View source for OWASP Mobile Security Testing Guide

=Main=
<!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_MSTG_Header.jpg|link=]]</div>

<!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==Our Vision ==

=== '''"Define the industry standard for mobile application security."''' ===

We are writing a security standard for mobile apps and a comprehensive testing guide that covers the processes, techniques, and tools used during a mobile app security test, as well as an exhaustive set of test cases that enables testers to deliver consistent and complete results.

== Preview Release  ==

   {| cellpadding="5"
  |-
   | [[File:Bites.jpg|link=https://leanpub.com/mobile-security-testing-guide-preview]]
   | '''Mobile Security Testing Guide - OWASP Summit Preview'''
The Summit Preview contains sample chapters on Android security testing and reverse engineering. Feel free to download it for $0 or contribute any amount you like. All funds raised through sales of this book go directly into the project budget and will be used to fund production of the final release.
|}

== Main Deliverables  ==

   {| cellpadding="5"
  |-
   | [[File:mstg-mini-2.jpg|link=https://www.github.com/OWASP/owasp-mstg/]]
   | '''Mobile Security Testing Guide'''
A comprehensive guide for iOS and Android mobile security testers with the following content:
# Mobile platform internals
# Security testing in the mobile app development lifecycle
# Basic static and dynamic security testing
# Mobile app reverse engineering and tampering
# Assessing software protections
# Detailed test cases that map to the requirements in the MASVS.
The MSTG is a work-in-progress. Currently, we hope to be "feature-complete" in Q3 2017. You can contribute and comment in the [https://github.com/OWASP/owasp-mstg GitHub Repo]. A book version of the current master branch is available on [https://b-mueller.gitbooks.io/owasp-mobile-security-testing-guide/content/ Gitbook].
 |-
   | [[File:masvs-sample-mini.jpg|link=https://www.owasp.org/images/f/fe/MASVS_v0.9.3.pdf]]
  |  '''Mobile App Security Requirements and Verification'''
The [https://www.owasp.org/images/f/fe/MASVS_v0.9.3.pdf OWASP Mobile Application Security Verification Standard (MASVS)] is a standard for mobile app security. It can be used by mobile software architects and developers seeking to develop secure mobile applications, as well as security testers to ensure completeness and consistency of test results. The latest release is [https://www.owasp.org/images/f/fe/MASVS_v0.9.3.pdf version 0.9.3].
   |-
   | [[File:checklist.jpg|link=https://www.owasp.org/images/1/1b/Mobile_App_Security_Checklist_0.9.3.xlsx]]
   | '''Mobile App Security Checklist'''
A checklist for use in security assessments. Also contains links to the MSTG test case for each requirement. The current release is [https://www.owasp.org/images/1/1b/Mobile_App_Security_Checklist_0.9.3.xlsx version 0.9.3].
|}

[[Category:OWASP Project]]  
[[Category:OWASP_Breakers]]  
[[Category:OWASP_Document]]


<!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->
| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

==Classifications==

   {| width="200" cellpadding="2"
   |-
   | align="center" valign="center" width="50%" | [[File:Owasp-breakers-small.png|link=https://www.owasp.org/index.php/Breakers]]
   |
   |-
   | align="center" valign="center" width="50%" | 
   |-
   | colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
   |-
   | colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
   |}

== Project Leaders ==

<span style="color:#ff0000">

[https://www.owasp.org/index.php/User:Bernhard_Mueller Bernhard Mueller]

[https://www.owasp.org/index.php/User:Sven_Schleier Sven Schleier]

== Road Map ==

* Q3 2017: Beta release
* Q4 2017: Version 1.0
* Q1 2018: Produce A Printable Book

== Parent Project ==

[[OWASP_Mobile_Security_Project]]

==Licensing==

The guide is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

|}

=How-To=

== Using the OWASP Mobile App Security Verification Standard, Testing Guide and Checklist ==

The documents produced in this project cover many aspects of mobile application security, from the high-level requirements to the nitty-gritty implementation details and test cases. They can be used to plan and verify security controls during any phase of mobile app development, as well as during pre-release code review and penetration testing.

