OWASP MASTG Full Checklist
Complete mapping of OWASP Mobile Application Security Testing Guide (MASTG) test cases to MCP tools, Frida scripts, and expected findings.
MASVS-STORAGE: Data Storage
MASTG-TEST-0001: Testing Local Storage for Sensitive Data
Objective: Verify sensitive data is not stored insecurely in local storage.
MCP Tools:
dump_shared_prefs("com.target.app")
dump_databases("com.target.app")
dump_internal_storage("com.target.app")Frida Scripts: credential_hooks.js
Expected Findings:
| Data Type | Severity |
|---|---|
| Plaintext passwords | Critical |
| Authentication tokens | High |
| Session IDs | High |
| Encryption keys | Critical |
| PII (SSN, credit cards) | High |
Finding Format:
Title: Sensitive Data Stored in Plaintext
Severity: High/Critical
Location: /data/data/com.target.app/shared_prefs/auth.xml
Evidence: auth_token=eyJhbGciOiJIUzI1NiIs...MASTG-TEST-0002: Testing Local Storage for Input Validation
Objective: Test if input validation prevents injection into storage.
MCP Tools:
dump_databases("com.target.app")
frida_run_script(pid, "dynamic_dex_hooks.js")Frida Scripts: Custom SQL monitoring
Expected Findings:
- SQL injection in database queries
- Unvalidated input stored directly
MASTG-TEST-0003: Testing for Sensitive Data in External Storage
Objective: Check if sensitive data is stored on external storage.
MCP Tools:
dump_external_storage("com.target.app")Expected Findings:
| Data Type | Severity |
|---|---|
| Credentials on SD card | High |
| PII on external storage | Medium |
| Sensitive docs world-readable | High |
MASTG-TEST-0004: Testing for Sensitive Data in Logs
Objective: Verify no sensitive data is logged.
MCP Tools:
get_logcat("com.target.app")Expected Findings:
| Log Content | Severity |
|---|---|
| Passwords in logs | High |
| API keys in logs | High |
| User data in logs | Medium |
MASTG-TEST-0005: Testing Backups for Sensitive Data
Objective: Test if backup contains sensitive data.
MCP Tools:
get_app_info("com.target.app") # Check allowBackup flagManual Test:
adb backup -f backup.ab com.target.app
java -jar abe.jar unpack backup.ab backup.tarExpected Findings:
- allowBackup=true with sensitive data
- No backup rules excluding sensitive files
MASTG-TEST-0006: Testing Memory for Sensitive Data
Objective: Verify sensitive data is cleared from memory.
MCP Tools:
frida_memory_search(pid, "password")
frida_memory_search(pid, "secret_key")Expected Findings:
- Credentials in memory after logout
- Encryption keys not zeroed
MASTG-TEST-0007: Testing WebViews for Sensitive Data
Objective: Check WebView doesn't leak sensitive data.
MCP Tools:
frida_run_script(pid, "webview_hooks.js")Expected Findings:
| Issue | Severity |
|---|---|
| JavaScript interface exposing data | High |
| File access enabled | High |
| Cookies with sensitive data | Medium |
MASVS-CRYPTO: Cryptography
MASTG-TEST-0013: Testing the Configuration of Cryptographic Standard Algorithms
Objective: Verify proper cryptographic algorithms are used.
MCP Tools:
frida_run_script(pid, "crypto_hooks.js")Frida Scripts: crypto_hooks.js
Expected Findings:
| Issue | Severity |
|---|---|
| Hardcoded encryption key | Critical |
| DES/3DES usage | High |
| ECB mode | High |
| MD5/SHA1 for security | High |
| Weak key derivation | Medium |
MASTG-TEST-0014: Testing the Use of Deprecated or Weak Cryptographic Algorithms
Objective: Identify weak cryptographic implementations.
Static Analysis:
grep -rniE "(DES|RC4|MD5|SHA1|ECB)" jadx_output/Expected Findings:
- Use of DES/3DES
- Use of RC4
- MD5 for password hashing
- ECB mode encryption
MASTG-TEST-0015: Testing Random Number Generation
Objective: Verify secure random number generation.
