This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Mobile Security Testing Guide"

From OWASP
Jump to: navigation, search
Line 20: Line 20:
 
==Where to Download==
 
==Where to Download==
  
The MSTG is an a pre-release state and not yet ready for release. Currently, we aim for a first pre-release in Q1 2017.
+
The MSTG is an a pre-release state and not yet ready for release. Currently, we aim for a first pre-release in Q1 2017. You can however access the existing content  in the [GitHub repo.](https://github.com/OWASP/owasp-mstg)
  
 
==Licensing==
 
==Licensing==
  
'''The OWASP Security Principles are free to use. In fact it is encouraged!!!
+
The guide is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.
'' Additionally, We also encourage you to contribute back to the project. We have no monopoly on this knowledge; however, we all have pieces of this knowledge from our experience. Let's begin by putting our individual pieces together to make something great. Great things happen when people work together.
 
 
 
The OWASP Security Principles are licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.
 
  
 
<!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->
 
<!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->
 
| valign="top"  style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
 
| valign="top"  style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
  
== What is OWASP Security Principles Project? ==
 
  
 +
==Classifications==
  
The end goal is to identify, cite, and document the fundamental principles of information security. Once this is well organised, we think it would be great to publish this through the [http://scriptogr.am/dennis-groves/post/owasp-press OWASP Press]. Of course, it will always remain freely available, and any money collected will go directly into the project to absorb costs with any remaining funds going to the OWASP Foundation.
+
  {| width="200" cellpadding="2"
 
+
  |-
This document should serve as a guide to technical architects and designers outlining the fundamental principles of security.
+
  | align="center" valign="center" width="50%"| [[File:Owasp-breakers-small.png|link=https://www.owasp.org/index.php/Breakers]]
 
+
  |
== Presentation ==
+
  |-
 
+
  | align="center" valign="center" width="50%"|
Coming soon
+
  |-
 +
  | colspan="2" align="center"  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
 +
  |-
 +
  | colspan="2" align="center"  | [[File:Project_Type_Files_DOC.jpg|link=]]
 +
  |}
  
== Project Leader ==
+
== Project Leaders ==
  
 
<span style="color:#ff0000">
 
<span style="color:#ff0000">
 
[https://www.owasp.org/index.php/User:Milan_Singh_Thakur Milan Singh Thakur]
 
  
 
[https://www.owasp.org/index.php/User:Bernhard_Mueller Bernhard Mueller]
 
[https://www.owasp.org/index.php/User:Bernhard_Mueller Bernhard Mueller]
Line 53: Line 52:
 
[https://www.owasp.org/index.php/User:Sven_Schleier Sven Schleier]
 
[https://www.owasp.org/index.php/User:Sven_Schleier Sven Schleier]
  
A project leader is the individual who decides to lead the project throughout its lifecycle. The project leader is responsible for communicating the project’s progress to the OWASP Foundation, and he/she is ultimately responsible for the project’s deliverables. The project leader must provide OWASP with his/her real name and contact e-mail address for his/her project application to be accepted, as OWASP prides itself on the openness of its products, operations, and members.
+
== Project Initiators ==
</span>
+
 
 +
[https://www.owasp.org/index.php/User:Milan_Singh_Thakur Milan Singh Thakur]
  
 
== Parent Project ==
 
== Parent Project ==
  
 
+
[[OWASP_Mobile_Security_Project]]
* [[OWASP_Mobile_Security_Project]]
 
 
 
== Openhub ==
 
 
 
* [https://www.openhub.net/orgs/OWASP OWASP Project Openhub]
 
 
 
<!-- DO NOT ALTER OR REMOVE THE TEXT ON NEXT LINE -->
 
| valign="top"  style="padding-left:25px;width:200px;" |
 
 
 
== Quick Download ==
 
 
 
 
 
The home of the OWASP Mobile Security Testing Guide is on [https://github.com/OWASP/owasp-mstg GitHub.] You are encourged to fork, edit and push your changes back to the project through git or edit the project directly on github.
 
