deardaniel/secdata-raw huggingface dataset:
OWASP Mobile Application Security Testing Guide: README

<img width="180px" align="right" style="float: right;" src="cover.png">

# OWASP Mobile Application Security Testing Guide (MASTG)

[![OWASP Flagship](https://img.shields.io/badge/owasp-flagship%20project-48A646.svg)](https://owasp.org/projects/)
[![Creative Commons License](https://img.shields.io/github/license/OWASP/mastg?color=48A646)](https://creativecommons.org/licenses/by-sa/4.0/ "CC BY-SA 4.0")

[![Markdown Linter](https://github.com/OWASP/mastg/actions/workflows/markdown-linter.yml/badge.svg?branch=master)](https://github.com/OWASP/mastg/actions/workflows/markdown-linter.yml)
[![URL Checker](https://github.com/OWASP/mastg/actions/workflows/url-checker.yml/badge.svg?branch=master)](https://github.com/OWASP/mastg/actions/workflows/url-checker.yml)

The **OWASP Mobile Application Security Testing Guide (MASTG)** is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the [OWASP Mobile Security Weakness Enumeration (MASWE)](https://github.com/OWASP/maswe "MASWE") weaknesses, which are in alignment with the controls listed in the [OWASP Mobile Application Verification Standard (MASVS)](https://github.com/OWASP/masvs "MASVS").

> [OWASP MAS](https://mas.owasp.org): [OWASP MASVS](https://mas.owasp.org/MASVS) ➡ [OWASP MASWE](https://mas.owasp.org/MASWE) ➡ [OWASP MASTG](https://mas.owasp.org/MASTG)

<br>

<center>
<a href="https://mas.owasp.org/MASTG/">
<img width="250px" src="Document/Images/open_website.png"/>
</a>
</center>

<br>

- 🌐 [Access the MASTG Web](https://mas.owasp.org/MASTG/)
- ✅ [Get the latest Mobile App Security Checklists](https://github.com/OWASP/mastg/releases/latest)
- ⚡ [Contribute!](https://mas.owasp.org/contributing)
- 💥 [Play with our Crackmes](https://mas.owasp.org/crackmes)
- 📞 [Contact Us](https://mas.owasp.org/contact)

<br>

## Trusted by

The OWASP MASVS, MASWE and MASTG are trusted by the following platform providers and standardization, governmental and educational institutions. [Learn more](https://mas.owasp.org/MASTG/0x02b-MASVS-MASTG-Adoption/).

<a href="https://mas.owasp.org/MASTG/0x02b-MASVS-MASTG-Adoption/">
<img src="Document/Images/Other/trusted-by-logos.png"/>
</a>

<br>

## 🥇 MAS Advocates

MAS Advocates are industry adopters of the OWASP MASVS, MASWE and MASTG who have invested a significant and consistent amount of resources to push the project forward by providing consistent high-impact contributions and continuously spreading the word. [Learn more](https://mas.owasp.org/MASTG/0x02c-Acknowledgements).

<br>

<a href="https://mas.owasp.org/MASTG/0x02c-Acknowledgements#our-mastg-advocates">
<img src="Document/Images/Other/nowsecure-logo.png" width="200px;" />
<img src="Document/Images/Other/guardsquare-logo.png" width="200px;" />
</a>

<br>
OWASP Mobile Application Security Testing Guide: index

---
hide: toc
title: Reference Applications
---

The applications listed below can be used as training materials. Note: only the MASTG apps and Crackmes are tested and maintained by the MAS project.
OWASP Mobile Application Security Testing Guide: MASTG APP 0010

---
title: InsecureBankv2
platform: android
source: https://github.com/dineshshetty/Android-InsecureBankv2
---

A vulnerable Android app made for security enthusiasts and developers to learn the Android insecurities by testing a vulnerable application. It has been updated in 2018 and contains a lot of vulnerabilities.
OWASP Mobile Application Security Testing Guide: MASTG APP 0017

---
title: Disable-flutter-tls-verification
platform: android
source: https://github.com/NVISOsecurity/disable-flutter-tls-verification/blob/main/test_app/pinning.apk
---

An android application designed to verify the @MASTG-TOOL-0101 script, which disables Flutter's TLS verification.
OWASP Mobile Application Security Testing Guide: MASTG APP 0006

---
title: Digitalbank
platform: android
source: https://github.com/CyberScions/Digitalbank
---

A vulnerable app created in 2015, which can be used on older Android platforms.
OWASP Mobile Application Security Testing Guide: MASTG APP 0031

---
title: VulnForum 
platform: android
source: https://github.com/macik09/Vulnforum
---

VulnForum is an intentionally vulnerable mobile forum application designed for security testing and training, serving as a practical target for the test cases outlined in the MASTG.

