mastg

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.

The OWASP MASVS (Mobile Application Security Verification Standard) is the industry standard for mobile app security.

A collection of Semgrep rules derived from the OWASP MASTG specifically for Android applications.

Mobile Application Security Design Guide

Script to perform IPA Binary Analysis

📱 Damn Vulnerable Mobile App - a single Flutter codebase that builds real native iOS & Android binaries with 200+ intentionally-vulnerable modules mapped to OWASP MASVS/MASTG, Mobile Top 10, CWE, plus LLM & Agentic AI Top 10. For mobile security training, pentest practice, and scanner validation.

Den gesamten OWASP Mobile Application Security Standard als KI-Skill für Claude – nutzbar von Auditoren, Entwicklern, Architekten und Prüfern.

Which OWASP MASVS v2.1 controls a machine can decide, and which still need a human. 2 of 24 are fully automatable, with the reason for each.

Android APK static security analyzer — MASTG-aligned, from-scratch binary-AXML decoder, zero dependencies.

Damn Vulnerable Swift Application for iOS

Engagement authorization & scope enforcement for authorized mobile security testing (signed scope, ROE gating, tamper-evident audit log).

Security assessment of the Yoosee v6.44.1 Android app: DAST scripts and OWASP MASVS remediation

Terminal viewer for the latest OWASP Web Security and Mobile App Security Testing Guides

Mobile security toolkit for React Native: runtime root/jailbreak, debugger, hooking and integrity checks on Android and iOS, a static auditor with OWASP MASVS/CWE mappings and SARIF output, and AI-assisted review through your own model via MCP.

Mobile app static analysis harness for APK & IPA — orchestrates apktool, jadx, gitleaks, semgrep with LLM-powered triage

Android remote administration tool

A complete Android penetration testing learning repository — OWASP MASVS v2.1.0 mapped, 12 exploitation labs, cheat sheets, checklists, and reporting templates.

Self-hostable, open-source Android app-security training platform where every task auto-graded on a real Android emulator, aligned to OWASP MASVS/MASTG.