logo
OWASP Mobile Application Security
MASTG-TOOL-0020: JustTrustMe
Initializing search
    • Home
    • MASVS
    • MASWE (Beta)
    • MASTG
    • MAS Checklist
    • MAS Crackmes
    • News
    • 🎙 Talks
    • ⭐ Contribute
    • 💙 Donate
    • 💬 Connect with Us
    • Home
    • MASVS
        • Foreword
        • About the Standard
        • The Mobile Application Security Verification Standard
        • Assessment and Certification
      • MASVS-STORAGE: Storage
      • MASVS-STORAGE-1
      • MASVS-STORAGE-2
      • MASVS-CRYPTO: Cryptography
      • MASVS-CRYPTO-1
      • MASVS-CRYPTO-2
      • MASVS-AUTH: Authentication and Authorization
      • MASVS-AUTH-1
      • MASVS-AUTH-2
      • MASVS-AUTH-3
      • MASVS-NETWORK: Network Communication
      • MASVS-NETWORK-1
      • MASVS-NETWORK-2
      • MASVS-PLATFORM: Platform Interaction
      • MASVS-PLATFORM-1
      • MASVS-PLATFORM-2
      • MASVS-PLATFORM-3
      • MASVS-CODE: Code Quality
      • MASVS-CODE-1
      • MASVS-CODE-2
      • MASVS-CODE-3
      • MASVS-CODE-4
      • MASVS-RESILIENCE: Resilience Against Reverse Engineering and Tampering
      • MASVS-RESILIENCE-1
      • MASVS-RESILIENCE-2
      • MASVS-RESILIENCE-3
      • MASVS-RESILIENCE-4
      • MASVS-PRIVACY: Privacy
      • MASVS-PRIVACY-1
      • MASVS-PRIVACY-2
      • MASVS-PRIVACY-3
      • MASVS-PRIVACY-4
    • MASWE (Beta)
        • MASWE-0001: Insertion of Sensitive Data into Logs
        • MASWE-0002: Sensitive Data Stored With Insufficient Access Restrictions in Internal Locations
        • MASWE-0003: Backup Unencrypted
        • MASWE-0004: Sensitive Data Not Excluded From Backup
        • MASWE-0006: Sensitive Data Stored Unencrypted in Private Storage Locations
        • MASWE-0007: Sensitive Data Stored Unencrypted in Shared Storage Requiring No User Interaction
        • MASWE-0009: Improper Cryptographic Key Generation
        • MASWE-0010: Improper Cryptographic Key Derivation
        • MASWE-0011: Cryptographic Key Rotation Not Implemented
        • MASWE-0012: Insecure or Wrong Usage of Cryptographic Key
        • MASWE-0013: Hardcoded Cryptographic Keys in Use
        • MASWE-0014: Cryptographic Keys Not Properly Protected at Rest
        • MASWE-0015: Deprecated Android KeyStore Implementations
        • MASWE-0016: Unsafe Handling of Imported Cryptographic Keys
        • MASWE-0017: Cryptographic Keys Not Properly Protected on Export
        • MASWE-0018: Cryptographic Keys Access Not Restricted
        • MASWE-0019: Risky Cryptography Implementations
        • MASWE-0020: Improper Encryption
        • MASWE-0021: Improper Hashing
        • MASWE-0022: Predictable Initialization Vectors (IVs)
        • MASWE-0023: Risky Padding
        • MASWE-0024: Improper Use of Message Authentication Code (MAC)
        • MASWE-0025: Improper Generation of Cryptographic Signatures
        • MASWE-0026: Improper Verification of Cryptographic Signature
        • MASWE-0027: Improper Random Number Generation
        • MASWE-0005: API Keys Hardcoded in the App Package
        • MASWE-0028: MFA Implementation Best Practices Not Followed
        • MASWE-0029: Step-Up Authentication Not Implemented After Login
        • MASWE-0030: Re-Authenticates Not Triggered On Contextual State Changes
        • MASWE-0031: Insecure use of Android Protected Confirmation
        • MASWE-0032: Platform-provided Authentication APIs Not Used
        • MASWE-0033: Authentication or Authorization Protocol Security Best Practices Not Followed
        • MASWE-0034: Insecure Implementation of Confirm Credentials
        • MASWE-0035: Passwordless Authentication Not Implemented
        • MASWE-0036: Authentication Material Stored Unencrypted on the Device
        • MASWE-0037: Authentication Material Sent over Insecure Connections
        • MASWE-0038: Authentication Tokens Not Validated