 
 
However, if you like you may also download the master repository from the following link:
 
* [https://github.com/OWASP/owasp-mstg OWASP MSTG on GitHub]
 
 
 
== News and Events ==
 
 
 
* We are updating the mobile testing OWASP WIKI pages
 
 
 
== In Print ==
 
 
 
Once the project is ready for publication it can be purchased as a print on demand book from Lulu.com
 
 
 
==Classifications==
 
 
 
We aiming for a final version of the document to be finished somewhere in the first quarter of 2017.
 
 
 
  {| width="200" cellpadding="2"
 
  |-
 
  | align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
 
  | align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]] 
 
  |-
 
  | align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
 
  |-
 
  | colspan="2" align="center"  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
 
  |-
 
  | colspan="2" align="center"  | [[File:Project_Type_Files_DOC.jpg|link=]] 
 
  |}
 
  
 
|}
 
|}
Line 142: Line 102:
 
Q3 2017: Version 1.0
 
Q3 2017: Version 1.0
  
A project roadmap is the envisioned plan for the project. The purpose of the roadmap is to help others understand where the project is going. It gives the community a chance to understand the context and the vision for the goal of the project. Additionally, if a project becomes inactive, or if the project is abandoned, a roadmap can help ensure a project can be adopted and continued under  leadership.
+
A project roadmap is the envisioned plan for the project. The purpose of the roadmap is to help others understand where the project is going. It gives the community a chance to understand the context and the vision for the goal of the project. Additionally, if a project becomes inactive, or if the project is abandoned, a roadmap can help ensure a project can be adopted and continued under  leadership.
 
</span> 
 
</span> 
  

Revision as of 00:13, 3 December 2016

OWASP Project Header.jpg

The OWASP Mobile Security Testing Guide

The goal of this project is to create a comprehensive methodology that covers the processes, techniques, and tools used during a mobile app security test, and defines a complete set of test cases that enables testers to deliver consistent and complete results. Key topics explained in the guide are:

  1. Mobile platform internals
  2. Basic white-box and black-box security testing
  3. Mobile reverse engineering and tampering
  4. Assessing software protections

The MSTG also contains 96 detailed test cases that can be used to verify each of the requirements in the OWASP Mobile Application Verification Standard (MASVS). Currently, we support iOS and Android. The guide is however structured in a way that allows other mobile operating systems to be added at a later point.

Where to Download

The MSTG is an a pre-release state and not yet ready for release. Currently, we aim for a first pre-release in Q1 2017. You can however access the existing content in the [GitHub repo.](https://github.com/OWASP/owasp-mstg)

Licensing

The guide is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.


Classifications

Owasp-breakers-small.png
Cc-button-y-sa-small.png
Project Type Files DOC.jpg

Project Leaders

Bernhard Mueller

Sven Schleier

Project Initiators

Milan Singh Thakur

Parent Project

OWASP_Mobile_Security_Project

How can I participate in your project?

All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key. The home of the OWASP Mobile Security Testing Guide is on GitHub. You are encourged to fork, edit and push your changes back to the project through git or edit the project directly on github.

If I am not a programmer can I participate in your project?

Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.

Contributors

The OWASP Security Principles project is developed by a worldwide team of volunteers. A live update of project contributors is found here.

The first contributor and initiator of the project was:


The new versions contributors are:

  • Bernhard Mueller
  • Stefan Streichsbier
  • Stephen Corbiaux
  • Stephanie Vanroelen
  • Francesco Stillavato
  • Sven Schleier
  • Gerhard Wagner
  • Jeroen Willemsen
  • Abdessamad Temmar
  • YOUR NAME BELONGS HERE

Q2 2017: Beta release Q3 2017: Version 1.0

A project roadmap is the envisioned plan for the project. The purpose of the roadmap is to help others understand where the project is going. It gives the community a chance to understand the context and the vision for the goal of the project. Additionally, if a project becomes inactive, or if the project is abandoned, a roadmap can help ensure a project can be adopted and continued under leadership.  


As of November 2016, the priorities are:

  • Finish the referencing for each principle.
  • Update the Project Template.
  • Use the OWASP Press to develop a book.
  • Finish and publish the book on Lulu.

Involvement in the development and promotion of the OWASP Security Principles Project is actively encouraged! You do not have to be a security expert in order to contribute. Some of the ways you can help:

  • Helping find references to some of the principles.
  • Project administration support.
  • Wiki editing support.
  • Writing support for the book.

To be completed.