The application uses a modern technology stack, featuring a native Android frontend built with **Kotlin and Jetpack Compose** and an API backend implemented with **Python Flask**.

It covers a broad spectrum of common mobile and API security flaws, including:

- **Injection:** SQL Injection and Cross-Site Scripting (XSS).
- **Access Control:** Broken authorization logic and improper token validation.
- **Data Security:** Insecure data storage, verbose logging, and hardcoded secrets.
- **Platform:** Exploitable exported components and misconfigured deep links.

The repository provides detailed setup instructions and a specific set of **Flags/Challenges** for users to validate their exploitation skills.
OWASP Mobile Application Security Testing Guide: MASTG APP 0001

---
title: AndroGoat
platform: android
source: https://github.com/satishpatnayak/AndroGoat
---

An open source vulnerable/insecure app using Kotlin. This app has a wide range of vulnerabilities related to certificate pinning, custom URL schemes, Android Network Security Configuration, WebViews, root detection and over 20 other vulnerabilities.
OWASP Mobile Application Security Testing Guide: MASTG APP 0009

---
title: DVHMA
platform: android
source: https://github.com/logicalhacking/DVHMA
---

A hybrid mobile app (for Android) that intentionally contains vulnerabilities.
OWASP Mobile Application Security Testing Guide: MASTG APP 0033

---
title: Android RASP Sample
platform: android
source: https://github.com/securevale/android-rasp
package: com.securevale.rasp.android
---

A sample application demonstrating the @MASTG-TOOL-0147 library. The app showcases detection capabilities for root, emulators, and debuggers. The library implements checks using native code written in Rust to make bypassing more difficult. Provides a test interface to evaluate various RASP detection techniques including root indicators, emulator characteristics, and debugger attachment.
OWASP Mobile Application Security Testing Guide: MASTG APP 0011

---
title: MASTG Hacking Playground (Java)
platform: android
source: https://github.com/OWASP/MASTG-Hacking-Playground/tree/master/Android/MSTG-Android-Java-App
---

A vulnerable Android app by the OWASP MAS project. See included vulnerabilities in [the project wiki](https://github.com/OWASP/MASTG-Hacking-Playground/wiki/Android-App).
OWASP Mobile Application Security Testing Guide: MASTG APP 0016

---
title: Finstergram
platform: android
source: https://github.com/netlight/finstergram
---

Finstergram is an Android application designed with built-in security vulnerabilities to facilitate learning and teaching about common security issues in Android apps. To get started, simply open and build the project in your preferred version of Android Studio.

Functionally, Finstergram acts like a photo vault. The app requires a password to open your secret gallery, ostensibly preventing other users of the phone from accessing them. However, this security is not as foolproof as it seems.

The challenge presented involves having access to a non-rooted phone with the app installed. While you can unlock the phone, the app's password remains unknown. Your task is to identify vulnerabilities in Finstergram's code that could grant access to the secret gallery. Some initial strategies include examining the AndroidManifest file, understanding how the password is validated, investigating broadcast mechanisms, and exploring ways to leverage intents.
OWASP Mobile Application Security Testing Guide: MASTG APP 0012

---
title: MASTG Hacking Playground (Kotlin)
platform: android
source: https://github.com/OWASP/MASTG-Hacking-Playground/tree/master/Android/MASTG-Android-Kotlin-App
---

A vulnerable Android app by the OWASP MAS project.
OWASP Mobile Application Security Testing Guide: MASTG APP 0014

---
title: InsecureShop
platform: android
source: https://github.com/hax0rgb/InsecureShop/
status: deprecated
---

InsecureShop is an intentionally designed Android application that showcases vulnerabilities, aiming to educate developers and security experts about common pitfalls within modern Android apps. It serves as a dynamic platform for refining Android pentesting skills.