# The [https://www.owasp.org/images/f/f2/OWASP_Mobile_AppSec_Verification_Standard_v0.9.2.pdf Mobile Application Security Verification Standard (MASVS)] contains generic security requirements along with mappings to verification levels that can be chosen depending on the overall need for security.
# The [https://github.com/OWASP/owasp-mstg Mobile Security Testing Guide (MSTG)] provides verification instructions for each requirement in the MASVS, as well as security best practices for apps on each supported mobile operating system (currently Android and iOS). It is also useful as a standalone learning resource and reference guide for mobile application security testers.
# The [https://www.owasp.org/images/6/6f/Mobile_App_Security_Checklist_0.9.2.xlsx Mobile App Security Checklist] can be used to apply the MASVS requirements during practical assessments. It also conveniently links to the MSTG test case for each requirement, making mobile penetration testing a breeze.

It is important to note that the security standard, testing guide and checklists are closely related: They all map to the same basic set of requirements. Depending on the context, the documents can be used stand-alone or in combination to achieve different objectives.

[[File:Overview-800px.jpg]]

For example, the MASVS requirements may be used in the planning and architecture design stages, while the checklist and testing guide may serve as a baseline for manual security testing or as a template for automated security tests.

== Mobile App Security Testing ==

The [https://www.owasp.org/images/9/94/Mobile_App_Security_Verification_Checklist_0.8.2.xlsx checklist] works great as a reference during mobile app security assessments. You can walk through the requirements one-by-one - for more information on each requirement, simply click on the link in the "Testing procedures" column. Or, fill out the checklist at the end of an assessment to ensure completeness. 

== Security Engineering in the SDLC ==

Properly defined security requirements are an important part of the Secure SDLC. The [https://www.owasp.org/images/f/f2/OWASP_Mobile_AppSec_Verification_Standard_v0.9.2.pdf MASVS] levels can be used along with threat modeling to determine the appropriate set of security controls for a particular mobile app. MASVS V1 also lists requirements pertaining to the architecture and design of the mobile apps, as well as general processes and activities that should be part of the development process.

== Mobile App Security Education ==

The [https://github.com/OWASP/owasp-mstg Mobile Security Testing Guide] can be used as a standalone learning resource. Its main chapters contain general how-tos and tutorials that cover a variety of topics from mobile OS internals to advanced reverse engineering techniques.

=News=

== New Release: The OWASP Mobile Security Testing Guide - Summit Preview ==
  
The MSTG Summit Preview is an experimental proof-of-concept book created on the OWASP Summit 2017 in London. The goal was to improve the authoring process and book deployment pipeline, as well as to demonstrate the viability of the project. Note that the content is not final and will likely change significantly in subsequent releases.

Download the ebook [https://github.com/OWASP/owasp-mstg/releases/download/1.0/owasp-mstg-summit-edition.epub here].

== Mobile Security Testing Workshop on the OWASP Summit 2017  ==
  
The OWASP MSTG team is organizing a 5-days mobile security track on the OWASP Summit 2017. The track consists of a series of book sprints, each of which focuses on producing content for a specific section in the OWASP MSTG, as well as proof-reading and editing the existing content. The goal is to make as much progress on the guide as is humanly possible. Depending on the number of participants, we’ll split into sub-groups to work on different subsections or topic areas.

=== How to Join ===

Join up for the working session(s) you like by following the link(s) on the [http://owaspsummit.org/Working-Sessions/Mobile-Security/ mobile security track page], then hitting the "Edit this page here" link at the bottom, and adding yourself to the "participants" field. Signing up is not mandatory, but helps us to better organize the sessions. Don’t worry though if your session of choice happens on the "wrong" day - you can always simply stop by and we’ll brief you on your topic of choice. After all, this is the Woodstock of appsec!

