logo
OWASP Mobile Application Security
MASTG-TOOL-0020: JustTrustMe
Initializing search
    • Home
    • MASVS
    • MASWE (Beta)
    • MASTG
    • MAS Checklist
    • MAS Crackmes
    • News
    • 🎙 Talks
    • ⭐ Contribute
    • 💙 Donate
    • 💬 Connect with Us
    • Home
    • MASVS
        • Foreword
        • About the Standard
        • The Mobile Application Security Verification Standard
        • Assessment and Certification
      • MASVS-STORAGE: Storage
      • MASVS-STORAGE-1
      • MASVS-STORAGE-2
      • MASVS-CRYPTO: Cryptography
      • MASVS-CRYPTO-1
      • MASVS-CRYPTO-2
      • MASVS-AUTH: Authentication and Authorization
      • MASVS-AUTH-1
      • MASVS-AUTH-2
      • MASVS-AUTH-3
      • MASVS-NETWORK: Network Communication
      • MASVS-NETWORK-1
      • MASVS-NETWORK-2
      • MASVS-PLATFORM: Platform Interaction
      • MASVS-PLATFORM-1
      • MASVS-PLATFORM-2
      • MASVS-PLATFORM-3
      • MASVS-CODE: Code Quality
      • MASVS-CODE-1
      • MASVS-CODE-2
      • MASVS-CODE-3
      • MASVS-CODE-4
      • MASVS-RESILIENCE: Resilience Against Reverse Engineering and Tampering
      • MASVS-RESILIENCE-1
      • MASVS-RESILIENCE-2
      • MASVS-RESILIENCE-3
      • MASVS-RESILIENCE-4
      • MASVS-PRIVACY: Privacy
      • MASVS-PRIVACY-1
      • MASVS-PRIVACY-2
      • MASVS-PRIVACY-3
      • MASVS-PRIVACY-4
    • MASWE (Beta)
        • MASWE-0001: Insertion of Sensitive Data into Logs
        • MASWE-0002: Sensitive Data Stored With Insufficient Access Restrictions in Internal Locations
        • MASWE-0003: Backup Unencrypted
        • MASWE-0004: Sensitive Data Not Excluded From Backup
        • MASWE-0006: Sensitive Data Stored Unencrypted in Private Storage Locations
        • MASWE-0007: Sensitive Data Stored Unencrypted in Shared Storage Requiring No User Interaction
        • MASWE-0009: Improper Cryptographic Key Generation
        • MASWE-0010: Improper Cryptographic Key Derivation
        • MASWE-0011: Cryptographic Key Rotation Not Implemented
        • MASWE-0012: Insecure or Wrong Usage of Cryptographic Key
        • MASWE-0013: Hardcoded Cryptographic Keys in Use
        • MASWE-0014: Cryptographic Keys Not Properly Protected at Rest
        • MASWE-0015: Deprecated Android KeyStore Implementations
        • MASWE-0016: Unsafe Handling of Imported Cryptographic Keys
        • MASWE-0017: Cryptographic Keys Not Properly Protected on Export
        • MASWE-0018: Cryptographic Keys Access Not Restricted
        • MASWE-0019: Risky Cryptography Implementations
        • MASWE-0020: Improper Encryption
        • MASWE-0021: Improper Hashing
        • MASWE-0022: Predictable Initialization Vectors (IVs)
        • MASWE-0023: Risky Padding
        • MASWE-0024: Improper Use of Message Authentication Code (MAC)
        • MASWE-0025: Improper Generation of Cryptographic Signatures
        • MASWE-0026: Improper Verification of Cryptographic Signature
        • MASWE-0027: Improper Random Number Generation
        • MASWE-0005: API Keys Hardcoded in the App Package
        • MASWE-0028: MFA Implementation Best Practices Not Followed
        • MASWE-0029: Step-Up Authentication Not Implemented After Login
        • MASWE-0030: Re-Authenticates Not Triggered On Contextual State Changes
        • MASWE-0031: Insecure use of Android Protected Confirmation
        • MASWE-0032: Platform-provided Authentication APIs Not Used
        • MASWE-0033: Authentication or Authorization Protocol Security Best Practices Not Followed
        • MASWE-0034: Insecure Implementation of Confirm Credentials
        • MASWE-0035: Passwordless Authentication Not Implemented
        • MASWE-0036: Authentication Material Stored Unencrypted on the Device
        • MASWE-0037: Authentication Material Sent over Insecure Connections
        • MASWE-0038: Authentication Tokens Not Validated
        • MASWE-0039: Shared Web Credentials and Website-association Not Implemented
        • MASWE-0040: Insecure Authentication in WebViews
        • MASWE-0041: Authentication Enforced Only Locally Instead of on the Server-side
        • MASWE-0042: Authorization Enforced Only Locally Instead of on the Server-side
        • MASWE-0043: App Custom PIN Not Bound to Platform KeyStore
        • MASWE-0044: Biometric Authentication Can Be Bypassed
        • MASWE-0045: Fallback to Non-biometric Credentials Allowed for Sensitive Transactions
        • MASWE-0046: Crypto Keys Not Invalidated on New Biometric Enrollment
        • MASWE-0047: Insecure Identity Pinning
        • MASWE-0048: Insecure Machine-to-Machine Communication
        • MASWE-0049: Proven Networking APIs Not used
        • MASWE-0050: Cleartext Traffic
        • MASWE-0051: Unprotected Open Ports
        • MASWE-0052: Insecure Certificate Validation
        • MASWE-0053: Sensitive Data Leaked via the User Interface
        • MASWE-0054: Sensitive Data Leaked via Notifications
        • MASWE-0055: Sensitive Data Leaked via Screenshots or Screen Recordings
        • MASWE-0056: Tapjacking Attacks
        • MASWE-0057: StrandHogg Attack / Task Affinity Vulnerability
        • MASWE-0058: Insecure Deep Links
        • MASWE-0059: Use Of Unauthenticated Platform IPC
        • MASWE-0060: Insecure Use of UIActivity
        • MASWE-0061: Insecure Use of App Extensions
        • MASWE-0062: Insecure Services
        • MASWE-0063: Insecure Broadcast Receivers
        • MASWE-0064: Insecure Content Providers
        • MASWE-0065: Sensitive Data Permanently Shared with Other Apps
        • MASWE-0066: Insecure Intents
        • MASWE-0067: Debuggable Flag Not Disabled
        • MASWE-0068: JavaScript Bridges in WebViews
        • MASWE-0069: WebViews Allows Access to Local Resources
        • MASWE-0070: JavaScript Loaded from Untrusted Sources
        • MASWE-0071: WebViews Loading Content from Untrusted Sources
        • MASWE-0072: Universal XSS
        • MASWE-0073: Insecure WebResourceResponse Implementations
        • MASWE-0074: Web Content Debugging Enabled
        • MASWE-0118: Sensitive Data Not Removed After Use
        • MASWE-0075: Enforced Updating Not Implemented
        • MASWE-0076: Dependencies with Known Vulnerabilities
        • MASWE-0077: Running on a recent Platform Version Not Ensured
        • MASWE-0078: Latest Platform Version Not Targeted
        • MASWE-0079: Unsafe Handling of Data from the Network
        • MASWE-0080: Unsafe Handling of Data from Backups
        • MASWE-0081: Unsafe Handling Of Data From External Interfaces
        • MASWE-0082: Unsafe Handling of Data From Local Storage
        • MASWE-0083: Unsafe Handling of Data From The User Interface
        • MASWE-0084: Unsafe Handling of Data from IPC
        • MASWE-0085: Unsafe Dynamic Code Loading
        • MASWE-0086: SQL Injection
        • MASWE-0087: Insecure Parsing and Escaping
        • MASWE-0088: Insecure Object Deserialization
        • MASWE-0116: Compiler Provided Security Features Not Used
        • MASWE-0008: Missing Device Secure Lock Verification Implementation
        • MASWE-0089: Code Obfuscation Not Implemented
        • MASWE-0090: Resource Obfuscation Not Implemented
        • MASWE-0091: Anti-Deobfuscation Techniques Not Implemented
        • MASWE-0092: Static Analysis Tools Not Prevented
        • MASWE-0093: Debugging Symbols Not Removed
