OWASP MASTG

MASTG, the OWASP Mobile Application Security Testing Guide, is OWASP's manual for testing mobile apps against the Mobile Application Security Verification Standard (MASVS). Where MASVS defines what a secure app must do, MASTG defines exactly how to verify it, with hundreds of concrete test cases, one or more per MASVS control, for both iOS and Android.

MASTG isn't a short document. Its scope spans dedicated test procedures, best-practice recommendations, platform-specific knowledge base articles, and reproducible demos with working code, all cross-linked back to the MASVS control and the MASWE weakness each one verifies.

What does MASTG stand for?

MASTG stands for Mobile Application Security Testing Guide. It's maintained by the OWASP Mobile Application Security (MAS) project, the same group behind MASVS and MASWE, as a nonprofit, community-authored, vendor-neutral resource.

Before an August 2022 rebrand, the broader project was known as the OWASP Mobile Security Testing Guide (MSTG); the guide carries that lineage under its current name.

MASTG vs. MAST: same root, different thing

These two get confused constantly, understandably, since the acronyms differ by a single letter.

MAST (Mobile Application Security Testing) is a general industry term. It describes the category of testing that combines binary analysis, runtime analysis, and API testing to cover a mobile app the way it actually ships, compiled and running on a device, not just as source code sitting in a repository. No single organization owns the term, and no version number applies to it.

MASTG (Mobile Application Security Testing Guide) is a specific, versioned OWASP document. It's the detailed how-to manual: hundreds of numbered test cases, best practices, and demos, maintained by OWASP and cross-referenced to MASVS controls.

A useful way to hold the two apart: MAST is the category of testing Appknox performs. MASTG is the specific OWASP manual that documents how to perform parts of it. An app can undergo MAST without a single MASTG test case being invoked by name, and a tester can follow MASTG line by line while only covering the static and dynamic analysis slice of what a full MAST program includes.

For the broader testing category, see What is MAST?

Why MASTG matters

MASVS states requirements in a sentence: "The app performs local authentication using the platform APIs." That sentence doesn't say which command to run, which log to check, or which code pattern to search for. MASTG closes that gap.

Without a shared testing guide, two testers evaluating the same MASVS control could reach different conclusions using different methods, and neither would be wrong, exactly, just inconsistent. MASTG's role is to make mobile security testing reproducible: the same control, tested the same way, regardless of which tester or firm runs it.

What's inside MASTG

Tests

The core of MASTG: specific procedures for verifying a MASVS control, split by platform. MASTG-TEST-0022, "Testing Custom Certificate Stores and Certificate Pinning," is an example; it tells a tester exactly what to check and how, for the corresponding MASVS-NETWORK control.

Best practices

Prescriptive, numbered recommendations, framed as "do this" rather than "check for this." MASTG-BEST-0001, "Use Secure Random Number Generator APIs," is an example: a specific instruction a developer can follow before a test ever runs.

Knowledge

Background reference material on platform-specific mechanisms, Android's KeyStore, iOS's Keychain Services, and WebView behavior, that a tester needs to understand before a test makes sense.

Demos

Reproducible, working code samples showing the vulnerable pattern itself, plus the specific tool used to find it, Frida, semgrep, or radare2 depending on the platform and check, rather than a written description alone.

What changed in the MASTG v2 refactor

MASTG completed a multi-year restructuring in June 2026, reaching version 2.0.0, its first stable, non-beta release under the new structure.

Before the refactor, MASTG was a single, continuous reference document. A chapter on a topic like certificate pinning or anti-debugging could run for hundreds of lines, combining background context, static-analysis steps, dynamic-analysis steps, and bypass techniques into a single continuous narrative. Useful, but not built for automation, and not easy to pull one specific check out of.

The v2 structure breaks that into the separately referenceable components described above: tests, best practices, knowledge articles, and demos, each with its own ID, each cross-linked to the specific MASVS control and MASWE weakness it addresses. That structure is what makes it realistic for a platform to map an automated finding to an exact MASTG test case rather than a general chapter.

MASTG vs. MASVS vs. MASWE

MASTG is the third leg of the structure covered in full on the MASVS glossary page: MASVS sets the requirement, MASWE names the specific weakness, MASTG supplies the test that catches it.

For the full breakdown of how the three connect,

See: What is MASVS?

Where Appknox fits

MASTG's hundreds of test cases don't run themselves at enterprise scale; that's the actual argument for automation. Appknox's Automated Vulnerability Assessment maps its binary SAST, AI-led DAST, and API security testing findings to the specific MASTG test ID each one corresponds to, so a report reads as coverage against a named, citable OWASP procedure rather than a vendor's internal severity label.

KnoxIQ then scores how exploitable those findings are in the specific app, since passing every MASTG test in isolation doesn't guarantee the combination is safe in practice.

See the full testing methodology: Appknox Automated Vulnerability Assessment.

Frequently asked questions

What does MASTG stand for?

MASTG stands for Mobile Application Security Testing Guide, OWASP's manual for testing mobile apps against the MASVS standard.

What's the difference between MAST and MASTG?

MAST is a general industry term for the category of testing that covers the binary, runtime, and API layers. MASTG is OWASP's specific, versioned document that provides detailed test procedures, primarily for the binary and runtime layers.

Is MASTG the same as the old MSTG?

Yes. MASTG is the current name. The guide was known as the Mobile Security Testing Guide (MSTG) before OWASP's August 2022 rebrand to the broader Mobile Application Security (MAS) project.

How is MASTG organized?

As of MASTG v2.0.0 (June 2026), into four separately referenceable components: tests, best practices, knowledge articles, and demos, each with its own ID and cross-linked to the MASVS control and MASWE weakness it addresses.

Does Appknox automate MASTG testing?

Appknox's binary SAST, AI-led DAST, and API security testing map findings to specific MASTG test IDs and KnoxIQ scores, indicating which of those findings are actually exploitable in context.

Related: What is MASVS? | What is MAST? | OWASP MASTG Best Practices Checklist | OWASP MASVS & MASTG Guide | Appknox Automated Vulnerability Assessment

By Aadarsh Anand, Security Researcher, Appknox Security Research Team

Appknox is an enterprise mobile application security testing platform. This page was written by Appknox's security research team based on direct experience mapping automated and manual testing findings to MASTG, MASVS, and OWASP Mobile Top 10 requirements across financial services, healthcare, and enterprise mobile app portfolios. This page was drafted with AI assistance and reviewed and verified by the Appknox security research team.