Mobile security track main page:

http://owaspsummit.org/Working-Sessions/Mobile-Security/

Mobile security track schedule:

http://owaspsummit.org/schedule/tracks/Mobile-Security.html/

== April 5th, 2017: Mobile App Security Verification Standard Update ==
  
[https://www.owasp.org/images/f/fe/MASVS_v0.9.3.pdf Version 0.9.3] of the MASVS is now [https://www.owasp.org/images/f/fe/MASVS_v0.9.3.pdf available for download] . This release contains several bug fixes and modifications to security requirements:

 * Merged requirements 7.8 and 7.9 into for simplification
 * Removed Anti-RE controls 8.1 and 8.2
 * Updated MSTG links to current master
 * Section "Environmental Interaction" renamed to "Platform Interaction"
 * Removed To-dos
 * Fixed some wording & spelling issues

== January 31st, 2017: Mobile App Security Verification Standard v0.9.2 Available For Download ==
  
The Mobile App Security Verification Standard (MASVS) has undergone a major revision, including a re-design of the security model and verification levels. We also revised many security requirements to address the multitude of [https://github.com/OWASP/owasp-masvs/issues?q=is%3Aissue%20 issues raised on GitHub]. The result is MASVS v0.9.2, which is now [https://www.owasp.org/images/f/f2/OWASP_Mobile_AppSec_Verification_Standard_v0.9.2.pdf available for download in PDF format].

As the MASVS is nearing maturity, we have decided to freeze the requirements until the Mobile Testing Guide and checklists "catch up" (due to the one-to-one mapping between requirements in the MASVS and MSTG, changes to the requirements make it necessary to update the other documents as well, causing repeated effort). Unless major issues pop up, the current list will therefore remain in place until MASVS/MSTG v1.0, and further changes will be reserved for v1.1 or later releases.

The MASVS is a community effort to establish security requirements for designing, developing and testing secure mobile apps on iOS and Android. Join the [https://owasp.slack.com/messages/project-mobile_omtg/details/ OWASP Mobile Security Project Slack Channel] to meet the project members! You can sign up for an account [http://owasp.herokuapp.com/ here].

== January 28th, 2017: Mobile Crackmes and Reversing Tutorials ==
   {| cellpadding="5"
   |-
   | [[File:uncrackable-250.png|link=]]
  |  
A key goal of the OWASP Mobile Testing Project is to build the ultimate learning resource and reference guide for mobile app reversers. As hands-on hacking is by far the best way to learn, we'd like to link most of the content to practical examples. 

Starting now, we'll be adding [https://github.com/OWASP/owasp-mstg/tree/master/Crackmes crackmes for Android and iOS] to the [https://github.com/OWASP/owasp-mstg GitHub repo] that will then be used as examples throughout the guide. The goal is to collect enough resources for demonstrating the most important tools and techniques in our guide, plus additional crackmes for practicing. For starters there are three challenges:

* [https://github.com/OWASP/owasp-mstg/tree/master/OMTG-Files/02_Crackmes/01_Android/01_License_Validation Android License Validator]
* [https://github.com/OWASP/owasp-mstg/tree/master/Crackmes/iOS/Level_01/ Uncrackable App for iOS Level 1]
* [https://github.com/OWASP/owasp-mstg/tree/master/Crackmes/iOS/Level_02/ Uncrackable App for iOS Level 2]

|}

One of these three already has a [https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05b-Reverse-Engineering-and-Tampering-Android.md#symbolicexec documented solution] in the guide. Tutorials for solving the other two [https://github.com/OWASP/owasp-mstg/blob/master/OMTG-Files/02_Crackmes/List_of_Crackmes.md still need to be added].

=== We Need More Authors and Contributors! ===

Maybe you have noticed that [https://rawgit.com/OWASP/owasp-mstg/master/Generated/OWASP-MSTG-Table-of-Contents.html the reverse engineering sections in the Mobile Testing Guide are incomplete]. The reason: We're still in the starting stages and don't have a lot of authors and contributors (in fact, 99% of the reversing content was produced by one guy). We'd love to welcome *you* as a contributor of crackmes, tutorials, writeups, or simply new ideas for this project. 
 
