What is mastg?

The OWASP Mobile Application Security Testing Guide, commonly called MASTG, is a free reference manual for testing the security of mobile apps on Android and iOS. It is produced by OWASP, a nonprofit foundation focused on software security, and is considered one of the most widely recognized resources in the mobile security field. The guide works alongside two companion documents. The first is the OWASP Mobile Application Verification Standard (MASVS), which defines the security controls a mobile app should meet. The second is the OWASP Mobile Security Weakness Enumeration (MASWE), which catalogs specific types of security weaknesses. MASTG provides the step-by-step testing procedures that show how to check for each weakness listed in MASWE. Practitioners use this guide to verify that a mobile app handles sensitive data, authentication, network communication, and device storage correctly. It covers both dynamic analysis (testing the app while it runs) and reverse engineering techniques that help examine how an app is built without access to the original source code. The project publishes downloadable checklists alongside the guide itself, making it possible to track which security requirements have been verified during an audit. It also offers a set of practice exercises called crackmes for people who want to improve their hands-on testing skills. Platform providers, government agencies, and universities have adopted the MASVS and MASTG as formal references. The project is licensed under Creative Commons and accepts contributions from the broader security community.