        • MASWE-0094: Non-Production Resources Not Removed
        • MASWE-0095: Code That Disables Security Controls Not Removed
        • MASWE-0096: Data Sent Unencrypted Over Encrypted Connections
        • MASWE-0097: Root/Jailbreak Detection Not Implemented
        • MASWE-0098: App Virtualization Environment Detection Not Implemented
        • MASWE-0099: Emulator Detection Not Implemented
        • MASWE-0100: Device Attestation Not Implemented
        • MASWE-0101: Debugger Detection Not Implemented
        • MASWE-0102: Dynamic Analysis Tools Detection Not Implemented
        • MASWE-0103: RASP Techniques Not Implemented
        • MASWE-0104: App Integrity Not Verified
        • MASWE-0105: Integrity of App Resources Not Verified
        • MASWE-0106: Official Store Verification Not Implemented
        • MASWE-0107: Runtime Code Integrity Not Verified
        • MASWE-0108: Sensitive Data in Network Traffic
        • MASWE-0109: Lack of Anonymization or Pseudonymisation Measures
        • MASWE-0110: Use of Unique Identifiers for User Tracking
        • MASWE-0111: Inadequate Privacy Policy
        • MASWE-0112: Inadequate Data Collection Declarations
        • MASWE-0113: Lack of Proper Data Management Controls
        • MASWE-0114: Inadequate Data Visibility Controls
        • MASWE-0115: Inadequate or Ambiguous User Consent Mechanisms
        • MASWE-0117: Inadequate Permission Management
    • MASTG
        • Foreword
        • Frontispiece
        • OWASP MASVS and MASTG Adoption
        • Acknowledgments
        • Suggested Reading
        • Mobile Application Taxonomy
        • Mobile Application Security Testing
        • Mobile App Tampering and Reverse Engineering
        • Mobile App Authentication Architectures
        • Mobile App Network Communication
        • Mobile App Cryptography
        • Mobile App Code Quality
        • Mobile App User Privacy Protection
        • MAS Testing Profiles
        • Android Platform Overview
        • Android Security Testing
        • Android Data Storage
        • Android Cryptographic APIs
        • Android Local Authentication
        • Android Network Communication
        • Android Platform APIs
        • Android Code Quality and Build Settings
        • Android Anti-Reversing Defenses
        • iOS Platform Overview
        • iOS Security Testing
        • iOS Data Storage
        • iOS Cryptographic APIs
        • iOS Local Authentication
        • iOS Network Communication
        • iOS Platform APIs
        • iOS Code Quality and Build Settings
        • iOS Anti-Reversing Defenses
      • Best Practices
        • MASTG-BEST-0001: Use Secure Random Number Generator APIs
        • MASTG-BEST-0002: Remove Logging Code
        • MASTG-BEST-0003: Comply with Privacy Regulations and Best Practices
        • MASTG-BEST-0004: Exclude Sensitive Data from Backups
        • MASTG-BEST-0005: Use Secure Encryption Modes
        • MASTG-BEST-0006: Use Up-to-Date APK Signing Schemes
        • MASTG-BEST-0007: Debuggable Flag Disabled in the AndroidManifest
        • MASTG-BEST-0008: Debugging Disabled for WebViews
        • MASTG-BEST-0009: Use Secure Encryption Algorithms
        • MASTG-BEST-0010: Use Up-to-Date minSdkVersion
        • MASTG-BEST-0011: Securely Load File Content in a WebView
        • MASTG-BEST-0012: Disable JavaScript in WebViews
        • MASTG-BEST-0013: Disable Content Provider Access in WebViews
        • MASTG-BEST-0014: Preventing Screenshots and Screen Recording
        • MASTG-BEST-0015: Use `setRecentsScreenshotEnabled` to Prevent Screenshots When Backgrounded
        • MASTG-BEST-0016: Use `SECURE_FLAG` to Prevent Screenshots and Screen Recording
        • MASTG-BEST-0017: Use `setSecure` to Prevent Screenshots in SurfaceViews
        • MASTG-BEST-0018: Use `SecureFlagPolicy.SecureOn` to Prevent Screenshots in Compose Components
        • MASTG-BEST-0019: Use Non-Caching Input Types for Sensitive Fields
        • MASTG-BEST-0020: Update the GMS Security Provider
        • MASTG-BEST-0021: Ensure Proper Error and Exception Handling
        • MASTG-BEST-0022: Disable Verbose and Debug Logging in Production Builds
        • MASTG-BEST-0023: Exclude Sensitive Information from Backups
        • MASTG-BEST-0024: Store Data Encrypted in App Sandbox Directory
        • MASTG-BEST-0025: Use Secure Random Number Generator APIs
        • MASTG-BEST-0026: Preventing Keyboard Caching for Sensitive Text Inputs
        • MASTG-BEST-0027: Preventing Sensitive Data Exposure in Notifications
        • MASTG-BEST-0028: WebViews Cache Cleanup
        • MASTG-BEST-0029: Implementing Resilience and RASP Signals
        • MASTG-BEST-0030: Implementing Root Detection
        • MASTG-BEST-0031: Enforce Strong Biometrics for Sensitive Operations
      • Knowledge
            • MASTG-KNOW-0036: Shared Preferences
            • MASTG-KNOW-0037: SQLite Database
            • MASTG-KNOW-0038: SQLCipher Database
            • MASTG-KNOW-0039: Firebase Real-time Databases
            • MASTG-KNOW-0040: Realm Databases
            • MASTG-KNOW-0041: Internal Storage
            • MASTG-KNOW-0042: External Storage
            • MASTG-KNOW-0043: Android KeyStore
            • MASTG-KNOW-0044: Key Attestation
            • MASTG-KNOW-0045: Secure Key Import into Keystore
            • MASTG-KNOW-0046: BouncyCastle KeyStore
            • MASTG-KNOW-0047: Cryptographic Key Storage
            • MASTG-KNOW-0048: KeyChain
            • MASTG-KNOW-0049: Logs
            • MASTG-KNOW-0050: Backups
            • MASTG-KNOW-0051: Process Memory
            • MASTG-KNOW-0052: User Interface Components
            • MASTG-KNOW-0053: Screenshots
            • MASTG-KNOW-0054: App Notifications
            • MASTG-KNOW-0055: Keyboard Cache
            • MASTG-KNOW-0011: Security Provider
            • MASTG-KNOW-0012: Key Generation
            • MASTG-KNOW-0013: Random Number Generation
            • MASTG-KNOW-0001: Biometric Authentication
            • MASTG-KNOW-0002: FingerprintManager
            • MASTG-KNOW-0014: Android Network Security Configuration
            • MASTG-KNOW-0015: Certificate Pinning
            • MASTG-KNOW-0016: TBD
            • MASTG-KNOW-0017: App Permissions
            • MASTG-KNOW-0018: WebViews
            • MASTG-KNOW-0019: Deep Links
            • MASTG-KNOW-0020: Inter-Process Communication (IPC) Mechanisms
            • MASTG-KNOW-0021: Object Serialization
            • MASTG-KNOW-0022: Overlay Attacks
            • MASTG-KNOW-0023: Enforced Updating
            • MASTG-KNOW-0024: Pending Intents
            • MASTG-KNOW-0025: Implicit Intents
            • MASTG-KNOW-0105: User-Initiated Screenshots and Screen Recording
            • MASTG-KNOW-0106: App-Initiated Screenshots and Screen Recording
            • MASTG-KNOW-0107: Screenshots and Screen Recording Detection
            • MASTG-KNOW-0004: Third-Party Libraries
            • MASTG-KNOW-0005: Memory Corruption Bugs
            • MASTG-KNOW-0006: Binary Protection Mechanisms
            • MASTG-KNOW-0008: Debugging Information and Debug Symbols
            • MASTG-KNOW-0009: StrictMode
            • MASTG-KNOW-0010: Exception Handling
            • MASTG-KNOW-0003: App Signing
            • MASTG-KNOW-0007: Debuggable Apps