==== What You Can Do  ====

The OWASP MSTG is an open project and there's a lot of flexibility - it mostly depends on your skill set and willingness to commit your time. That said, the some areas that need help are:

* Solving crackmes and contributing a tutorial to the guide (preferable a technique that's not already documented. Check the [https://rawgit.com/OWASP/owasp-mstg/master/Generated/OWASP-MSTG-Table-of-Contents.html TOC] first).
* Writing and adding new crackmes along with solutions (should also describe something not already in the guide. Cracking white-boxes, dynamic analysis using an emulator / introspection, etc. etc.).
* General reversing write-ups to describe specific processes and techniques
* Help us figure out [https://github.com/OWASP/owasp-mstg/blob/master/Document/0x07b-Assessing_Software_Protections.md resiliency testing processes] and [https://github.com/b-mueller/obfuscation-metrics obfuscation metrics]

The reversing part of the guide consists of the following chapters:

* [https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05-Testing-Processes-and-Techniques.md#tampering-and-reverse-engineering Tampering and Reverse Engineering - General Overview]
* [https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05b-Reverse-Engineering-and-Tampering-Android.md#tampering-and-reverse-engineering-on-android Tampering and Reverse Engineering on Android]
* [https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Reverse-Engineering-and-Tampering-iOS.md#tampering-and-reverse-engineering-on-ios Tampering and Reverse Engineering on iOS]

==== How To Join  ====

Read the [https://github.com/OWASP/owasp-mstg/blob/master/authors_guide.md author's guide] first, and join the [https://owasp.slack.com/messages/project-mobile_omtg/details/ OWASP Mobile Security Project Slack Channel], where you'll find all the other project members. You can sign up for an account [http://owasp.herokuapp.com/ here].

== January 22nd, 2017: Mobile Testing Guide TOC Available ==

As of now, we'll be auto-generating a [https://rawgit.com/OWASP/owasp-mstg/master/Generated/OWASP-MSTG-Table-of-Contents.html table of contents] out of the current MSTG master branch. This reflects the current state of the guide, and should make it easier to coordinate work between authors. A short-term goal is to finalize the structure of the guide so we get a clearer picture of what will be included in the final document. Lead authors are encouraged to complete the outline of their respective chapters. 

'''On another note, we still need additional authors to help with all sections of the guide, including mobile operating system overviews, testing processes and techniques, and reverse engineering.''' Especially iOS authors are in short supply! As usual, ping us on the [https://owasp.slack.com/messages/project-mobile_omtg/details/ Slack Channel] if you want to contribute.

== December 4th, 2016: Call For Authors: The Ultimate Open-Source Mobile App Reverse Engineering Guide ==

Reverse engineering is an art, and describing every available facet of it would fill a whole library. The sheer range techniques and possible specializations is mind-blowing: One can spend years working on a very specific, isolated sub-problem, such as automating malware analysis or developing novel de-obfuscation methods. For mobile app security testers, it can be challenging to filter through the vast amount of information and build a working methodology. Things become even more problematic when one is tasked to assess apps that are heavily obfuscated and have anti-tampering measures built in.

One of the main goals in the MSTG is to build the ultimate resource for mobile reverse engineers. This includes not only basic static and dynamic analysis, but also advanced de-obfuscation, scripting and automation. Obviously, writing all this content is a lot of work, both in terms of general content and OS-specific how-tos. We're therefore looking for talented authors that want to join the project early on. Topics include the following:

* Basic Hybrid Static/Dynamic Analysis
* Code Injection and Dynamic Instrumentation (Substrate, FRIDA)
* Dynamic Binary Instrumentation (Valgrind, PIE)
* Analysis Frameworks (Metasm / Miasm)
* Symbolic Execution
* DCA and DPA attacks on white-box crypto
* Dynamic analysis frameworks (PANDA / DroidScope,...)
* Anything else we might have missed

=== What is in for me? ===

All of this is unpaid, volunteer work. However, depending on your contribution, you will be named in the "lead authors" or "contributors" list, and you'll be able to point to the fact that you co-authored the guide. You'll also be contributing to the field, helping others who are just starting out, and in turn becoming a happier person yourself (reaping the full benefits of your altruism).