The majority of these vulnerabilities can be exploited on non-rooted devices, posing risks from both remote users and malicious third-party applications. Notably, the app doesn't utilize any APIs. InsecureShop presents an opportunity to explore a range of vulnerabilities:

- **Hardcoded Credentials**: Embedded login credentials within the code.
- **Insufficient URL Validation**: Allows loading of arbitrary URLs via Deeplinks.
- **Arbitrary Code Execution**: Enables the execution of code from third-party packages.
- **Access to Protected Components**: Permits third-party apps to launch secure components.
- **Insecure Broadcast Receiver**: Registration of a broadcast enabling URL injection.
- **Insecure Content Provider**: Accessible content provider putting user data at risk.

Complementing these learning experiences, InsecureShop provided documentation about the implemented vulnerabilities and their associated code. This documentation, however, refrains from offering complete solutions for each vulnerability showcased within the InsecureShop app. The documentation website is not accessible anymore.
OWASP Mobile Application Security Testing Guide: MASTG APP 0032

---
title: RootBeer Sample
platform: android
source: https://github.com/scottyab/rootbeer
package: com.scottyab.rootbeer.sample
---

A sample application demonstrating the @MASTG-TOOL-0146 library, a root checking library for Android. The app provides a simple interface to test various root detection techniques including checking for root management apps, dangerous apps, root cloaking apps, test keys, dangerous properties, BusyBox and `su` binaries, and read-write system partitions.
OWASP Mobile Application Security Testing Guide: MASTG APP 0029

---
title: BugBazaar
platform: android
source: https://github.com/payatu/BugBazaar
---

BugBazaar is an open-source Android application intentionally designed to be vulnerable for hands-on security testing and training. It includes more than 30 vulnerabilities across many categories (WebView issues, intent/deeplink flaws, IPC/exported component problems, SQL injection, insecure storage and logging, hardcoded secrets, and authentication/authorization weaknesses). See the project README for the full list.
OWASP Mobile Application Security Testing Guide: MASTG APP 0003

---
title: Android UnCrackable L1
platform: android
source: https://mas.owasp.org/crackmes/Android#android-uncrackable-l1
---

A secret string is hidden somewhere in this app. Find a way to extract it.

> By [Bernhard Mueller](https://github.com/muellerberndt "Bernhard Mueller")
OWASP Mobile Application Security Testing Guide: MASTG APP 0013

---
title: OVAA
platform: android
source: https://github.com/oversecured/ovaa
---

An Android app that aggregates all the platform's known and popular security vulnerabilities.
OWASP Mobile Application Security Testing Guide: MASTG APP 0015

---
title: Android UnCrackable L4
platform: android
source: https://mas.owasp.org/crackmes/Android#android-uncrackable-l4
---

The Radare2 community always dreamed with its decentralized and free currency to allow r2 fans to make payments in places and transfer money between r2 users. A debug version of the r2Pay app has been developed and it will be supported very soon in many stores and websites. Can you verify that this is cryptographically unbreakable?

Hint: Run the APK in a non-tampered device to play a bit with the app.

1. There is a master PIN code that generates green tokens (aka r2coins) on the screen. If you see a red r2coin, then this token won't be validated by the community. You need to find out the 4 digits PIN code and the salt employed as well. Flag: `r2con{PIN_NUMERIC:SALT_LOWERCASE}`
2. There is a "r2pay master key" buried in layers of obfuscation and protections. Can you break the whitebox? Flag: `r2con{ascii(key)}`

**Versions:**

- `v0.9` - Release for OWASP MAS: Source code is available and the compilation has been softened in many ways to make the challenge easier and more enjoyable for newcomers.
- `v1.0` - Release for R2con CTF 2020: No source code is available and many extra protections are in place.

> Created and maintained by [Eduardo Novella](https://github.com/enovella "Eduardo Novella") & [Gautam Arvind](https://github.com/darvincisec "Gautam Arvind"). Special thanks to [NowSecure](https://www.nowsecure.com "NowSecure") for supporting this crackme.
OWASP Mobile Application Security Testing Guide: MASTG APP 0004

---
title: Android UnCrackable L2
platform: android
source: https://mas.owasp.org/crackmes/Android#android-uncrackable-l2
---

This app holds a secret inside. May include traces of native code.