            • MASTG-KNOW-0027: Root Detection
            • MASTG-KNOW-0028: Anti-Debugging
            • MASTG-KNOW-0029: File Integrity Checks
            • MASTG-KNOW-0030: Detection of Reverse Engineering Tools
            • MASTG-KNOW-0031: Emulator Detection
            • MASTG-KNOW-0032: Runtime Integrity Verification
            • MASTG-KNOW-0033: Obfuscation
            • MASTG-KNOW-0034: Device Binding
            • MASTG-KNOW-0035: Google Play Integrity API
            • MASTG-KNOW-0026: Third-party Services Embedded in the App
            • MASTG-KNOW-0091: File System APIs
            • MASTG-KNOW-0092: Binary Data Storage
            • MASTG-KNOW-0093: UserDefaults
            • MASTG-KNOW-0094: CoreData
            • MASTG-KNOW-0095: Firebase Real-time Databases
            • MASTG-KNOW-0096: Realm Databases
            • MASTG-KNOW-0097: Other Third-Party Databases
            • MASTG-KNOW-0098: User Interface Components
            • MASTG-KNOW-0099: Screenshots
            • MASTG-KNOW-0100: Keyboard Cache
            • MASTG-KNOW-0101: Logs
            • MASTG-KNOW-0102: Backups
            • MASTG-KNOW-0103: Process Memory
            • MASTG-KNOW-0104: Inter-Process Communication (IPC) Mechanisms
            • MASTG-KNOW-0108: App Sandbox Directories
            • MASTG-KNOW-0066: CryptoKit
            • MASTG-KNOW-0067: CommonCrypto, SecKey and Wrapper libraries
            • MASTG-KNOW-0068: Cryptographic Third-Party libraries
            • MASTG-KNOW-0069: Key Management
            • MASTG-KNOW-0070: Random Number Generator
            • MASTG-KNOW-0056: Local Authentication Framework
            • MASTG-KNOW-0057: Keychain Services
            • MASTG-KNOW-0071: iOS App Transport Security
            • MASTG-KNOW-0072: Server Trust Evaluation
            • MASTG-KNOW-0073: iOS Network APIs
            • MASTG-KNOW-0074: Enforced Updating
            • MASTG-KNOW-0075: Object Serialization
            • MASTG-KNOW-0076: WebViews
            • MASTG-KNOW-0077: App Permissions
            • MASTG-KNOW-0078: Inter-Process Communication (IPC)
            • MASTG-KNOW-0079: Custom URL Schemes
            • MASTG-KNOW-0080: Universal Links
            • MASTG-KNOW-0081: UIActivity Sharing
            • MASTG-KNOW-0082: App extensions
            • MASTG-KNOW-0083: Pasteboard
            • MASTG-KNOW-0058: App Signing
            • MASTG-KNOW-0059: Third-Party Libraries
            • MASTG-KNOW-0060: Memory Corruption Bugs
            • MASTG-KNOW-0061: Binary Protection Mechanisms
            • MASTG-KNOW-0062: Debuggable Apps
            • MASTG-KNOW-0063: Debugging Information and Debug Symbols
            • MASTG-KNOW-0064: Debugging Code and Error Logging
            • MASTG-KNOW-0065: Exception Handling
            • MASTG-KNOW-0084: Jailbreak Detection
            • MASTG-KNOW-0085: Anti-Debugging Detection
            • MASTG-KNOW-0086: File Integrity Checks
            • MASTG-KNOW-0087: Reverse Engineering Tools Detection
            • MASTG-KNOW-0088: Emulator Detection
            • MASTG-KNOW-0089: Obfuscation
            • MASTG-KNOW-0090: Device Binding
          • MASVS-PRIVACY
      • Tests
            • MASTG-TEST-0001: Testing Local Storage for Sensitive Data
            • MASTG-TEST-0003: Testing Logs for Sensitive Data
            • MASTG-TEST-0004: Determining Whether Sensitive Data Is Shared with Third Parties via Embedded Services
            • MASTG-TEST-0005: Determining Whether Sensitive Data Is Shared with Third Parties via Notifications
            • MASTG-TEST-0006: Determining Whether the Keyboard Cache Is Disabled for Text Input Fields
            • MASTG-TEST-0009: Testing Backups for Sensitive Data
            • MASTG-TEST-0011: Testing Memory for Sensitive Data
            • MASTG-TEST-0012: Testing the Device-Access-Security Policy
            • MASTG-TEST-0200: Files Written to External Storage
            • MASTG-TEST-0201: Runtime Use of APIs to Access External Storage
            • MASTG-TEST-0202: References to APIs and Permissions for Accessing External Storage
            • MASTG-TEST-0203: Runtime Use of Logging APIs
            • MASTG-TEST-0207: Runtime Storage of Unencrypted Data in the App Sandbox
            • MASTG-TEST-0216: Sensitive Data Not Excluded From Backup
            • MASTG-TEST-0231: References to Logging APIs
            • MASTG-TEST-0262: References to Backup Configurations Not Excluding Sensitive Data
            • MASTG-TEST-0287: Sensitive Data Stored Unencrypted via the SharedPreferences API to the App Sandbox
            • MASTG-TEST-0304: Sensitive Data Stored Unencrypted via SQLite
            • MASTG-TEST-0305: Sensitive Data Stored Unencrypted via DataStore
            • MASTG-TEST-0306: Sensitive Data Stored Unencrypted via Android Room DB
            • MASTG-TEST-0013: Testing Symmetric Cryptography
            • MASTG-TEST-0014: Testing the Configuration of Cryptographic Standard Algorithms
            • MASTG-TEST-0015: Testing the Purposes of Keys
            • MASTG-TEST-0016: Testing Random Number Generation
            • MASTG-TEST-0204: Insecure Random API Usage
            • MASTG-TEST-0205: Non-random Sources Usage
            • MASTG-TEST-0208: Insufficient Key Sizes
            • MASTG-TEST-0212: Use of Hardcoded Cryptographic Keys in Code
            • MASTG-TEST-0221: Broken Symmetric Encryption Algorithms
            • MASTG-TEST-0232: Broken Symmetric Encryption Modes
            • MASTG-TEST-0307: References to Asymmetric Key Pairs Used For Multiple Purposes
            • MASTG-TEST-0308: Runtime Use of Asymmetric Key Pairs Used For Multiple Purposes
            • MASTG-TEST-0309: References to Reused Initialization Vectors in Symmetric Encryption
            • MASTG-TEST-0310: Runtime Use of Reused Initialization Vectors in Symmetric Encryption
            • MASTG-TEST-0312: References to Explicit Security Provider in Cryptographic APIs
            • MASTG-TEST-0017: Testing Confirm Credentials
            • MASTG-TEST-0018: Testing Biometric Authentication
            • MASTG-TEST-0326: References to APIs Allowing Fallback to Non-Biometric Authentication
            • MASTG-TEST-0327: References to APIs for Event-Bound Biometric Authentication
            • MASTG-TEST-0328: References to APIs Detecting Biometric Enrollment Changes
            • MASTG-TEST-0329: References to APIs Enforcing Authentication without Explicit User Action
            • MASTG-TEST-0330: References to APIs for Keys used in Biometric Authentication with Extended Validity Duration
            • MASTG-TEST-0019: Testing Data Encryption on the Network
            • MASTG-TEST-0020: Testing the TLS Settings
            • MASTG-TEST-0021: Testing Endpoint Identify Verification
            • MASTG-TEST-0022: Testing Custom Certificate Stores and Certificate Pinning
            • MASTG-TEST-0023: Testing the Security Provider
            • MASTG-TEST-0217: Insecure TLS Protocols Explicitly Allowed in Code
            • MASTG-TEST-0218: Insecure TLS Protocols in Network Traffic
            • MASTG-TEST-0233: Hardcoded HTTP URLs
            • MASTG-TEST-0234: Missing Implementation of Server Hostname Verification with SSLSockets
            • MASTG-TEST-0235: Android App Configurations Allowing Cleartext Traffic
