This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Mobile Security Testing Guide"

From OWASP
Jump to: navigation, search
m (May 21nd, 2019: New release of the MSTG)
(Changed Slack registration Link)
Line 270: Line 270:
 
As the MASVS is nearing maturity, we have decided to freeze the requirements until the Mobile Testing Guide and checklists "catch up" (due to the one-to-one mapping between requirements in the MASVS and MSTG, changes to the requirements make it necessary to update the other documents as well, causing repeated effort). Unless major issues pop up, the current list will therefore remain in place until MASVS/MSTG v1.0, and further changes will be reserved for v1.1 or later releases.
 
As the MASVS is nearing maturity, we have decided to freeze the requirements until the Mobile Testing Guide and checklists "catch up" (due to the one-to-one mapping between requirements in the MASVS and MSTG, changes to the requirements make it necessary to update the other documents as well, causing repeated effort). Unless major issues pop up, the current list will therefore remain in place until MASVS/MSTG v1.0, and further changes will be reserved for v1.1 or later releases.
  
The MASVS is a community effort to establish security requirements for designing, developing and testing secure mobile apps on iOS and Android. Join the [https://owasp.slack.com/messages/project-mobile_omtg/details/ OWASP Mobile Security Project Slack Channel] to meet the project members! You can sign up for an account [http://owasp.herokuapp.com/ here].
+
The MASVS is a community effort to establish security requirements for designing, developing and testing secure mobile apps on iOS and Android. Join the [https://owasp.slack.com/messages/project-mobile_omtg/details/ OWASP Mobile Security Project Slack Channel] to meet the project members! You can sign up for an account [https://join.slack.com/t/owasp/shared_invite/enQtNjExMTc3MTg0MzU4LTViMDg1MmJiMzMwZGUxZjgxZWQ1MTE0NTBlOTBhNjhhZDIzZTZiNmEwOTJlYjdkMzAxMGVhNDkwNDNiNjZiOWQ here].
  
 
== January 28th, 2017: Mobile Crackmes and Reversing Tutorials ==
 
== January 28th, 2017: Mobile Crackmes and Reversing Tutorials ==
Line 310: Line 310:
 
==== How To Join  ====
 
==== How To Join  ====
  
Read the [https://github.com/OWASP/owasp-mstg/blob/master/authors_guide.md author's guide] first, and join the [https://owasp.slack.com/messages/project-mobile_omtg/details/ OWASP Mobile Security Project Slack Channel], where you'll find all the other project members. You can sign up for an account [http://owasp.herokuapp.com/ here].
+
Read the [https://github.com/OWASP/owasp-mstg/blob/master/authors_guide.md author's guide] first, and join the [https://owasp.slack.com/messages/project-mobile_omtg/details/ OWASP Mobile Security Project Slack Channel], where you'll find all the other project members. You can sign up for an account [https://join.slack.com/t/owasp/shared_invite/enQtNjExMTc3MTg0MzU4LTViMDg1MmJiMzMwZGUxZjgxZWQ1MTE0NTBlOTBhNjhhZDIzZTZiNmEwOTJlYjdkMzAxMGVhNDkwNDNiNjZiOWQ here].
  
 
== January 22nd, 2017: Mobile Testing Guide TOC Available ==
 
== January 22nd, 2017: Mobile Testing Guide TOC Available ==
Line 347: Line 347:
 
You'll probably immediately have ideas on how you can contribute. If that's the case, read the [https://github.com/OWASP/owasp-mstg/blob/master/authors_guide.md author's guide] first.  
 
You'll probably immediately have ideas on how you can contribute. If that's the case, read the [https://github.com/OWASP/owasp-mstg/blob/master/authors_guide.md author's guide] first.  
  
Then contact [https://github.com/b-mueller Bernhard Mueller] - ideally directly on the  [https://owasp.slack.com/messages/project-mobile_omtg/details/ OWASP Mobile Security Project Slack Channel], where you'll find all the other project members. You can sign up for an account [http://owasp.herokuapp.com/ here].
+
Then contact [https://github.com/b-mueller Bernhard Mueller] - ideally directly on the  [https://owasp.slack.com/messages/project-mobile_omtg/details/ OWASP Mobile Security Project Slack Channel], where you'll find all the other project members. You can sign up for an account [https://join.slack.com/t/owasp/shared_invite/enQtNjExMTc3MTg0MzU4LTViMDg1MmJiMzMwZGUxZjgxZWQ1MTE0NTBlOTBhNjhhZDIzZTZiNmEwOTJlYjdkMzAxMGVhNDkwNDNiNjZiOWQ here].
  