> By [Bernhard Mueller](https://github.com/muellerberndt "Bernhard Mueller"). Special thanks to Michael Helwig for finding and fixing an oversight in the anti-tampering mechanism.
OWASP Mobile Application Security Testing Guide: MASTG APP 0007

---
title: DIVA Android
platform: android
source: https://github.com/payatu/diva-android
---

An app intentionally designed to be insecure which has received updates in 2016 and contains 13 different challenges.
OWASP Mobile Application Security Testing Guide: MASTG APP 0005

---
title: Android UnCrackable L3
platform: android
source: https://mas.owasp.org/crackmes/Android#android-uncrackable-l3
---

The crackme from hell! A secret string is hidden somewhere in this app. Find a way to extract it.

> By [Bernhard Mueller](https://github.com/muellerberndt "Bernhard Mueller").
Special thanks to [Eduardo Novella](https://github.com/enovella "Eduardo Novella") for testing, feedback and pointing out flaws in the initial build(s).
OWASP Mobile Application Security Testing Guide: MASTG APP 0018

---
title: MASTestApp-Android-NETWORK
platform: android
source: https://github.com/sydseter/MASTestApp-Android-NETWORK
---

An Android application designed to include weaknesses related to MASVS-NETWORK.
OWASP Mobile Application Security Testing Guide: MASTG APP 0002

---
title: Android License Validator
platform: android
source: https://mas.owasp.org/crackmes/Android#android-license-validator
---

The Android License Validator is a crackme that implements a key validation function in native code, packaged as a standalone ELF executable for Android devices. Analyzing native code is often more challenging than Java, which is why critical business logic is frequently written this way.

While this sample application may not represent a real-world scenario, it serves as a valuable learning tool to grasp the basics of symbolic execution. These insights can be applied in practical situations, especially when dealing with Android apps that include obfuscated native libraries. In fact, obfuscated code is often put into native libraries specifically to make the process of de-obfuscation more challenging.

> By [Bernhard Mueller](https://github.com/muellerberndt "Bernhard Mueller")
OWASP Mobile Application Security Testing Guide: MASTG APP 0024

---
title: DVIA-v2
platform: ios
source: https://github.com/prateek147/DVIA-v2
---

A vulnerable iOS app, written in Swift with over 15 vulnerabilities.
OWASP Mobile Application Security Testing Guide: MASTG APP 0025

---
title: iOS UnCrackable L1
platform: ios
source: https://mas.owasp.org/crackmes/iOS#ios-uncrackable-l1
---

A secret string is hidden somewhere in this app. Find a way to extract it.

> By [Bernhard Mueller](https://github.com/muellerberndt "Bernhard Mueller")
OWASP Mobile Application Security Testing Guide: MASTG APP 0023

---
title: DVIA
platform: ios
source: http://damnvulnerableiosapp.com/
---

A vulnerable iOS app written in Objective-C which provides a platform to mobile security enthusiasts/professionals or students to test their iOS penetration testing skills.
OWASP Mobile Application Security Testing Guide: MASTG APP 0026

---
title: iOS UnCrackable L2
platform: ios
source: https://mas.owasp.org/crackmes/iOS#ios-uncrackable-l2
---

This app holds a secret inside - and this time it won't be tampered with!

> By [Bernhard Mueller](https://github.com/muellerberndt "Bernhard Mueller")
OWASP Mobile Application Security Testing Guide: MASTG APP 0030

---
title: iBugBazaar
platform: ios
source: https://github.com/payatu/iBugBazaar
---

iBugBazaar is an open-source iOS application intentionally designed to be vulnerable for hands-on security testing and training. It contains more than 20 vulnerabilities (examples include hardcoded credentials, insecure storage and logging, WebView/XSS and redirect issues, insecure HTTP requests and authentication/authorization flaws). See the project README for the full list.
OWASP Mobile Application Security Testing Guide: MASTG APP 0027

---
title: Disable-flutter-tls-verification
platform: ios
source: https://github.com/NVISOsecurity/disable-flutter-tls-verification/blob/main/test_app/pinning.ipa
---

An iOS application designed to verify the @MASTG-TOOL-0101 script, which disables Flutter's TLS verification.
OWASP Mobile Application Security Testing Guide: MASTG APP 0028

