31 Oct 08:36

7172dfa

v1.7.0 Latest

Latest

MASTG Refactor Part 2: Techniques, Tools & Reference Apps: This release introduces the second phase of the MASTG (Mobile Application Security Testing Guide) refactor. These changes aim to enhance the usability and accessibility of the MASTG.

The primary focus of this new refactor is the reorganization of the MASTG content into different components, each housed in its dedicated section/folder and existing now as individual pages in our website (markdown files with metadata/frontmatter in GitHub):

NOTE: You may find broken links on the website and in the PDF/eBook. This is a consequence of these massive changes and we expect to be able to fix them soon.

Tests:
- Website: Tests section.
- GitHub: tests/ folder.
- Identified by IDs in the format MASTG-TEST-XXXX.
- Includes all tests originally in:
  - 0x05d/0x06d-Testing-Data-Storage.md
  - 0x05e/0x06e-Testing-Cryptography.md
  - 0x05f/0x06f-Testing-Local-Authentication.md
  - 0x05g/0x06g-Testing-Network-Communication.md
  - 0x05h/0x06h-Testing-Platform-Interaction.md
  - 0x05i/0x06i-Testing-Code-Quality-and-Build-Settings.md
  - 0x05j/0x06j-Testing-Resiliency-Against-Reverse-Engineering.md
- ⚠️ IMPORTANT (TODO): These tests are still the original MASTG v1.6.0 tests. We will progressively split them into smaller tests, the so-called "atomic tests" in MASTG v2 and assign the new MAS profiles accordingly.
Techniques:
- Website: Techniques section.
- GitHub: techniques/ folder.
- Identified by IDs in the format MASTG-TECH-XXXX.
- Includes all techniques originally in:
  - 0x05b/0x06b-Basic-Security_Testing.md
  - 0x05c/0x06c-Reverse-Engineering-and-Tampering.md
Tools:
- Website: Tools section.
- GitHub: tools/ folder.
- Identified by IDs in the format MASTG-TOOL-XXXX.
- Includes all tools from:
  - 0x08a-Testing-Tools.md
Apps:
- Website: Apps section.
- GitHub: apps/ folder.
- Identified by IDs in the format MASTG-APP-XXXX.
- Includes all apps from:
  - 0x08b-Reference-Apps.md

We hope that the revamped structure enables you to navigate the MASTG more efficiently and access the information you need with ease. See below for a detailed list of changes.

We'd like to thank all of our loyal contributors and welcome our new contributors.

Special thanks to NowSecure for their consistent high-impact contributions to the project, especially for this new OWASP MASTG refactoring phase and for continuing spreading the word about the OWASP MAS project.

We'd also like to thank our new MAS Advocate applicants for waiting patiently while we get everything ready behind the scenes for them to help us efficiently.

💙 Thanks to Zimperium for their generous donation!

Carlos Holguera, Sven Schleier and Jeroen Beckers - OWASP MAS project

NOTE: the OWASP MASTG v1.7.0 relies on the latest MASVS v2.0.0

Help us improve! questions | ideas | contact

What's Changed

📢 News

Introducing the new MAS Testing Profiles and MASTG Atomic Tests proposals by @cpholguera in #2424
Add news about the MAS Score Formula Proposal by @cpholguera in #2436
News: MASVS-PRIVACY by @cpholguera in #2459

🧪 MASTG Test Cases

Proofreading fixes 0x05d part 4 by @Laancelot in #2414
[ios_0x06d/0055] Fix the description of the keyboard cache location by @sohsatoh in #2416
Update Android permission protection levels and introduced risk categories (by @nowsecure) by @cpholguera in #2423
Proofreading fixes 0x05d part 3 by @Laancelot in #2413
Proofreading fixes 0x05d part 1 (by @nowsecure) by @cpholguera in #2427
Proofreading fixes 0x05e part 1 (by @nowsecure) by @cpholguera in #2426

📖 MASTG Testing Fundamentals

Introduce App Attest by @lihter in #2462

✨ MASTG Testing Techniques

Taint analysis for Android Java code by @su-vikas in #2390

🪄 MASTG Testing Tools

Replace Passionfruit with Grapefruit by @lihter in #2451
Update r2frida guide examples to use : instead of \ for command start by @Shiva953 in #2450

📜 Mobile Security Checklists

Changed value of status_cells in yaml_to_excel.py by @bl13pbl03p in #2417

🎉 New Donators

Add Zimperium to God Mode Donators by @sushi2k in #2440

Other Changes

Consolidate Contributors in the MAS Website by @sushi2k in #2392
Fix broken download button in overview page by @ploar-bear in #2410
UnCrackable L1 Solution using MobSF by @Xhoenix in #2421
Update MASTG-TEST-0087 "Make Sure That Free Security Features Are Activated" (by @nowsecure) by @cpholguera in #2430
MASTG Refactor Part 2: Techniques, Tools & Reference Apps (by @nowsecure) by @cpholguera in #2439

New Contributors

@ploar-bear made their first contribution in #2410
@bl13pbl03p made their first contribution in #2417
@Xhoenix made their first contribution in #2421
@lihter made their first contribution in #2451
@Shiva953 made their first contribution in #2450

Full Changelog: v1.6.0...v1.7.0

Contributors

Laancelot, sushi2k, and 9 other contributors

Assets 5

08 May 10:20

github-actions

v1.6.0

1271f4b

v1.6.0

Following up on the OWASP MASVS v2.0.0 Release we're excited to announce the release of the new OWASP MASTG version v1.6.0. This update includes a range of new features, including the first phase of the MASTG refactoring, MASVS color-coding, upgraded MAS Checklists (for OWASP MASVS v2.0.0 + MASTG v1.6.0), and much more. See below for a detailed list of changes.

We'd like to thank all of our loyal contributors and welcome our new contributors.

Special thanks to NowSecure for their consistent high-impact contributions to the project, especially for the MASVS refactoring, the OWASP MASTG refactoring, the OWASP MAS website and this MASTG v1.6.0 release and for continuing spreading the word about the OWASP MAS project.

💙 Thanks to dvuln, eShard, OHRUS and devoteam Cyber Trust for their generous donations!

Carlos Holguera, Sven Schleier and Jeroen Beckers - OWASP MAS project

NOTE: the OWASP MASTG v1.6.0 relies on the latest MASVS v2.0.0

Help us improve! questions | ideas | contact