mastg

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.

The OWASP MASVS (Mobile Application Security Verification Standard) is the industry standard for mobile app security.

A collection of Semgrep rules derived from the OWASP MASTG specifically for Android applications.

Mobile Application Security Design Guide

Script to perform IPA Binary Analysis

Android APK static security analyzer — MASTG-aligned, from-scratch binary-AXML decoder, zero dependencies.

Android remote administration tool

Damn Vulnerable Swift Application for iOS

Engagement authorization & scope enforcement for authorized mobile security testing (signed scope, ROE gating, tamper-evident audit log).

Terminal viewer for the latest OWASP Web Security and Mobile App Security Testing Guides

Mobile security toolkit for React Native: runtime root/jailbreak, debugger, hooking and integrity checks on Android and iOS, a static auditor with OWASP MASVS/CWE mappings and SARIF output, and AI-assisted review through your own model via MCP.

Self-hostable, open-source Android app-security training platform — every task auto-graded on a real Android emulator, aligned to OWASP MASVS/MASTG.