Static Analysis:
grep -rni "java.util.Random" jadx_output/Expected Findings:
| Issue | Severity |
|---|---|
| java.util.Random for crypto | High |
| Predictable seed | High |
MASVS-AUTH: Authentication
MASTG-TEST-0016: Testing Local Authentication
Objective: Verify local authentication security.
MCP Tools:
frida_run_script(pid, "biometric_bypass.js")
frida_run_script(pid, "credential_hooks.js")Frida Scripts: biometric_bypass.js
Expected Findings:
| Issue | Severity |
|---|---|
| Biometric bypass possible | High |
| No server verification | Critical |
| Client-side session validation | High |
| Weak PIN storage | High |
MASTG-TEST-0017: Testing Session Management
Objective: Verify proper session management.
MCP Tools:
frida_hook_method(pid, "com.target.app.SessionManager", "*")Expected Findings:
| Issue | Severity |
|---|---|
| No session timeout | Medium |
| Session not invalidated on logout | Medium |
| Token reuse after logout | High |
MASTG-TEST-0018: Testing Multi-Factor Authentication
Objective: Verify MFA implementation security.
MCP Tools:
frida_run_script(pid, "credential_hooks.js")Expected Findings:
| Issue | Severity |
|---|---|
| MFA bypass possible | Critical |
| Weak OTP generation | High |
| No rate limiting on MFA | Medium |
MASVS-NETWORK: Network Communication
MASTG-TEST-0019: Testing for Cleartext Traffic
Objective: Verify no sensitive data sent over cleartext.
MCP Tools:
capture_traffic_start("com.target.app")
frida_run_script(pid, "network_hooks.js")Frida Scripts: network_hooks.js
Expected Findings:
| Issue | Severity |
|---|---|
| HTTP for sensitive data | High |
| Cleartext traffic allowed | High |
MASTG-TEST-0020: Testing the TLS Configuration
Objective: Verify proper TLS configuration.
Manual Test:
testssl.sh api.target.comExpected Findings:
| Issue | Severity |
|---|---|
| TLS 1.0/1.1 enabled | Medium |
| Weak cipher suites | Medium |
| No HSTS | Low |
MASTG-TEST-0021: Testing for Certificate Pinning
Objective: Verify certificate pinning implementation.
MCP Tools:
frida_bypass_ssl(pid)
# If bypass succeeds, pinning is weakFrida Scripts: ssl_pinning_bypass.js
Expected Findings:
| Issue | Severity |
|---|---|
| No certificate pinning | Medium |
| Pinning easily bypassed | Low |
MASVS-PLATFORM: Platform Interaction
MASTG-TEST-0022: Testing for IPC Vulnerabilities
Objective: Test exported components for vulnerabilities.
MCP Tools:
list_exported_components("com.target.app")
launch_activity("com.target.app", ".ExportedActivity", extras={...})
send_broadcast("com.target.app.ACTION", extras={...})
query_content_provider("content://com.target.app.provider/...")Frida Scripts: intent_monitor.js
Expected Findings:
| Issue | Severity |
|---|---|
| Exported component without permission | High |
| Intent injection | Medium |
| Broadcast injection | Medium |
MASTG-TEST-0023: Testing for Content Provider Vulnerabilities
Objective: Test content providers for SQL injection and path traversal.
MCP Tools:
query_content_provider("content://com.target.app.provider/users' OR '1'='1")
query_content_provider("content://com.target.app.provider/../../../etc/passwd")Expected Findings:
| Issue | Severity |
|---|---|
| SQL injection | Critical |
| Path traversal | High |
| Unprotected provider | High |
MASTG-TEST-0024: Testing Deep Links
Objective: Test deep link handling security.