            • MASTG-TEST-0236: Cleartext Traffic Observed on the Network
            • MASTG-TEST-0237: Cross-Platform Framework Configurations Allowing Cleartext Traffic
            • MASTG-TEST-0238: Runtime Use of Network APIs Transmitting Cleartext Traffic
            • MASTG-TEST-0239: Using low-level APIs (e.g. Socket) to set up a custom HTTP connection
            • MASTG-TEST-0242: Missing Certificate Pinning in Network Security Configuration
            • MASTG-TEST-0243: Expired Certificate Pins in the Network Security Configuration
            • MASTG-TEST-0244: Missing Certificate Pinning in Network Traffic
            • MASTG-TEST-0282: Unsafe Custom Trust Evaluation
            • MASTG-TEST-0283: Incorrect Implementation of Server Hostname Verification
            • MASTG-TEST-0284: Incorrect SSL Error Handling in WebViews
            • MASTG-TEST-0285: Outdated Android Version Allowing Trust in User-Provided CAs
            • MASTG-TEST-0286: Network Security Configuration Allowing Trust in User-Provided CAs
            • MASTG-TEST-0295: GMS Security Provider Not Updated
            • MASTG-TEST-0007: Determining Whether Sensitive Stored Data Has Been Exposed via IPC Mechanisms
            • MASTG-TEST-0008: Checking for Sensitive Data Disclosure Through the User Interface
            • MASTG-TEST-0010: Finding Sensitive Information in Auto-Generated Screenshots
            • MASTG-TEST-0024: Testing for App Permissions
            • MASTG-TEST-0028: Testing Deep Links
            • MASTG-TEST-0029: Testing for Sensitive Functionality Exposure Through IPC
            • MASTG-TEST-0030: Testing for Vulnerable Implementation of PendingIntent
            • MASTG-TEST-0031: Testing JavaScript Execution in WebViews
            • MASTG-TEST-0032: Testing WebView Protocol Handlers
            • MASTG-TEST-0033: Testing for Java Objects Exposed Through WebViews
            • MASTG-TEST-0035: Testing for Overlay Attacks
            • MASTG-TEST-0037: Testing WebViews Cleanup
            • MASTG-TEST-0250: References to Content Provider Access in WebViews
            • MASTG-TEST-0251: Runtime Use of Content Provider Access APIs in WebViews
            • MASTG-TEST-0252: References to Local File Access in WebViews
            • MASTG-TEST-0253: Runtime Use of Local File Access APIs in WebViews
            • MASTG-TEST-0258: References to Keyboard Caching Attributes in UI Elements
            • MASTG-TEST-0289: Runtime Verification of Sensitive Content Exposure in Screenshots During App Backgrounding
            • MASTG-TEST-0291: References to Screen Capturing Prevention APIs
            • MASTG-TEST-0292: `setRecentsScreenshotEnabled` Not Used to Prevent Screenshots When Backgrounded
            • MASTG-TEST-0293: `setSecure` Not Used to Prevent Screenshots in SurfaceViews
            • MASTG-TEST-0294: `SecureOn` Not Used to Prevent Screenshots in Compose Dialogs
            • MASTG-TEST-0315: Sensitive Data Exposed via Notifications
            • MASTG-TEST-0316: App Exposing User Authentication Data in Text Input Fields
            • MASTG-TEST-0320: WebViews Not Cleaning Up Sensitive Data
            • MASTG-TEST-0002: Testing Local Storage for Input Validation
            • MASTG-TEST-0025: Testing for Injection Flaws
            • MASTG-TEST-0026: Testing Implicit Intents
            • MASTG-TEST-0027: Testing for URL Loading in WebViews
            • MASTG-TEST-0034: Testing Object Persistence
            • MASTG-TEST-0036: Testing Enforced Updating
            • MASTG-TEST-0042: Checking for Weaknesses in Third Party Libraries
            • MASTG-TEST-0043: Memory Corruption Bugs
            • MASTG-TEST-0044: Make Sure That Free Security Features Are Activated
            • MASTG-TEST-0222: Position Independent Code (PIC) Not Enabled
            • MASTG-TEST-0223: Stack Canaries Not Enabled
            • MASTG-TEST-0245: References to Platform Version APIs
            • MASTG-TEST-0272: Identify Dependencies with Known Vulnerabilities in the Android Project
            • MASTG-TEST-0274: Dependencies with Known Vulnerabilities in the App's SBOM
            • MASTG-TEST-0038: Making Sure that the App is Properly Signed
            • MASTG-TEST-0039: Testing whether the App is Debuggable
            • MASTG-TEST-0040: Testing for Debugging Symbols
            • MASTG-TEST-0041: Testing for Debugging Code and Verbose Error Logging
            • MASTG-TEST-0045: Testing Root Detection
            • MASTG-TEST-0046: Testing Anti-Debugging Detection
            • MASTG-TEST-0047: Testing File Integrity Checks
            • MASTG-TEST-0048: Testing Reverse Engineering Tools Detection
            • MASTG-TEST-0049: Testing Emulator Detection
            • MASTG-TEST-0050: Testing Runtime Integrity Checks
            • MASTG-TEST-0051: Testing Obfuscation
            • MASTG-TEST-0224: Usage of Insecure Signature Version
            • MASTG-TEST-0225: Usage of Insecure Signature Key Size
            • MASTG-TEST-0226: Debuggable Flag Enabled in the AndroidManifest
            • MASTG-TEST-0227: Debugging Enabled for WebViews
            • MASTG-TEST-0247: References to APIs for Detecting Secure Screen Lock
            • MASTG-TEST-0249: Runtime Use of Secure Screen Lock Detection APIs
            • MASTG-TEST-0263: Logging of StrictMode Violations
            • MASTG-TEST-0264: Runtime Use of StrictMode APIs
            • MASTG-TEST-0265: References to StrictMode APIs
            • MASTG-TEST-0288: Debugging Symbols in Native Binaries
            • MASTG-TEST-0324: References to Root Detection Mechanisms
            • MASTG-TEST-0325: Runtime Use of Root Detection Techniques
            • MASTG-TEST-0206: Undeclared PII in Network Traffic Capture
            • MASTG-TEST-0254: Dangerous App Permissions
            • MASTG-TEST-0255: Permission Requests Not Minimized
            • MASTG-TEST-0256: Missing Permission Rationale
            • MASTG-TEST-0257: Not Resetting Unused Permissions
            • MASTG-TEST-0318: References to SDK APIs Known to Handle Sensitive User Data
            • MASTG-TEST-0319: Runtime Use of SDK APIs Known to Handle Sensitive User Data
            • MASTG-TEST-0052: Testing Local Data Storage
            • MASTG-TEST-0053: Checking Logs for Sensitive Data
            • MASTG-TEST-0054: Determining Whether Sensitive Data Is Shared with Third Parties
            • MASTG-TEST-0055: Finding Sensitive Data in the Keyboard Cache
            • MASTG-TEST-0058: Testing Backups for Sensitive Data
            • MASTG-TEST-0060: Testing Memory for Sensitive Data
            • MASTG-TEST-0215: Sensitive Data Not Marked For Backup Exclusion
            • MASTG-TEST-0296: Sensitive Data Exposure Through Insecure Logging
            • MASTG-TEST-0297: Insertion of Sensitive Data into Logs
            • MASTG-TEST-0298: Runtime Monitoring of Files Eligible for Backup
            • MASTG-TEST-0299: Data Protection Classes for Files in Private Storage
            • MASTG-TEST-0300: References to APIs for Storing Unencrypted Data in Private Storage
            • MASTG-TEST-0301: Runtime Use of APIs for Storing Unencrypted Data in Private Storage
            • MASTG-TEST-0302: Sensitive Data Unencrypted in Private Storage Files
            • MASTG-TEST-0303: References to APIs for Storing Unencrypted Data in Shared Storage