---
title: iGoat-Swift
platform: ios
source: https://github.com/OWASP/iGoat-Swift
---

A Swift version of original iGoat Objective C project. Using OWASP iGoat, you can learn exploiting and defending vulnerabilities in iOS Swift applications. It contains many challenges such as:

- Reverse Engineering
- Runtime Analysis
- Data Protection (Rest)
- Data Protection (Transit)
- Key Management
- Tampering
- Injection Flaws
- Broken Cryptography
- Memory Management
- URL Scheme Attack
- Social Engineering
- SSL Pinning
- Authentication
- Jailbreak Detection
- Side Channel Data Leaks
- Cloud Misconfiguration
- Crypto Challenges
OWASP Mobile Application Security Testing Guide: README

# Scripts and Releases

## Overview

This folder contains scripts and assets needed to generate our deliverables.

Files:

- `scripts/`: Directory containing the scripts used for the generation of the MAS deliverables such as the website and the checklists.
- `contributors.py`: Python script to retrieve current contributors and group them into our different categories according to their additions.

## GitHub Actions

Our workflows for GitHub Actions are located in `.github/workflows`.

Usually we don't have to change anything here apart from upgrading the version of the included actions (e.g. `actions/checkout@v2`).

- **Document** (`.github/workflows/docgenerator.yml`) generates:
    - the MAS Checklist using `src/scripts/yaml_to_excel.py`
- **Build Website** (`.github/workflows/build-website.yml`): builds the website and pushes the result to the `gh-pages` branch.
- **Markdown Linter** (`.github/workflows/markdown-linter.yml`): runs a markdown linter using our config `.markdownlint.json` (more about [configuration](https://github.com/igorshubovych/markdownlint-cli#configuration)).
- **URLs Checker** (`.github/workflows/url-checker.yml`, `.github/workflows/url-checker-pr.yml`): runs a URL checker using our config `.github/workflows/config/url-checker-config.json` (this workflow usually gives false positives that we have to exclude in the config).
- **Spell Checker** (`.github/workflows/spell-checker.yml`): runs a spell checker
- **CodeQL Security Scan** (`.github/workflows/codeql-analysis.yml`): to detect security issues in our Python code.
- **Labeler** (`.github/workflows/labeler.yml`): automatically labels PRs based on the files changed and the configuration in `.github/labeler.yml`.

## How to Release

See ["How to Release"](https://github.com/sushi2k/MSTG-MASVS-Internal/blob/main/docs/release/1_How_to_Release.md) (access restricted).
OWASP Mobile Application Security Testing Guide: requirements

pandas==2.3.0
pyyaml==6.0.2
tabulate==0.9.0
requests==2.33.0
lxml==6.1.0
bs4==0.0.2
openpyxl==3.1.5
Pillow==12.2.0
semgrep
frida
frida-tools
frooky
r2pipe
OWASP Mobile Application Security Testing Guide: 0x05j Testing Resiliency Against Reverse Engineering

---
masvs_category: MASVS-RESILIENCE
platform: android
---

# Android Anti-Reversing Defenses

## Overview

**General Disclaimer:**

The **lack of any of these measures does not cause a vulnerability** - instead, they are meant to increase the app's resilience against reverse engineering and specific client-side attacks.

None of these measures can assure a 100% effectiveness, as the reverse engineer will always have full access to the device and will therefore always win (given enough time and resources)!

For example, preventing debugging is virtually impossible. If the app is publicly available, it can be run on an untrusted device that is under full control of the attacker. A very determined attacker will eventually manage to bypass all the app's anti-debugging controls by patching the app binary or by dynamically modifying the app's behavior at runtime with tools such as Frida.

You can learn more about principles and technical risks of reverse engineering and code modification in these OWASP documents:

- [OWASP Architectural Principles That Prevent Code Modification or Reverse Engineering](https://wiki.owasp.org/index.php/OWASP_Reverse_Engineering_and_Code_Modification_Prevention_Project "OWASP Architectural Principles That Prevent Code Modification or Reverse Engineering")
- [OWASP Technical Risks of Reverse Engineering and Unauthorized Code Modification](https://wiki.owasp.org/index.php/Technical_Risks_of_Reverse_Engineering_and_Unauthorized_Code_Modification "OWASP Technical Risks of Reverse Engineering and Unauthorized Code Modification")