{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/OWASP/mastg/blob/02ffd85fb74383ec2a30b42866d38f89d72c0ead/Document/0x04c-Tampering-and-Reverse-Engineering.md",
    "https://github.com/OWASP/mastg/blob/02ffd85fb74383ec2a30b42866d38f89d72c0ead/Document/0x05b-Android-Security-Testing.md",
    "https://github.com/OWASP/mastg/blob/02ffd85fb74383ec2a30b42866d38f89d72c0ead/Document/0x06b-iOS-Security-Testing.md",
    "https://github.com/OWASP/mastg/blob/02ffd85fb74383ec2a30b42866d38f89d72c0ead/tests-beta/index.md",
    "https://github.com/OWASP/mastg/blob/02ffd85fb74383ec2a30b42866d38f89d72c0ead/demos/index.md",
    "https://github.com/OWASP/mastg/blob/02ffd85fb74383ec2a30b42866d38f89d72c0ead/Crackmes/README.md",
    "https://github.com/OWASP/mastg/blob/02ffd85fb74383ec2a30b42866d38f89d72c0ead/CITATION.cff",
    "https://github.com/OWASP/mastg/blob/02ffd85fb74383ec2a30b42866d38f89d72c0ead/License.md",
    "https://github.com/OWASP/mastg/releases/tag/v2.0.0"
  ],
  "category": "learning",
  "description_en": "OWASP’s open manual for Android and iOS app security testing and reverse engineering, published at mas.owasp.org. Chapters on platform internals, test setup and app tampering and reverse engineering sit beside modular, individually referenced tests, techniques, tool pages, knowledge articles, best practices and runnable demos, all mapped to MASVS controls and MASWE weaknesses. OWASP’s UnCrackable crackme apps serve as practice targets and examples.",
  "description_zh": "OWASP 维护的开放手册，讲解 Android 和 iOS 应用的安全测试与逆向工程，发布于 mas.owasp.org。除平台原理、测试环境搭建以及应用篡改与逆向工程等章节外，还收录可单独引用的测试、技术、工具页面、知识条目、最佳实践和可运行的演示，均与 MASVS 控制项和 MASWE 弱点对应。OWASP 自己的 UnCrackable 破解练习应用用作练习目标和示例。",
  "entry_url": "https://awesomerea.org/resources/owasp-mastg/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/owasp-mastg/",
  "evidence_url": "https://github.com/OWASP/mastg/blob/02ffd85fb74383ec2a30b42866d38f89d72c0ead/README.md",
  "group": "learn",
  "id": "owasp-mastg",
  "json_url": "https://awesomerea.org/resources/owasp-mastg/record.json",
  "kind": "learning-resource",
  "markdown_url": "https://awesomerea.org/resources/owasp-mastg/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/owasp-mastg/index.md",
  "name": "OWASP Mobile Application Security Testing Guide (MASTG)",
  "name_zh": "OWASP 移动应用安全测试指南（MASTG）",
  "record_type": "resource",
  "relationship": "learning",
  "requirements": [
    "Reviewed at the 2026-09-30 master commit. The latest release, v2.0.0 of 2026-06-30, is described as completing the refactor into modular, machine-readable components and as the first stable release of that framework, while CITATION.cff still names version 1.5.0 of 2022. The pin holds 92 v1 tests and 200 atomic tests, 167 techniques, 135 tool pages, 157 demos, 141 knowledge articles and 74 best practices.",
    "Reading needs only a browser; OWASP’s separate mas-website workflow builds the site. Following the techniques needs a Windows, Linux or macOS host with the tools each page names, such as the Android SDK platform tools, plus test devices or emulators. The guide recommends a rooted Android test device or jailbroken iOS device for dynamic analysis, warns against using a personal device, and describes fallbacks for testers without one.",
    "The UnCrackable apps for Android and iOS are OWASP’s own reverse-engineering challenges, used as examples throughout the guide. Sample-app pages describe third-party apps, and tool pages describe external software; both keep their own terms. Demo results are written up from the guide’s sample code, not from tests of production apps.",
    "The repository is licensed CC BY-SA 4.0, so adapted text needs attribution and the same license."
  ],
  "requirements_zh": [
    "审阅基于 2026-09-30 的 master 分支提交。最新版本 v2.0.0 发布于 2026-06-30，发布说明称其完成了向模块化、机器可读组件的重构，并且是该框架的首个稳定版；而 CITATION.cff 仍写着 2022 年的 1.5.0 版。所固定的提交包含 92 项 v1 测试和 200 项原子测试、167 项技术、135 个工具页面、157 个演示、141 篇知识条目和 74 项最佳实践。",
    "阅读只需浏览器；网站由 OWASP 独立的 mas-website 工作流构建。按技术页面操作需要 Windows、Linux 或 macOS 主机，以及各页面列出的工具（如 Android SDK 平台工具），并准备测试设备或模拟器。指南建议使用已 root 的 Android 测试设备或已越狱的 iOS 设备进行动态分析，提醒不要使用个人设备，并为没有此类设备的测试者介绍了替代办法。",
    "Android 与 iOS 版 UnCrackable 应用是 OWASP 自己的逆向工程挑战，在指南中通篇用作示例。示例应用页面介绍的是第三方应用，工具页面介绍的是外部软件，二者均保留各自条款。演示结果基于指南自带的示例代码撰写，并非对正式发布应用的测试。",
    "仓库采用 CC BY-SA 4.0 许可，改编文本须署名并沿用相同许可。"
  ],
  "targets": [
    "app"
  ],
  "url": "https://mas.owasp.org/MASTG/",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}