Learning resource
OWASP Mobile Application Security Testing Guide (MASTG)
OWASP’s open manual for Android and iOS app security testing and reverse engineering, published at mas.owasp.org. Chapters on platform internals, test setup and app tampering and reverse engineering sit beside modular, individually referenced tests, techniques, tool pages, knowledge articles, best practices and runnable demos, all mapped to MASVS controls and MASWE weaknesses. OWASP’s UnCrackable crackme apps serve as practice targets and examples.
- Targets
- App
- Category
- Learning resources
- Relationship
- Learning resource
- Sources reviewed
Requirements & limits
- Reviewed at the 2026-09-30 master commit. The latest release, v2.0.0 of 2026-06-30, is described as completing the refactor into modular, machine-readable components and as the first stable release of that framework, while CITATION.cff still names version 1.5.0 of 2022. The pin holds 92 v1 tests and 200 atomic tests, 167 techniques, 135 tool pages, 157 demos, 141 knowledge articles and 74 best practices.
- Reading needs only a browser; OWASP’s separate mas-website workflow builds the site. Following the techniques needs a Windows, Linux or macOS host with the tools each page names, such as the Android SDK platform tools, plus test devices or emulators. The guide recommends a rooted Android test device or jailbroken iOS device for dynamic analysis, warns against using a personal device, and describes fallbacks for testers without one.
- The UnCrackable apps for Android and iOS are OWASP’s own reverse-engineering challenges, used as examples throughout the guide. Sample-app pages describe third-party apps, and tool pages describe external software; both keep their own terms. Demo results are written up from the guide’s sample code, not from tests of production apps.
- The repository is licensed CC BY-SA 4.0, so adapted text needs attribution and the same license.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · OWASP/mastg · Revision 02ffd85
- Document/0x04c-Tampering-and-Reverse-Engineering.md GitHub · OWASP/mastg · Revision 02ffd85
- Document/0x05b-Android-Security-Testing.md GitHub · OWASP/mastg · Revision 02ffd85
- Document/0x06b-iOS-Security-Testing.md GitHub · OWASP/mastg · Revision 02ffd85
- tests-beta/index.md GitHub · OWASP/mastg · Revision 02ffd85
- demos/index.md GitHub · OWASP/mastg · Revision 02ffd85
- Crackmes/README.md GitHub · OWASP/mastg · Revision 02ffd85
- CITATION.cff GitHub · OWASP/mastg · Revision 02ffd85
- License.md GitHub · OWASP/mastg · Revision 02ffd85
- https://github.com/OWASP/mastg/releases/tag/v2.0.0
More in References and learning
- The Decompilation Wiki · Learning resource
- Frontkick vs Rikugan: a CREBench agent comparison · Learning resource
- FLARE Learning Hub · Learning resource
- Nintendo Switch Reverse Engineering · Learning resource
- Android App Reverse Engineering 101 · Learning resource
- Reverse Engineering iOS Applications · Learning resource