        • MASWE-0039: Shared Web Credentials and Website-association Not Implemented
        • MASWE-0040: Insecure Authentication in WebViews
        • MASWE-0041: Authentication Enforced Only Locally Instead of on the Server-side
        • MASWE-0042: Authorization Enforced Only Locally Instead of on the Server-side
        • MASWE-0043: App Custom PIN Not Bound to Platform KeyStore
        • MASWE-0044: Biometric Authentication Can Be Bypassed
        • MASWE-0045: Fallback to Non-biometric Credentials Allowed for Sensitive Transactions
        • MASWE-0046: Crypto Keys Not Invalidated on New Biometric Enrollment
        • MASWE-0047: Insecure Identity Pinning
        • MASWE-0048: Insecure Machine-to-Machine Communication
        • MASWE-0049: Proven Networking APIs Not used
        • MASWE-0050: Cleartext Traffic
        • MASWE-0051: Unprotected Open Ports
        • MASWE-0052: Insecure Certificate Validation
        • MASWE-0053: Sensitive Data Leaked via the User Interface
        • MASWE-0054: Sensitive Data Leaked via Notifications
        • MASWE-0055: Sensitive Data Leaked via Screenshots or Screen Recordings
        • MASWE-0056: Tapjacking Attacks
        • MASWE-0057: StrandHogg Attack / Task Affinity Vulnerability
        • MASWE-0058: Insecure Deep Links
        • MASWE-0059: Use Of Unauthenticated Platform IPC
        • MASWE-0060: Insecure Use of UIActivity
        • MASWE-0061: Insecure Use of App Extensions
        • MASWE-0062: Insecure Services
        • MASWE-0063: Insecure Broadcast Receivers
        • MASWE-0064: Insecure Content Providers
        • MASWE-0065: Sensitive Data Permanently Shared with Other Apps
        • MASWE-0066: Insecure Intents
        • MASWE-0068: JavaScript Bridges in WebViews
        • MASWE-0069: WebViews Allows Access to Local Resources
        • MASWE-0070: JavaScript Loaded from Untrusted Sources
        • MASWE-0071: WebViews Loading Content from Untrusted Sources
        • MASWE-0072: Universal XSS
        • MASWE-0073: Insecure WebResourceResponse Implementations
        • MASWE-0074: Web Content Debugging Enabled
        • MASWE-0118: Sensitive Data Not Removed After Use
        • MASWE-0119: Insecure Activities
        • MASWE-0075: Enforced Updating Not Implemented
        • MASWE-0076: Dependencies with Known Vulnerabilities
        • MASWE-0077: Running on a recent Platform Version Not Ensured
        • MASWE-0078: Latest Platform Version Not Targeted
        • MASWE-0079: Unsafe Handling of Data from the Network
        • MASWE-0080: Unsafe Handling of Data from Backups
        • MASWE-0081: Unsafe Handling Of Data From External Interfaces
        • MASWE-0082: Unsafe Handling of Data From Local Storage
        • MASWE-0083: Unsafe Handling of Data From The User Interface
        • MASWE-0084: Unsafe Handling of Data from IPC
        • MASWE-0085: Unsafe Dynamic Code Loading
        • MASWE-0086: SQL Injection
        • MASWE-0087: Insecure Parsing and Escaping
        • MASWE-0088: Insecure Object Deserialization
        • MASWE-0116: Compiler-Provided Security Features Not Used
        • MASWE-0008: Missing Device Secure Lock Verification Implementation
        • MASWE-0067: Debuggable Flag Not Disabled
        • MASWE-0089: Code Obfuscation Not Implemented
        • MASWE-0090: Resource Obfuscation Not Implemented
        • MASWE-0091: Anti-Deobfuscation Techniques Not Implemented
        • MASWE-0092: Static Analysis Tools Not Prevented
        • MASWE-0093: Debugging Symbols Not Removed
        • MASWE-0094: Non-Production Resources Not Removed
        • MASWE-0095: Code That Disables Security Controls Not Removed
        • MASWE-0096: Data Sent Unencrypted Over Encrypted Connections
        • MASWE-0097: Root/Jailbreak Detection Not Implemented
        • MASWE-0098: App Virtualization Environment Detection Not Implemented