=== Where do I sign up? ===

First of all, have a look at the existing RE chapters outline:

* [https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05-Testing-Processes-and-Techniques.md#tampering-and-reverse-engineering Generic / Introduction]
* [https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05b-Reverse-Engineering-and-Tampering-Android.md Android]
* [https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Reverse-Engineering-and-Tampering-iOS.md#tampering-and-reverse-engineering-on-ios iOS]

You'll probably immediately have ideas on how you can contribute. If that's the case, read the [https://github.com/OWASP/owasp-mstg/blob/master/authors_guide.md author's guide] first. 

Then contact [https://github.com/b-mueller Bernhard Mueller] - ideally directly on the  [https://owasp.slack.com/messages/project-mobile_omtg/details/ OWASP Mobile Security Project Slack Channel], where you'll find all the other project members. You can sign up for an account [http://owasp.herokuapp.com/ here].

=FAQs=

==How can I participate in your project?==

'''We are searching for additional authors, reviewers and editors.''' The best way to get started is to browse the [https://b-mueller.gitbooks.io/owasp-mobile-security-testing-guide/content/ existing content]. Also, check the [https://github.com/OWASP/owasp-mstg/projects/1 project dashboard] for a list of open tasks.

Drop a us line on the [https://owasp.slack.com/messages/project-mobile_omtg/details/) Slack channel] before you start working on a topic. This helps us to keep track of what everyone is doing and prevent conflicts. You can create a Slack account here:

http://owasp.herokuapp.com/

Before you start contributing, please read our brief [https://github.com/OWASP/owasp-mstg/blob/master/style_guide.md style guide] which contains a few basic writing rules.

If there's something you really want to see in the guide, or you want to suggest an improvement, create an issue [https://github.com/OWASP/owasp-mstg/issues issue] or ping us on [https://owasp.slack.com/messages/project-mobile_omtg/details/ Slack].

==Where do you guys need help the most?==

There's a lot of areas where you can help out:

* Writing original content, such as describing testing processes and writing test cases. We're all doing this in our spare time, which unfortunately means that things sometimes slow down to a crawl. If you're knowledgeable in some area and have time available, we'd be incredibly thankful to anyone who contributes, even if it's only one or two test cases.

* Reviewing content and giving feedback. The proper channel for questions and feedback is the GitHub issues system of the respective repo, contacting us on [https://owasp.slack.com/messages/project-mobile_omtg/details/ OWASP Mobile Security Project Slack Channel] is another possibility.

* Developing tools. For example, we still don't have an automated way of generating checklists out of the GitHub repo.

* Contributing to auxiliary projects: The [https://github.com/b-mueller/obfuscation-metrics obfuscation metrics project] is an auxiliary project that deals with specific forms of control flow and data obfuscation. This project needs experts in advanced obfuscation / de-obfuscation. Please contact us if you have experience in this area.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.

==I contributed to the original Google Doc, but I'm not credited in the new version of the MSTG? ==
As we migrated some of the existing content, we did our best to backtrack the original authors and credit them appropriately. We also added a [https://github.com/OWASP/owasp-mstg/blob/master/Document/0x02-Frontispiece.md revision history] that lists all the authors from old Google Docs. If you are not on that list but feel you should be, please contact [https://github.com/b-mueller Bernhard] or [https://github.com/sushi2k Sven] and they'll fix it. Or better yet, re-join the author's team and start contributing to the new guide.