            • MASTG-TEST-0313: References to APIs for Preventing Keyboard Caching of Text Fields
            • MASTG-TEST-0314: Runtime Monitoring of Text Fields Eligible for Keyboard Caching
            • MASTG-TEST-0061: Verifying the Configuration of Cryptographic Standard Algorithms
            • MASTG-TEST-0062: Testing Key Management
            • MASTG-TEST-0063: Testing Random Number Generation
            • MASTG-TEST-0209: Insufficient Key Sizes
            • MASTG-TEST-0210: Broken Symmetric Encryption Algorithms
            • MASTG-TEST-0211: Broken Hashing Algorithms
            • MASTG-TEST-0213: Use of Hardcoded Cryptographic Keys in Code
            • MASTG-TEST-0214: Hardcoded Cryptographic Keys in Files
            • MASTG-TEST-0311: Insecure Random API Usage
            • MASTG-TEST-0317: Broken Symmetric Encryption Modes
            • MASTG-TEST-0064: Testing Biometric Authentication
            • MASTG-TEST-0266: References to APIs for Event-Bound Biometric Authentication
            • MASTG-TEST-0267: Runtime Use Of Event-Bound Biometric Authentication
            • MASTG-TEST-0268: References to APIs Allowing Fallback to Non-Biometric Authentication
            • MASTG-TEST-0269: Runtime Use Of APIs Allowing Fallback to Non-Biometric Authentication
            • MASTG-TEST-0270: References to APIs Detecting Biometric Enrollment Changes
            • MASTG-TEST-0271: Runtime Use Of APIs Detecting Biometric Enrollment Changes
            • MASTG-TEST-0065: Testing Data Encryption on the Network
            • MASTG-TEST-0066: Testing the TLS Settings
            • MASTG-TEST-0067: Testing Endpoint Identity Verification
            • MASTG-TEST-0068: Testing Custom Certificate Stores and Certificate Pinning
            • MASTG-TEST-0321: Hardcoded HTTP URLs
            • MASTG-TEST-0322: App Transport Security Configurations Allowing Cleartext Traffic
            • MASTG-TEST-0323: Uses of Low-Level Networking APIs for Cleartext Traffic
            • MASTG-TEST-0056: Determining Whether Sensitive Data Is Exposed via IPC Mechanisms
            • MASTG-TEST-0057: Checking for Sensitive Data Disclosed Through the User Interface
            • MASTG-TEST-0059: Testing Auto-Generated Screenshots for Sensitive Information
            • MASTG-TEST-0069: Testing App Permissions
            • MASTG-TEST-0070: Testing Universal Links
            • MASTG-TEST-0071: Testing UIActivity Sharing
            • MASTG-TEST-0072: Testing App Extensions
            • MASTG-TEST-0073: Testing UIPasteboard
            • MASTG-TEST-0075: Testing Custom URL Schemes
            • MASTG-TEST-0076: Testing iOS WebViews
            • MASTG-TEST-0077: Testing WebView Protocol Handlers
            • MASTG-TEST-0078: Determining Whether Native Methods Are Exposed Through WebViews
            • MASTG-TEST-0276: Use of the iOS General Pasteboard
            • MASTG-TEST-0277: Sensitive Data in the iOS General Pasteboard at Runtime
            • MASTG-TEST-0278: Pasteboard Contents Not Cleared After Use
            • MASTG-TEST-0279: Pasteboard Contents Not Expiring
            • MASTG-TEST-0280: Pasteboard Contents Not Restricted to Local Device
            • MASTG-TEST-0290: Runtime Verification of Sensitive Content Exposure in Screenshots During App Backgrounding
            • MASTG-TEST-0079: Testing Object Persistence
            • MASTG-TEST-0080: Testing Enforced Updating
            • MASTG-TEST-0085: Checking for Weaknesses in Third Party Libraries
            • MASTG-TEST-0086: Memory Corruption Bugs
            • MASTG-TEST-0087: Make Sure That Free Security Features Are Activated
            • MASTG-TEST-0228: Position Independent Code (PIC) not Enabled
            • MASTG-TEST-0229: Stack Canaries Not enabled
            • MASTG-TEST-0230: Automatic Reference Counting (ARC) not enabled
            • MASTG-TEST-0273: Identify Dependencies with Known Vulnerabilities by Scanning Dependency Managers Artifacts
            • MASTG-TEST-0275: Dependencies with Known Vulnerabilities in the App's SBOM
            • MASTG-TEST-0081: Making Sure that the App Is Properly Signed
            • MASTG-TEST-0082: Testing whether the App is Debuggable
            • MASTG-TEST-0083: Testing for Debugging Symbols
            • MASTG-TEST-0084: Testing for Debugging Code and Verbose Error Logging
            • MASTG-TEST-0088: Testing Jailbreak Detection
            • MASTG-TEST-0089: Testing Anti-Debugging Detection
            • MASTG-TEST-0090: Testing File Integrity Checks
            • MASTG-TEST-0091: Testing Reverse Engineering Tools Detection
            • MASTG-TEST-0092: Testing Emulator Detection
            • MASTG-TEST-0093: Testing Obfuscation
            • MASTG-TEST-0219: Testing for Debugging Symbols
            • MASTG-TEST-0220: Usage of Outdated Code Signature Format
            • MASTG-TEST-0240: Jailbreak Detection in Code
            • MASTG-TEST-0241: Runtime Use of Jailbreak Detection Techniques
            • MASTG-TEST-0246: Runtime Use of Secure Screen Lock Detection APIs
            • MASTG-TEST-0248: References to APIs for Detecting Secure Screen Lock
            • MASTG-TEST-0261: Debuggable Entitlement Enabled in the entitlements.plist
            • MASTG-TEST-0281: Undeclared Known Tracking Domains
      • Demos
            • MASTG-DEMO-0001: File System Snapshots from External Storage
            • MASTG-DEMO-0002: External Storage APIs Tracing with Frida
            • MASTG-DEMO-0003: App Writing to External Storage without Scoped Storage Restrictions
            • MASTG-DEMO-0004: App Writing to External Storage with Scoped Storage Restrictions
            • MASTG-DEMO-0005: App Writing to External Storage via the MediaStore API
            • MASTG-DEMO-0006: Tracing Common Logging APIs Looking for Secrets
            • MASTG-DEMO-0010: File System Snapshots from Internal Storage
            • MASTG-DEMO-0020: Data Exclusion using backup_rules.xml with Backup Manager
            • MASTG-DEMO-0034: Backup and Restore App Data with semgrep
            • MASTG-DEMO-0035: Data Exclusion using backup_rules.xml with adb backup
            • MASTG-DEMO-0059: Using SharedPreferences to Write Sensitive Data Unencrypted to the App Sandbox
            • MASTG-DEMO-0060: App Writing Sensitive Data to Sandbox using EncryptedSharedPreferences
            • MASTG-DEMO-0064: Uses of Caching UI Elements with semgrep
            • MASTG-DEMO-0068: Sensitive Data in Unencrypted SQLite
            • MASTG-DEMO-0069: Sensitive Data Stored Unencrypted via DataStore
            • MASTG-DEMO-0070: Sensitive Data Stored Unencrypted via Room Database
            • MASTG-DEMO-0007: Common Uses of Insecure Random APIs
            • MASTG-DEMO-0008: Uses of Non-random Sources
            • MASTG-DEMO-0012: Cryptographic Key Generation With Insufficient Key Length
            • MASTG-DEMO-0017: Use of Hardcoded AES Key in SecretKeySpec with semgrep
            • MASTG-DEMO-0022: Uses of Broken Symmetric Encryption Algorithms in Cipher with semgrep
            • MASTG-DEMO-0023: Uses of Broken Encryption Modes in Cipher with semgrep
            • MASTG-DEMO-0058: Using KeyGenParameterSpec with a Broken ECB Block Mode
            • MASTG-DEMO-0071: References to Asymmetric Key Pairs Used For Multiple Purposes with Semgrep