MCP Tools:
launch_activity("com.target.app", ".DeepLinkActivity",
data_uri="targetapp://action?param=<script>alert(1)</script>")Expected Findings:
| Issue | Severity |
|---|---|
| Deep link injection | High |
| Open redirect | Medium |
| XSS via deep link | High |
MASTG-TEST-0025: Testing WebViews
Objective: Test WebView security configuration.
MCP Tools:
frida_run_script(pid, "webview_hooks.js")Frida Scripts: webview_hooks.js
Expected Findings:
| Issue | Severity |
|---|---|
| JavaScript interface abuse | High |
| File access enabled | High |
| XSS in WebView | High |
MASVS-CODE: Code Quality
MASTG-TEST-0026: Testing for Debugging Code and Verbose Logging
Objective: Verify no debug code in production.
MCP Tools:
get_app_info("com.target.app") # Check debuggable flag
get_logcat("com.target.app")Expected Findings:
| Issue | Severity |
|---|---|
| Debuggable flag true | Critical |
| Debug logs in production | Medium |
| Verbose error messages | Low |
MASTG-TEST-0027: Testing for Reverse Engineering Protections
Objective: Assess anti-reverse engineering measures.
MCP Tools:
frida_bypass_root(pid) # Test root detection
frida_run_script(pid, "anti_tampering_bypass.js")Frida Scripts: root_bypass.js, anti_tampering_bypass.js
Expected Findings:
| Check | Status |
|---|---|
| Root detection | Present/Absent |
| Emulator detection | Present/Absent |
| Debugger detection | Present/Absent |
| Obfuscation | Present/Absent |
MASTG-TEST-0028: Testing for Dynamic Code Loading
Objective: Test dynamic code loading security.
MCP Tools:
frida_run_script(pid, "dynamic_dex_hooks.js")Frida Scripts: dynamic_dex_hooks.js
Expected Findings:
| Issue | Severity |
|---|---|
| Unverified DEX loading | High |
| Code from external storage | High |
| No signature verification | High |
Quick Reference: MASTG Test Coverage
| MASTG ID | Category | MCP Tools | Frida Script |
|---|---|---|---|
| TEST-0001 | Storage | dump_* | credential_hooks.js |
| TEST-0002 | Storage | dump_databases | - |
| TEST-0003 | Storage | dump_external_storage | - |
| TEST-0004 | Storage | get_logcat | - |
| TEST-0005 | Storage | get_app_info | - |
| TEST-0006 | Storage | frida_memory_search | - |
| TEST-0007 | Storage | frida_run_script | webview_hooks.js |
| TEST-0013 | Crypto | frida_run_script | crypto_hooks.js |
| TEST-0014 | Crypto | Static analysis | crypto_hooks.js |
| TEST-0015 | Crypto | Static analysis | - |
| TEST-0016 | Auth | frida_run_script | biometric_bypass.js |
| TEST-0017 | Auth | frida_hook_method | credential_hooks.js |
| TEST-0018 | Auth | frida_run_script | - |
| TEST-0019 | Network | capture_traffic_* | network_hooks.js |
| TEST-0020 | Network | Manual | - |
| TEST-0021 | Network | frida_bypass_ssl | ssl_pinning_bypass.js |
| TEST-0022 | Platform | list_exported_components | intent_monitor.js |
| TEST-0023 | Platform | query_content_provider | - |
| TEST-0024 | Platform | launch_activity | - |
| TEST-0025 | Platform | frida_run_script | webview_hooks.js |
| TEST-0026 | Code | get_app_info, get_logcat | - |
| TEST-0027 | Code | frida_bypass_root | anti_tampering_bypass.js |
| TEST-0028 | Code | frida_run_script | dynamic_dex_hooks.js |
Severity Classification
| Severity | Description | Examples |
|---|---|---|
| Critical | Direct compromise possible | Hardcoded keys, SQL injection |
| High | Significant data exposure | Plaintext credentials, XSS |
| Medium | Partial data exposure | Missing pinning, weak crypto |
| Low | Minor issues | Missing headers, info disclosure |
| Info | Informational | Best practice recommendations |