 
=FAQs=
 
=FAQs=
Line 366: Line 366:
 
Drop a us line on the [https://owasp.slack.com/messages/project-mobile_omtg/details/) Slack channel] before you start working on a topic. This helps us to keep track of what everyone is doing and prevent conflicts. You can create a Slack account here:
 
Drop a us line on the [https://owasp.slack.com/messages/project-mobile_omtg/details/) Slack channel] before you start working on a topic. This helps us to keep track of what everyone is doing and prevent conflicts. You can create a Slack account here:
  
http://owasp.herokuapp.com/
+
[https://join.slack.com/t/owasp/shared_invite/enQtNjExMTc3MTg0MzU4LTViMDg1MmJiMzMwZGUxZjgxZWQ1MTE0NTBlOTBhNjhhZDIzZTZiNmEwOTJlYjdkMzAxMGVhNDkwNDNiNjZiOWQ http://owasp.herokuapp.com/]
  
 
Before you start contributing, please read our brief [https://github.com/OWASP/owasp-mstg/blob/master/style_guide.md style guide] which contains a few basic writing rules.
 
Before you start contributing, please read our brief [https://github.com/OWASP/owasp-mstg/blob/master/style_guide.md style guide] which contains a few basic writing rules.

Revision as of 05:20, 24 May 2019

OWASP MSTG Header.jpg
Lab big.jpg

Our Vision

"Define the industry standard for mobile application security."

We are writing a security standard for mobile apps and a comprehensive testing guide that covers the processes, techniques, and tools used during a mobile app security test, as well as an exhaustive set of test cases that enables testers to deliver consistent and complete results.

Main Deliverables

Mstg-cover-release-small2.jpg Mobile Security Testing Guide (MSTG) - 1.1.2 Release

The 1.1.2 Release of the MSTG is a comprehensive manual for mobile app security testing and reverse engineering for iOS and Android mobile security testers with the following content:

  1. Mobile platform internals
  2. Security testing in the mobile app development lifecycle
  3. Basic static and dynamic security testing
  4. Mobile app reverse engineering and tampering
  5. Assessing software protections
  6. Detailed test cases that map to the requirements in the MASVS.

You can contribute and comment in the GitHub Repo. An online book version of the current master branch is available on Gitbook.

Feel free to download the ePub or Mobi for $0 or contribute any amount you like. All funds raised through sales of this book go directly into the project budget and will be used to for technical editing and designing the book and fund production of future releases.

Masvs-mini-cover2.jpg Mobile App Security Requirements and Verification

The OWASP Mobile Application Security Verification Standard (MASVS) version 1.1.3 is a standard for mobile app security. It can be used by mobile software architects and developers seeking to develop secure mobile applications, as well as security testers to ensure completeness and consistency of test results.You can find the sources on the Github repo. We now have versions in the folllowing languages: Chinese, English, French, German, Japanese, Russian, and Spanish! Want to get a pdf/mobi/epub of the standard? Check the release page on Github.

Checklist.jpg Mobile App Security Checklist

A checklist for use in security assessments. Also contains links to the MSTG test case for each requirement. The current release is can be found at Github in English, Spanish and Japanese.


Classifications

Lab Project Owasp-builders-small.png
Owasp-breakers-small.png
Owasp-defenders-small.png
CC-License-4.0.png
Project Type Files DOC.jpg

Project Leaders

Sven Schleier

Jeroen Willemsen

Training

Presentations

  • AppDevcon (Amsterdam), March 2019 - Securing your mobile app with the OWASP Mobile Security Testing Guide
  • OWASP BeNeLux days 2018 - Fast forwarding mobile security with the MSTG, November 2018 - slides
  • OWASP Germany days 2018 - Introduction to Mobile Security Testing, November 2018 - slides
  • DBS AppSecCon (Singapore) - Fixing Mobile AppSec, October 2018
  • OWASP Bay Area Chapter - Mobile Testing Workshop, October 2018
  • OWASP AppSec USA - Fixing Mobile AppSec, October 2018
  • CSC 2018 - A Perspective on Mobile Security in IoT and how OWASP can Help - slides.
  • OWASP North Sweden Umea - Mobile Security Essentials
  • OWASP Gotentburg - Mobile Security Essentials Introduction into OMTG and All about the keying material
  • OWASP Day Indonesia 2017 - Fixing Mobile AppSec
  • Confidence (Krakow, Poland) - Pawel Rzepa - Testing Mobile Applications
  • OWASP AppSec EU 2017 - Fixing Mobile AppSec - Slides, Video

Parent Project

OWASP_Mobile_Security_Project

Licensing

The guide is licensed under the Creative Commons Attribution-ShareAlike 4.0 license, so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.