            • MASTG-DEMO-0072: Runtime Use of Asymmetric Key Pairs Used For Multiple Purposes With Frida
            • MASTG-DEMO-0075: Uses of Explicit Security Providers in Cryptographic APIs with semgrep
            • MASTG-DEMO-0048: SSLSocket Connection to Wrong Host Server Allowed by Lack of HostnameVerifier
            • MASTG-DEMO-0049: SSLSocket Connection to Wrong Host Server Blocked by HostnameVerifier
            • MASTG-DEMO-0054: Use of a TrustManager that Does Not Validate Certificate Chains
            • MASTG-DEMO-0055: Use of the HostnameVerifier that Allows Any Hostname
            • MASTG-DEMO-0056: WebView Ignoring TLS Errors in onReceivedSslError
            • MASTG-DEMO-0057: Network Security Configuration Allows User-Added Certificates
            • MASTG-DEMO-0029: Uses of WebViews Allowing Content Access with semgrep
            • MASTG-DEMO-0030: Uses of WebViews Allowing Content Access with Frida
            • MASTG-DEMO-0031: Uses of WebViews Allowing Local File Access with Frida
            • MASTG-DEMO-0032: Uses of WebViews Allowing Local File Access with semgrep
            • MASTG-DEMO-0040: Debuggable Flag Enabled in the AndroidManifest with semgrep
            • MASTG-DEMO-0061: Uses of FLAG_SECURE with semgrep
            • MASTG-DEMO-0062: Enabling Screenshots in Recents via setRecentsScreenshotEnabled with semgrep
            • MASTG-DEMO-0063: Incorrectly Preventing Screenshots with SecureFlagPolicy in Compose Dialogs with semgrep
            • MASTG-DEMO-0078: App Leaking Sensitive Data via Notifications
            • MASTG-DEMO-0079: App Exposing Access and Verification Codes in Text Input Fields
            • MASTG-DEMO-0082: WebView WebStorage Cleanup
            • MASTG-DEMO-0025: Uses of Build.VERSION.SDK_INT with semgrep
            • MASTG-DEMO-0050: Identifying Insecure Dependencies in Android Studio
            • MASTG-DEMO-0051: Identifying Insecure Dependencies through SBOM Creation
            • MASTG-DEMO-0027: Runtime Use of KeyguardManager.isDeviceSecure and BiometricManager.canAuthenticate APIs with Frida
            • MASTG-DEMO-0028: Uses of KeyguardManager.isDeviceSecure and BiometricManager.canAuthenticate with semgrep
            • MASTG-DEMO-0037: App Leaking Information about Unclosed SQL Cursor via StrictMode
            • MASTG-DEMO-0038: Detecting StrictMode Uses with Frida
            • MASTG-DEMO-0039: Detecting StrictMode PenaltyLog Usage with Semgrep
            • MASTG-DEMO-0087: Uses of Root Detection Techniques with Semgrep
            • MASTG-DEMO-0088: Runtime Detection of Root Detection Mechanisms
            • MASTG-DEMO-0009: Detecting Undeclared PII in Network Traffic
            • MASTG-DEMO-0033: Dangerous Permissions in the AndroidManifest with semgrep
            • MASTG-DEMO-0081: Sensitive User Data Sent to Firebase Analytics with Frida
            • MASTG-DEMO-0019: Uses of isExcludedFromBackupKey with r2
            • MASTG-DEMO-0065: Uses of Logging APIs with r2
            • MASTG-DEMO-0066: Sensitive Data Logging with idevicesyslog
            • MASTG-DEMO-0067: Runtime Tracking of Files Eligible for Backup with Frida
            • MASTG-DEMO-0076: Keyboard Caching Not Prevented for Sensitive Data with r2
            • MASTG-DEMO-0077: Runtime Monitoring of Text Fields Eligible for Keyboard Caching with Frida
            • MASTG-DEMO-0011: Uses of Insufficient Key Size in SecKeyCreateRandomKey with r2
            • MASTG-DEMO-0013: Use of Hardcoded RSA Private Key in SecKeyCreateWithData with r2
            • MASTG-DEMO-0014: Use of Hardcoded ECDSA Private Key in CryptoKit with r2
            • MASTG-DEMO-0015: Uses of Broken Hashing Algorithms in CommonCrypto with r2
            • MASTG-DEMO-0016: Uses of Broken Hashing Algorithms in CryptoKit with r2
            • MASTG-DEMO-0018: Uses of Broken Encryption Algorithms in CommonCrypto with r2
            • MASTG-DEMO-0073: Uses of Insecure Random Number Generation with r2
            • MASTG-DEMO-0074: Uses of Insecure Random Number Generation with frida-trace
            • MASTG-DEMO-0080: Uses of Broken Encryption Modes in CommonCrypto with r2
            • MASTG-DEMO-0041: Uses of LAContext.evaluatePolicy with r2
            • MASTG-DEMO-0042: Runtime Use of LAContext.evaluatePolicy with Frida
            • MASTG-DEMO-0043: Uses of kSecAccessControlUserPresence with r2
            • MASTG-DEMO-0044: Runtime Use of kSecAccessControlUserPresence with Frida
            • MASTG-DEMO-0045: Uses of kSecAccessControlBiometryCurrentSet with r2
            • MASTG-DEMO-0046: Runtime Use of kSecAccessControlBiometryCurrentSet with Frida
            • MASTG-DEMO-0047: Runtime Use of the Keychain Not Requiring User Presence with Frida
            • MASTG-DEMO-0021: Uses of Jailbreak Detection Techniques with r2
            • MASTG-DEMO-0024: Uses of LAContext.canEvaluatePolicy with r2
            • MASTG-DEMO-0026: Runtime Use of LAContext.canEvaluatePolicy with Frida
            • MASTG-DEMO-0036: Debuggable Entitlement Enabled in the entitlements.plist with rabin2
      • Techniques
          • MASTG-TECH-0047: Reverse Engineering
          • MASTG-TECH-0048: Static Analysis
          • MASTG-TECH-0049: Dynamic Analysis
          • MASTG-TECH-0050: Binary Analysis
          • MASTG-TECH-0051: Tampering and Runtime Instrumentation
          • MASTG-TECH-0119: Intercepting HTTP Traffic by Hooking Network APIs at the Application Layer
          • MASTG-TECH-0120: Intercepting HTTP Traffic Using an Interception Proxy
          • MASTG-TECH-0121: Intercepting Non-HTTP Traffic Using an Interception Proxy
          • MASTG-TECH-0122: Passive Eavesdropping
          • MASTG-TECH-0123: Achieving a MITM Position via ARP Spoofing
          • MASTG-TECH-0124: Achieving a MITM Position Using a Rogue Access Point
          • MASTG-TECH-0125: Intercepting Xamarin Traffic
          • MASTG-TECH-0001: Accessing the Device Shell
          • MASTG-TECH-0002: Host-Device Data Transfer
          • MASTG-TECH-0003: Obtaining and Extracting Apps
          • MASTG-TECH-0004: Repackaging Apps
          • MASTG-TECH-0005: Installing Apps
          • MASTG-TECH-0006: Listing Installed Apps
          • MASTG-TECH-0007: Exploring the App Package
          • MASTG-TECH-0008: Accessing App Data Directories
          • MASTG-TECH-0009: Monitoring System Logs
          • MASTG-TECH-0010: Basic Network Monitoring/Sniffing
          • MASTG-TECH-0011: Setting Up an Interception Proxy
          • MASTG-TECH-0012: Bypassing Certificate Pinning
          • MASTG-TECH-0013: Reverse Engineering Android Apps
          • MASTG-TECH-0014: Static Analysis on Android
          • MASTG-TECH-0015: Dynamic Analysis on Android
          • MASTG-TECH-0016: Disassembling Code to Smali
          • MASTG-TECH-0017: Decompiling Java Code
          • MASTG-TECH-0018: Disassembling Native Code
          • MASTG-TECH-0019: Retrieving Strings
          • MASTG-TECH-0020: Retrieving Cross References
          • MASTG-TECH-0021: Information Gathering - API Usage
          • MASTG-TECH-0022: Information Gathering - Network Communication
          • MASTG-TECH-0023: Reviewing Decompiled Java Code
          • MASTG-TECH-0024: Reviewing Disassembled Native Code
