mkdir docs/MASTG/General 4 | mkdir docs/MASTG/Android 5 | mkdir docs/MASTG/iOS 6 | mkdir docs/MASTG/Tools 7 | mkdir docs/MASTG/References 8 | cp Document/0x0*.md docs/MASTG 9 | mv docs/MASTG/0x0[1-3]*.md docs/MASTG/Intro 10 | mv docs/MASTG/0x04*.md docs/MASTG/General 11 | mv docs/MASTG/0x05*.md docs/MASTG/Android 12 | mv docs/MASTG/0x06*.md docs/MASTG/iOS 13 | mv docs/MASTG/0x08*.md docs/MASTG/Tools 14 | mv docs/MASTG/0x09*.md docs/MASTG/References -------------------------------------------------------------------------------- /tools/scripts/structure_masvs.sh: -------------------------------------------------------------------------------- 1 | mkdir docs/MASVS 2 | mkdir docs/MASVS/Intro 3 | mkdir docs/MASVS/Controls 4 | mkdir docs/MASVS/Appendix 5 | cp owasp-masvs/Document/0x*.md docs/MASVS 6 | mv docs/MASVS/0x0[1-4]*.md docs/MASVS/Intro 7 | mv docs/MASVS/0x*V[1-8]*.md docs/MASVS/Controls 8 | mv docs/MASVS/0x9*.md docs/MASVS/Appendix -------------------------------------------------------------------------------- /tools/scripts/testcase_diff.py: -------------------------------------------------------------------------------- 1 | import yaml 2 | 3 | def main(): 4 | import argparse 5 | 6 | parser = argparse.ArgumentParser(description="Diff the MASTG test cases covered.") 7 | parser.add_argument("-o", "--old", required=True) 8 | parser.add_argument("-n", "--new", required=True) 9 | 10 | args = parser.parse_args() 11 | 12 | MASVS_OLD = yaml.safe_load(open(args.old)) 13 | MASVS_NEW = yaml.safe_load(open(args.new)) 14 | 15 | updated = 0 16 | added = 0 17 | removed = 0 18 | 19 | print("OWASP MAS Checklists Changes") 20 | 21 | for mstg_id, req in MASVS_NEW.items(): 22 | old_links = MASVS_OLD[mstg_id].get("links") 23 | new_links = req.get("links") 24 | 25 | if old_links and new_links: 26 | diff = list(set(new_links) - set(old_links)) 27 | updated += 1 28 | if diff: 29 | print(f"- [UPDATED] {mstg_id}:") 30 | for link in diff: 31 | print(f" - {link}") 32 | print("\n") 33 | elif old_links is None and new_links: 34 | added += 1 35 | print(f"- [ADDED] {mstg_id}:") 36 | for link in new_links: 37 | print(f" - {link}") 38 | print("\n") 39 | elif old_links and new_links is None: 40 | removed += 1 41 | print(f"- [REMOVED] {mstg_id}\n") 42 | 43 | print(f"\nSUMMARY: removed ({removed}) added ({added}) updated ({updated})") 44 | 45 | if __name__ == "__main__": 46 | main() -------------------------------------------------------------------------------- /tools/scripts/transform_files.py: -------------------------------------------------------------------------------- 1 | import re, os 2 | from pathlib import Path 3 | 4 | EMOJIS_regex = r"🥇 |🎁 |📝 |❗ " 5 | 6 | def transform_links(file_text): 7 | # print("[*] Regex Substitutions ../Document to MASTG/") 8 | found = re.findall(r'(\(0x.*\.md/*)', file_text) 9 | 10 | # TODO FIX we must find a better solution to this 11 | while len(found) > 0: 12 | print(f" Found: {found}") 13 | file_text = re.sub(r"\((0x0[1-3].*\.md)", r"(../Intro/\1", file_text) 14 | file_text = re.sub(r"\((0x04.*\.md)", r"(../General/\1", file_text) 15 | file_text = re.sub(r"\((0x05.*\.md)", r"(../Android/\1", file_text) 16 | file_text = re.sub(r"\((0x06.*\.md)", r"(../iOS/\1", file_text) 17 | file_text = re.sub(r"\((0x08.*\.md)", r"(../Tools/\1", file_text) 18 | file_text = re.sub(r"\((0x09.*\.md)", r"(../References/\1", file_text) 19 | 20 | found = re.findall(r'(\(0x.*\.md/*)', file_text) 21 | 22 | return file_text 23 | 24 | def remove_emojis(file_text): 25 | print("[*] Regex Substitutions for emojis") 26 | found = re.findall(EMOJIS_regex, file_text) 27 | print(f" Found: {found}") 28 | return re.sub(EMOJIS_regex, r"", file_text) 29 | 30 | def transform(folder, functions): 31 | print(f"[*] Applying transforms to {folder}") 32 | for root, dirname, filenames in os.walk(folder): 33 | if len(filenames): 34 | files = Path(root).glob('*.md') 35 | 36 | for file in files: 37 | file_obj = Path(file) 38 | print(f" - File {file_obj.as_posix()}") 39 | file_text = file_obj.read_text() 40 | 41 | new_text = None 42 | for function in functions: 43 | if new_text is None: 44 | new_text = function(file_text) 45 | else: 46 | new_text = function(new_text) 47 | 48 | file_obj.write_text(new_text) 49 | 50 | transform("docs/MASTG", [transform_links]) 51 | # transform("docs/MASTG", [remove_emojis]) -------------------------------------------------------------------------------- /tools/updateLeanpub.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | echo "There is a publishing API available https://leanpub.com/help/api." 3 | 4 | echo "As of now (26th July 2021) the API of Leanpub is only available to Pro Customers, which would costs 12.99 USD per month. For now we do it manullay at https://leanpub.com/owasp-mastg/upload" 5 | -------------------------------------------------------------------------------- /tools/updateLulu.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | echo "Will be created when we have full support from Lulu. For now do it manullay at https://leanpub.com/mobile-security-testing-guide/upload" 3 | 4 | echo "At the moment (26th July 2021) it's only possible to use the API for ordering books, but not releasing a new version, https://api.lulu.com/docs/#section/Getting-Started/Generate-a-Token" --------------------------------------------------------------------------------