OWASP Mobile Security Testing Guide

=Main=



{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
 * valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

The OWASP Mobile Security Testing Guide
The goal of this project is to create a comprehensive methodology that covers the processes, techniques, and tools used during a mobile app security test, and defines a complete set of test cases that enables testers to deliver consistent and complete results. Key topics explained in the guide are:


 * 1) Mobile platform internals
 * 2) Basic white-box and black-box security testing
 * 3) Mobile reverse engineering and tampering
 * 4) Assessing software protections

The MSTG also contains 96 detailed test cases that can be used to verify each of the requirements in the OWASP Mobile Application Verification Standard (MASVS). Currently, we support iOS and Android. The guide is however structured such that additional mobile operating systems can be integrated easily.

Where to Download
The MSTG is an a pre-release state and not yet ready for release. Currently, we aim for a first pre-release in Q1 2017. You can however access the existing content in the GitHub Repo.

Licensing
The guide is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.


 * valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

Project Leaders
Bernhard Mueller

Sven Schleier

Project Initiators
Milan Singh Thakur

Parent Project
OWASP_Mobile_Security_Project


 * }

=FAQs=

How can I participate in your project?
First of all, read the author's guide and decide in what for you would like to contribute. Then, contact the lead author responsible for the chapter you are interested in. You can find their name and GitHub handle in the [README https://github.com/OWASP/owasp-mstg/blob/master/README.md]. Please always check with the responsible person first, or you might end up working on a chapter that's already being done by someone else. In any case, we encourage you to join OWASP Mobile Security Project Slack Channel, where you'll find all the other project members. You can sign up for an account here:



The home of the OWASP Mobile Security Testing Guide is on GitHub. You are encourged to fork, edit and push your changes back to the project through git or edit the project directly on github.

If I am not a programmer can I participate in your project?
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.

= Acknowledgements =

Contributors
The OWASP Security Principles project is developed by a worldwide team of volunteers. A live update of project contributors is found here.

The first contributor and initiator of the project was:


 * Milan Singh Thakur

The new versions contributors are:
 * Bernhard Mueller
 * Stefan Streichsbier
 * Stephen Corbiaux
 * Stephanie Vanroelen
 * Francesco Stillavato
 * Sven Schleier
 * Gerhard Wagner
 * Jeroen Willemsen
 * Abdessamad Temmar
 * YOUR NAME BELONGS HERE

= Road Map and Getting Involved =

Q2 2017: Beta release Q3 2017: Version 1.0

A project roadmap is the envisioned plan for the project. The purpose of the roadmap is to help others understand where the project is going. It gives the community a chance to understand the context and the vision for the goal of the project. Additionally, if a project becomes inactive, or if the project is abandoned, a roadmap can help ensure a project can be adopted and continued under leadership.

As of November 2016, the priorities are:
 * Finish the referencing for each principle.
 * Update the Project Template.
 * Use the OWASP Press to develop a book.
 * Finish and publish the book on Lulu.

Involvement in the development and promotion of the OWASP Security Principles Project is actively encouraged! You do not have to be a security expert in order to contribute. Some of the ways you can help:
 * Helping find references to some of the principles.
 * Project administration support.
 * Wiki editing support.
 * Writing support for the book.

=Project About=

To be completed.