          • MASTG-TECH-0025: Automated Static Analysis
          • MASTG-TECH-0026: Dynamic Analysis on Non-Rooted Devices
          • MASTG-TECH-0027: Get Open Files
          • MASTG-TECH-0028: Get Open Connections
          • MASTG-TECH-0029: Get Loaded Native Libraries
          • MASTG-TECH-0030: Sandbox Inspection
          • MASTG-TECH-0031: Debugging
          • MASTG-TECH-0032: Execution Tracing
          • MASTG-TECH-0033: Method Tracing
          • MASTG-TECH-0034: Native Code Tracing
          • MASTG-TECH-0035: JNI Tracing
          • MASTG-TECH-0036: Emulation-based Analysis
          • MASTG-TECH-0037: Symbolic Execution
          • MASTG-TECH-0038: Patching
          • MASTG-TECH-0039: Repackaging & Re-Signing
          • MASTG-TECH-0040: Waiting for the Debugger
          • MASTG-TECH-0041: Library Injection
          • MASTG-TECH-0042: Getting Loaded Classes and Methods Dynamically
          • MASTG-TECH-0043: Method Hooking
          • MASTG-TECH-0044: Process Exploration
          • MASTG-TECH-0045: Runtime Reverse Engineering
          • MASTG-TECH-0100: Logging Sensitive Data from Network Traffic
          • MASTG-TECH-0108: Taint Analysis
          • MASTG-TECH-0109: Intercepting Flutter HTTPS Traffic
          • MASTG-TECH-0112: Reverse Engineering Flutter Applications
          • MASTG-TECH-0115: Obtaining Compiler-Provided Security Features
          • MASTG-TECH-0116: Obtaining Information about the APK Signature
          • MASTG-TECH-0117: Obtaining Information from the AndroidManifest
          • MASTG-TECH-0126: Obtaining App Permissions
          • MASTG-TECH-0127: Inspecting an App's Backup Data
          • MASTG-TECH-0128: Performing a Backup and Restore of App Data
          • MASTG-TECH-0129: Verifying Android Dependencies at Runtime
          • MASTG-TECH-0130: Software Composition Analysis (SCA) of Android Dependencies by Creating a SBOM
          • MASTG-TECH-0131: Software Composition Analysis (SCA) of Android Dependencies at Build Time
          • MASTG-TECH-0140: Obtaining Debugging Information and Symbols
          • MASTG-TECH-0141: Inspecting the Merged AndroidManifest
          • MASTG-TECH-0142: Inspecting WebView Storage
          • MASTG-TECH-0143: Monitor File System Operations in WebViews
          • MASTG-TECH-0144: Bypassing Root Detection
          • MASTG-TECH-0145: Working with XAPK Files
          • MASTG-TECH-0052: Accessing the Device Shell
          • MASTG-TECH-0053: Host-Device Data Transfer
          • MASTG-TECH-0054: Obtaining and Extracting Apps
          • MASTG-TECH-0055: Launching a Repackaged App in Debug Mode
          • MASTG-TECH-0056: Installing Apps
          • MASTG-TECH-0057: Listing Installed Apps
          • MASTG-TECH-0058: Exploring the App Package
          • MASTG-TECH-0059: Accessing App Data Directories
          • MASTG-TECH-0060: Monitoring System Logs
          • MASTG-TECH-0061: Dumping KeyChain Data
          • MASTG-TECH-0062: Basic Network Monitoring/Sniffing
          • MASTG-TECH-0063: Setting up an Interception Proxy
          • MASTG-TECH-0064: Bypassing Certificate Pinning
          • MASTG-TECH-0065: Reverse Engineering iOS Apps
          • MASTG-TECH-0066: Static Analysis on iOS
          • MASTG-TECH-0067: Dynamic Analysis on iOS
          • MASTG-TECH-0068: Disassembling Native Code
          • MASTG-TECH-0069: Decompiling Native Code
          • MASTG-TECH-0070: Extracting Information from the Application Binary
          • MASTG-TECH-0071: Retrieving Strings
          • MASTG-TECH-0072: Retrieving Cross References
          • MASTG-TECH-0073: Information Gathering - API Usage
          • MASTG-TECH-0074: Information Gathering - Network Communication
          • MASTG-TECH-0075: Reviewing Decompiled Objective-C and Swift Code
          • MASTG-TECH-0076: Reviewing Disassembled Objective-C and Swift Code
          • MASTG-TECH-0077: Reviewing Disassembled Native Code
          • MASTG-TECH-0078: Automated Static Analysis
          • MASTG-TECH-0079: Obtaining a Developer Provisioning Profile
          • MASTG-TECH-0080: Get Open Files
          • MASTG-TECH-0081: Get Open Connections
          • MASTG-TECH-0082: Get Shared Libraries
          • MASTG-TECH-0083: TBD
          • MASTG-TECH-0084: Debugging
          • MASTG-TECH-0085: Execution Tracing
          • MASTG-TECH-0086: Method Tracing
          • MASTG-TECH-0087: Native Code Tracing
          • MASTG-TECH-0088: Emulation-based Analysis
          • MASTG-TECH-0089: Symbolic Execution
          • MASTG-TECH-0090: Injecting Frida Gadget into an IPA Automatically
          • MASTG-TECH-0091: Injecting Libraries into an IPA Manually
          • MASTG-TECH-0092: Signing IPA files
          • MASTG-TECH-0093: Waiting for the debugger
          • MASTG-TECH-0094: Getting Loaded Classes and Methods dynamically
          • MASTG-TECH-0095: Method Hooking
          • MASTG-TECH-0096: Process Exploration
          • MASTG-TECH-0097: Runtime Reverse Engineering
          • MASTG-TECH-0098: Patching React Native Apps
          • MASTG-TECH-0110: Intercepting Flutter HTTPS Traffic
          • MASTG-TECH-0111: Extracting Entitlements from MachO Binaries
          • MASTG-TECH-0112: Obtaining the Code Signature Format Version
          • MASTG-TECH-0113: Obtaining Debugging Symbols
          • MASTG-TECH-0114: Demangling Symbols
          • MASTG-TECH-0118: Obtaining Compiler-Provided Security Features
          • MASTG-TECH-0132: Software Composition Analysis (SCA) of iOS Dependencies by Creating a SBOM
          • MASTG-TECH-0133: Software Composition Analysis (SCA) of iOS Dependencies by Scanning Package Manager Artifacts
          • MASTG-TECH-0134: Monitoring the Pasteboard
          • MASTG-TECH-0135: Bypassing Biometric Authentication
          • MASTG-TECH-0136: Retrieving PrivacyInfo.xcprivacy Files
          • MASTG-TECH-0137: Analyzing PrivacyInfo.xcprivacy Files
          • MASTG-TECH-0138: Convert Plist Files to JSON
          • MASTG-TECH-0139: Attach to WKWebView
          • MASTG-TECH-0146: Dynamic Analysis on Non-Jailbroken Devices
      • Tools
          • MASTG-TOOL-0031: Frida
          • MASTG-TOOL-0032: Frida CodeShare
          • MASTG-TOOL-0033: Ghidra
          • MASTG-TOOL-0034: LIEF
          • MASTG-TOOL-0035: MobSF
          • MASTG-TOOL-0036: r2frida
          • MASTG-TOOL-0037: RMS Runtime Mobile Security
          • MASTG-TOOL-0038: objection
          • MASTG-TOOL-0098: iaito
          • MASTG-TOOL-0100: reFlutter
          • MASTG-TOOL-0101: disable-flutter-tls-verification
          • MASTG-TOOL-0104: hermes-dec
          • MASTG-TOOL-0106: Fridump
          • MASTG-TOOL-0108: Corellium
          • MASTG-TOOL-0110: semgrep
          • MASTG-TOOL-0129: rabin2
          • MASTG-TOOL-0131: dependency-check
          • MASTG-TOOL-0132: dependency-track
          • MASTG-TOOL-0133: Visual Studio Code (vscode)
          • MASTG-TOOL-0134: cdxgen
          • MASTG-TOOL-0144: gitleaks
          • MASTG-TOOL-0145: Frooky
          • MASTG-TOOL-0001: Frida (Android)
          • MASTG-TOOL-0002: MobSF (Android)
          • MASTG-TOOL-0003: nm (Android)
          • MASTG-TOOL-0004: adb
          • MASTG-TOOL-0005: Android NDK
          • MASTG-TOOL-0006: Android SDK
          • MASTG-TOOL-0007: Android Studio