= Acknowledgements =

== Acknowledgments ==

=== Authors ===

====Bernhard Mueller ====

Bernhard is a cyber security specialist with a talent in hacking all kinds of systems. During more than a decade in the industry, he has published many zero-day exploits for software such as MS SQL Server, Adobe Flash Player, IBM Director, Cisco VOIP and ModSecurity. If you can name it, he has probably broken it at least once. His pioneering work in mobile security was commended with a BlackHat "Best Research" Pwnie Award.

====  Sven Schleier ====

Sven is an experienced penetration tester and security architect who specialized in implementing secure SDLC for web application, iOS and Android apps. He is a project leader for the OWASP Mobile Security Testing Guide and the creator of OWASP Mobile Hacking Playground. Sven also supports the community with free hands-on workshops on web and mobile app security testing. He has published several security advisories and a white papers about a range of security topics.

=== Co-Authors ===

Co-authors have consistently contributed quality content, and have at least 2,000 additions logged in the GitHub repository.

==== Romuald Szkudlarek ====

Romuald is a passionate cyber security & privacy professional with over 15 years of experience in the Web, Mobile, IoT and Cloud domains. During his career, he has been dedicating spare time to a variery of projects with the goal of advancing the sectors of software and security. He is also teaching at various institutions. He holds CISSP, CSSLP and CEH credentials.

==== Jeroen Willemsen ====

Jeroen is a full-stack developer specialized in IT security at Xebia with a passion for mobile and risk management. He loves to explain things: starting as a teacher teaching PHP to bachelor students and then move along explaining security, risk management and programming issues to anyone willing to listen and learn.

=== Top Contributors ===

Top contributors have consistently contributed quality content with at least 500 additions logged in the GitHub repository.

* Francesco Stillavato
* Pawel Rzepa
* Andreas Happe
* Henry Hoggard
* Wen Bin Kong
* Abdessamad Temmar
* Alexander Anthuk
* Slawomir Kosowski
* Bolot Kerimbaev

=== Contributors ===

Contributors have made a quality contribution with at least 50 additions logged in the GitHub repository.

Jin Kung Ong, Gerhard Wagner, Andreas Happe, Wen Bin Kong, Michael Helwig, Jeroen Willemsen, Denis Pilipchuk, Ryan Teoh, Dharshin De Silva, Anita Diamond, Daniel Ramirez Martin, Claudio André, Enrico Verzegnassi, Prathan Phongthiproek, Tom Welch, Luander Ribeiro, Oguzhan Topgul, Carlos Holguera, David Fern, Pishu Mahtani, Anuruddha

=== Reviewers ===

Reviewers have consistently provided useful feedback through GitHub issues and pull request comments.

* Anant Shrivastava
* Sjoerd Langkemper

=== Others ===

Many other contributors have committed small amounts of content, such as a single word or sentence (less than 50 additions). The full list of contributors is available on [https://github.com/OWASP/owasp-mstg/graphs/contributors GitHub].

=== Old Version - MSTG "Beta" on Google Drive ===

The Mobile Security Testing Guide was initiated by  [https://www.owasp.org/index.php/User:Milan_Singh_Thakur Milan Singh Thakur] in 2015. The original document was hosted on Google Drive.

'''Authors:'''

Mirza Ali, Stephen Corbiaux, Ryan Dewhurst, Mohammad Hamed Dadpour,  David Fern, Ali Yazdani, Bao Lee, Anto Joseph, Nutan Kumar Panda, Rahil Parikh, Julian Schütte, Abhinav Sejpal, Anant Shrivastava, Pragati Singh,  Milan Singh Thakur, Stephanie Vanroelen, Gerhard Wagner

'''Reviewers:'''

Andrew Muller, Jonathan Carter, Stephanie Vanroelen, Milan Singh Thakur

<!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->
__NOTOC__ <headertabs></headertabs> 

[[Category:OWASP Project]]  
[[Category:OWASP_Builders]] 
[[Category:OWASP_Defenders]]  
[[Category:OWASP_Document]]