OWASP MASTG (Mobile Application Security Testing Guide), explained

Last updated: 2026-10-28

The OWASP Mobile Application Security Testing Guide (MASTG) is, per OWASP's own MASVS documentation, the resource that "describes the technical processes for verifying the controls listed in the MASVS." It is maintained by the OWASP Mobile Application Security (MAS) project and, per its GitHub description, serves as "a comprehensive manual for mobile app security testing and reverse engineering" covering Android and iOS apps. Where MASVS is the checklist of what to verify, MASTG is the how: concrete test procedures, tooling, and worked demonstrations for each control.

A modular guide, not a single document

MASTG's structure changed substantially with v2.0.0, released 30 June 2026. Per the project's GitHub release notes, this release completed a multi-year refactor that broke the guide out of large per-topic markdown pages into individually referenceable, machine-readable components, each with its own stable identifier and cross-links to the MASVS control and MASWE weakness it addresses:

Component type	Count at v2.0.0
Tests (`MASTG-TEST-####`)	193
Techniques	167
Knowledge-base articles	140
Best practices	72
Demos	152
Tools	135

These figures are a snapshot of the v2.0.0 release specifically — the guide is under continuous development, so current totals should be read on the live site rather than assumed to stay fixed at these numbers.

MASWE: the missing middle layer

For years, MASVS and MASTG stood as a two-piece system: control, then test. MASWE (Mobile Application Security Weakness Enumeration) fills the gap between them with a catalog of specific, named weaknesses — for example MASWE-0001, "Sensitive Data Stored Unencrypted in Private Storage" — each mapped back to the MASVS control it violates and forward to the MASTG test(s) that can detect it. OWASP announced MASWE v1.0.0 in a MAS-project blog post dated 17 August 2026, "MASWE v1.0.0 is Here." Read together, the three pieces now form a chain: MASVS states the control, MASWE names the concrete failure mode, and MASTG supplies the test that proves whether that failure is present in a given app.

Scope: native apps first

Per the MASTG's own overview, the guide focuses primarily on native Android and iOS apps rather than attempting exhaustive coverage of every cross-platform framework, on the basis that the underlying techniques — storage inspection, traffic interception, binary analysis, runtime instrumentation — carry over to hybrid and web-based mobile apps even when the framework-specific tooling differs. Teams testing a Flutter, React Native, or WebView-heavy app should expect to adapt MASTG's native test procedures rather than find a framework-specific walkthrough for every case.

License and OWASP's stance on certification

The MASTG is free to read at mas.owasp.org and licensed, per the OWASP/mastg GitHub repository, under Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) — the same license OWASP applies to MASVS. As with MASVS, OWASP does not certify vendors, testers, or software against the MASTG; any third party's claim of running "MASTG-based" or "MASTG-certified" testing is that party's own characterization of their process, not an OWASP-issued credential.

Where this fits for device makers

A companion mobile app for setup, pairing, or firmware updates is now standard on most connected devices, and it is frequently assessed far less rigorously than the firmware or hardware it controls. Teams that already use MASVS as the control baseline for that companion app can use MASTG as the concrete test plan: pick the MASVS controls relevant to the app's MAS Profile, then follow the matching MASTG tests rather than inventing ad hoc test steps. Firmware teams tracking CWE Top 25 weaknesses in embedded code gain a parallel, test-procedure-level resource for the mobile side of the same product.

SoftWSP's device and firmware assessments can extend to a product's companion mobile app, running it against MASTG-style test procedures rather than leaving the app as an unassessed gap next to a hardened firmware image: see device & firmware security services.

This guide summarises a public OWASP publication; it does not constitute legal or compliance advice.

Frequently asked questions

What is the OWASP MASTG?

The Mobile Application Security Testing Guide (MASTG) is OWASP's companion resource to the Mobile Application Security Verification Standard (MASVS): per OWASP's own MASVS documentation, the MASTG "describes the technical processes for verifying the controls listed in the MASVS." Where MASVS states *what* a mobile app should do to be considered secure, the MASTG supplies the *how* — concrete, per-platform test procedures for Android and iOS, organized around the same eight control categories (MASVS-STORAGE, -CRYPTO, -AUTH, -NETWORK, -PLATFORM, -CODE, -RESILIENCE, -PRIVACY). The project's own GitHub description states it "is a comprehensive manual for mobile app security testing and reverse engineering."

What changed in MASTG v2.0.0, and how is the guide structured now?

MASTG v2.0.0, released 30 June 2026 per the OWASP/mastg GitHub release page, marks the completion of a multi-year refactor that broke the guide apart from large per-topic markdown pages into individually referenceable, machine-readable components: discrete tests (each with its own MASTG-TEST-#### identifier), techniques, tools, best practices, demos, and knowledge-base articles, all cross-linked to the MASVS control and MASWE weakness they address. At the v2.0.0 release, the GitHub release notes put the totals at 193 tests, 152 demos, 167 techniques, 140 knowledge articles, 72 best practices, and 135 tools — counts that are a snapshot of that specific release and will have grown since, since the guide is under continuous development.

What is MASWE, and how does it relate to MASVS and MASTG?

MASWE (Mobile Application Security Weakness Enumeration) is a separate OWASP catalog of specific, named mobile-app weaknesses (for example MASWE-0001, "Sensitive Data Stored Unencrypted in Private Storage"), each mapped to the MASVS control it violates and to the MASTG test(s) that can detect it. OWASP announced MASWE v1.0.0 in a MAS-project blog post dated 17 August 2026, titled "MASWE v1.0.0 is Here." In effect, MASWE sits in the middle of the other two standards: MASVS states the control, MASWE names the concrete way that control can fail, and MASTG supplies the test procedure that proves whether the failure is present.

Who maintains the MASTG, and is it free to use?

The MASTG is maintained by the OWASP Mobile Application Security (MAS) project — the same project that maintains MASVS and MASWE — as an open OWASP Flagship project on GitHub (OWASP/mastg). It is fully free to read online at mas.owasp.org, and OWASP licenses the repository under Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0), matching the license OWASP applies to the MASVS. As with MASVS, OWASP does not certify vendors, testers, or tools against the MASTG; a third party's claim of "MASTG-based" testing is that party's own characterization, not an OWASP endorsement.