          • MASTG-TOOL-0008: Android-SSL-TrustKiller
          • MASTG-TOOL-0009: APKiD
          • MASTG-TOOL-0010: APKLab
          • MASTG-TOOL-0011: Apktool
          • MASTG-TOOL-0012: apkx
          • MASTG-TOOL-0013: Busybox
          • MASTG-TOOL-0014: Bytecode Viewer
          • MASTG-TOOL-0015: drozer
          • MASTG-TOOL-0016: gplaycli
          • MASTG-TOOL-0017: House
          • MASTG-TOOL-0018: jadx
          • MASTG-TOOL-0019: jdb
          • MASTG-TOOL-0020: JustTrustMe
          • MASTG-TOOL-0021: Magisk
          • MASTG-TOOL-0022: ProGuard
          • MASTG-TOOL-0023: RootCloak Plus
          • MASTG-TOOL-0024: Scrcpy
          • MASTG-TOOL-0025: SSLUnpinning
          • MASTG-TOOL-0026: Termux
          • MASTG-TOOL-0027: Xposed
          • MASTG-TOOL-0028: radare2 for Android
          • MASTG-TOOL-0029: objection (Android)
          • MASTG-TOOL-0030: Angr
          • MASTG-TOOL-0099: FlowDroid
          • MASTG-TOOL-0103: uber-apk-signer
          • MASTG-TOOL-0107: jnitrace
          • MASTG-TOOL-0112: pidcat
          • MASTG-TOOL-0116: blutter
          • MASTG-TOOL-0120: ProxyDroid
          • MASTG-TOOL-0123: apksigner
          • MASTG-TOOL-0124: aapt2
          • MASTG-TOOL-0125: Apkleaks
          • MASTG-TOOL-0130: blint
          • MASTG-TOOL-0140: frida-multiple-unpinning
          • MASTG-TOOL-0146: RootBeer
          • MASTG-TOOL-0147: Android RASP
          • MASTG-TOOL-0148: apkeep
          • MASTG-TOOL-0149: LSPosed
          • MASTG-TOOL-0039: Frida (iOS)
          • MASTG-TOOL-0040: MobSF (iOS)
          • MASTG-TOOL-0041: nm (iOS)
          • MASTG-TOOL-0042: BinaryCookieReader
          • MASTG-TOOL-0043: class-dump
          • MASTG-TOOL-0044: class-dump-z
          • MASTG-TOOL-0045: class-dump-dyld
          • MASTG-TOOL-0046: Cycript
          • MASTG-TOOL-0047: Cydia
          • MASTG-TOOL-0048: dsdump
          • MASTG-TOOL-0049: Frida-cycript
          • MASTG-TOOL-0050: Frida-ios-dump
          • MASTG-TOOL-0051: gdb
          • MASTG-TOOL-0053: iOSbackup
          • MASTG-TOOL-0054: ios-deploy
          • MASTG-TOOL-0055: iproxy
          • MASTG-TOOL-0056: Keychain-Dumper
          • MASTG-TOOL-0057: lldb
          • MASTG-TOOL-0058: MachoOView
          • MASTG-TOOL-0059: optool
          • MASTG-TOOL-0060: otool
          • MASTG-TOOL-0061: Grapefruit
          • MASTG-TOOL-0062: Plutil
          • MASTG-TOOL-0063: security
          • MASTG-TOOL-0064: Sileo
          • MASTG-TOOL-0065: simctl
          • MASTG-TOOL-0066: SSL Kill Switch 3
          • MASTG-TOOL-0067: swift-demangle
          • MASTG-TOOL-0068: SwiftShield
          • MASTG-TOOL-0069: Usbmuxd
          • MASTG-TOOL-0070: Xcode
          • MASTG-TOOL-0071: Xcode Command Line Tools
          • MASTG-TOOL-0072: xcrun
          • MASTG-TOOL-0073: radare2 (iOS)
          • MASTG-TOOL-0074: objection (iOS)
          • MASTG-TOOL-0102: ios-app-signer
          • MASTG-TOOL-0105: ipsw
          • MASTG-TOOL-0111: ldid
          • MASTG-TOOL-0114: codesign
          • MASTG-TOOL-0117: fastlane
          • MASTG-TOOL-0118: Sideloadly
          • MASTG-TOOL-0121: objdump (iOS)
          • MASTG-TOOL-0122: c++filt
          • MASTG-TOOL-0126: libimobiledevice suite
          • MASTG-TOOL-0127: AppSync Unified
          • MASTG-TOOL-0128: Filza
          • MASTG-TOOL-0135: PlistBuddy
          • MASTG-TOOL-0136: plistlib
          • MASTG-TOOL-0137: GlobalWebInspect
          • MASTG-TOOL-0138: ipainstaller
          • MASTG-TOOL-0139: ElleKit
          • MASTG-TOOL-0141: IOSSecuritySuite
          • MASTG-TOOL-0142: Choicy
          • MASTG-TOOL-0075: tcpdump (Android)
          • MASTG-TOOL-0076: bettercap
          • MASTG-TOOL-0077: Burp Suite
          • MASTG-TOOL-0078: MITM Relay
          • MASTG-TOOL-0079: ZAP (Zed Attack Proxy)
          • MASTG-TOOL-0080: tcpdump
          • MASTG-TOOL-0081: Wireshark
          • MASTG-TOOL-0097: mitmproxy
          • MASTG-TOOL-0109: Nope-Proxy
          • MASTG-TOOL-0115: HTTP Toolkit
          • MASTG-TOOL-0143: badssl
      • Apps
          • MASTG-APP-0001: AndroGoat
          • MASTG-APP-0002: Android License Validator
          • MASTG-APP-0003: Android UnCrackable L1
          • MASTG-APP-0004: Android UnCrackable L2
          • MASTG-APP-0005: Android UnCrackable L3
          • MASTG-APP-0006: Digitalbank
          • MASTG-APP-0007: DIVA Android
          • MASTG-APP-0008: DodoVulnerableBank
          • MASTG-APP-0009: DVHMA
          • MASTG-APP-0010: InsecureBankv2
          • MASTG-APP-0011: MASTG Hacking Playground (Java)
          • MASTG-APP-0012: MASTG Hacking Playground (Kotlin)
          • MASTG-APP-0013: OVAA
          • MASTG-APP-0014: InsecureShop
          • MASTG-APP-0015: Android UnCrackable L4
          • MASTG-APP-0016: Finstergram
          • MASTG-APP-0017: Disable-flutter-tls-verification
          • MASTG-APP-0018: MASTestApp-Android-NETWORK
          • MASTG-APP-0029: BugBazaar
          • MASTG-APP-0031: VulnForum
          • MASTG-APP-0032: RootBeer Sample
          • MASTG-APP-0033: Android RASP Sample
          • MASTG-APP-0023: DVIA
          • MASTG-APP-0024: DVIA-v2
          • MASTG-APP-0025: iOS UnCrackable L1
          • MASTG-APP-0026: iOS UnCrackable L2
          • MASTG-APP-0027: Disable-flutter-tls-verification
          • MASTG-APP-0028: iGoat-Swift
          • MASTG-APP-0030: iBugBazaar
    • MAS Checklist
      • MASVS-STORAGE
      • MASVS-CRYPTO
      • MASVS-AUTH
      • MASVS-NETWORK
      • MASVS-PLATFORM
      • MASVS-CODE
      • MASVS-RESILIENCE
      • MASVS-PRIVACY
    • MAS Crackmes
      • Android Crackmes
      • iOS Crackmes
    • News
        • 2025
        • 2024
        • 2023
        • 2022
        • 2021
        • 2020
        • 2019
        • 2018
        • 2017
        • 2016
    • 🎙 Talks
    • ⭐ Contribute
      • How Can You Contribute?
      • Getting Started
      • Pull Requests & Reviews
      • Add a New Language
      • Style Guide
      • Add a Crackme
      • How to Run the OWASP MAS Website Locally
      • Writing Content
        • Style and Formatting for MASTG Markdown Files
        • Writing MASTG App Files
        • Writing MASTG Best Practices Files
        • Writing MASTG Demo Files
        • Writing Frida scripts for MASTG demos
        • Writing MASTG Frooky Hook Configurations
        • Writing MASTG Knowledge Files
        • Writing mitmproxy Python scripts for MASTG demos
        • Writing r2 scripts (radare2) for MASTG demos
        • Writing MASTG SAST Rules
        • Writing MASTG Technique Files
        • Writing MASTG Test Files
        • Writing MASTG Tool Files
        • Porting MASTG v1 tests to v2
      • Donations
      • How to Donate
      • Donation Packages
    • 💬 Connect with Us
    android tool

    MASTG-TOOL-0020: JustTrustMe

    {:target="blank"} JustTrustMe is an LSPosed_ module to bypass SSL certificate pinning.

    © OWASP Foundation 2026. This work is licensed under CC-BY-4.0. For any reuse or distribution, you must make clear to others the license terms of this work.
    OWASP ® is a registered trademark of the OWASP Foundation, Inc. This website uses cookies to analyze our traffic and only share that information with our analytics partners. Learn more.
    Made with Material for MkDocs | Website and covers designed by Carlos Holguera.