What is OWASP MASTG?
The OWASP Mobile Application Security Testing Guide (MASTG) is the manual for how to test a mobile app. Where MASVS lists the requirements, MASTG explains the techniques and checks an analyst uses to confirm each one on a real Android or iOS app.
It was previously known as the MSTG. It covers static and dynamic testing, reverse engineering and the platform-specific details of both Android and iOS.
How MASVS and MASTG work together
The two are a pair. MASVS gives you the requirement ("sensitive data is stored securely"); MASTG gives you the test ("here is how to check on-device storage on Android and iOS"). Together they turn "is this app secure?" into a repeatable, evidenced process.
How Mobexa uses MASTG
Mobexa automates the kinds of checks the MASTG describes across the build you ship, then maps each result back to the MASVS requirement it verifies. You get repeatable coverage of the testing guide without running every test by hand, and a clear trail from finding to standard.
Common questions
Is MASTG the same as MSTG?
Do I need to run every MASTG test manually?
Mobexa maps every finding on your Android and iOS builds to OWASP MASTG and the other standards an auditor recognises.
Start Free Trial