        • MASWE-0099: Emulator Detection Not Implemented
        • MASWE-0100: Device Attestation Not Implemented
        • MASWE-0101: Debugger Detection Not Implemented
        • MASWE-0102: Dynamic Analysis Tools Detection Not Implemented
        • MASWE-0103: RASP Techniques Not Implemented
        • MASWE-0104: App Integrity Not Verified
        • MASWE-0105: Integrity of App Resources Not Verified
        • MASWE-0106: Official Store Verification Not Implemented
        • MASWE-0107: Runtime Code Integrity Not Verified
        • MASWE-0108: Sensitive Data in Network Traffic
        • MASWE-0109: Lack of Anonymization or Pseudonymisation Measures
        • MASWE-0110: Use of Unique Identifiers for User Tracking
        • MASWE-0111: Inadequate Privacy Policy
        • MASWE-0112: Inadequate Data Collection Declarations
        • MASWE-0113: Lack of Proper Data Management Controls
        • MASWE-0114: Inadequate Data Visibility Controls
        • MASWE-0115: Inadequate or Ambiguous User Consent Mechanisms
        • MASWE-0117: Inadequate Permission Management
    • MASTG
        • Foreword
        • Frontispiece
        • OWASP MASVS and MASTG Adoption
        • Acknowledgments
        • Suggested Reading
        • Mobile Application Taxonomy
        • Mobile Application Security Testing
        • Mobile App Tampering and Reverse Engineering
        • Mobile App Authentication Architectures
        • Mobile App Network Communication
        • Mobile App Cryptography
        • Mobile App Code Quality
        • Mobile App User Privacy Protection
        • MAS Testing Profiles
        • Android Platform Overview
        • Android Security Testing
        • Android Data Storage
        • Android Cryptographic APIs
        • Android Local Authentication
        • Android Network Communication
        • Android Platform APIs
        • Android Code Quality and Build Settings
        • Android Anti-Reversing Defenses
        • iOS Platform Overview
        • iOS Security Testing
        • iOS Data Storage
        • iOS Cryptographic APIs
        • iOS Local Authentication
        • iOS Network Communication
        • iOS Platform APIs
        • iOS Code Quality and Build Settings
        • iOS Anti-Reversing Defenses
      • Best Practices
        • MASTG-BEST-0001: Use Secure Random Number Generator APIs
        • MASTG-BEST-0002: Remove Logging Code
        • MASTG-BEST-0003: Comply with Privacy Regulations and Best Practices
        • MASTG-BEST-0004: Exclude Sensitive Data from Backups
        • MASTG-BEST-0005: Use Secure Encryption Modes
        • MASTG-BEST-0006: Use Up-to-Date APK Signing Schemes
        • MASTG-BEST-0007: Debuggable Flag Disabled in the AndroidManifest
        • MASTG-BEST-0008: Debugging Disabled for WebViews
        • MASTG-BEST-0009: Use Secure Encryption Algorithms
        • MASTG-BEST-0010: Use Up-to-Date minSdkVersion
        • MASTG-BEST-0011: Securely Load File Content in a WebView
        • MASTG-BEST-0012: Disable JavaScript in WebViews
        • MASTG-BEST-0013: Disable Content Provider Access in WebViews
        • MASTG-BEST-0014: Preventing Screenshots and Screen Recording
        • MASTG-BEST-0015: Use `setRecentsScreenshotEnabled` to Prevent Screenshots When Backgrounded
        • MASTG-BEST-0016: Use `SECURE_FLAG` to Prevent Screenshots and Screen Recording
        • MASTG-BEST-0017: Use `setSecure` to Prevent Screenshots in SurfaceViews
        • MASTG-BEST-0018: Use `SecureFlagPolicy.SecureOn` to Prevent Screenshots in Compose Components
        • MASTG-BEST-0019: Use Non-Caching Input Types for Sensitive Fields
        • MASTG-BEST-0020: Update the GMS Security Provider
        • MASTG-BEST-0021: Ensure Proper Error and Exception Handling
        • MASTG-BEST-0022: Disable Verbose and Debug Logging in Production Builds
        • MASTG-BEST-0023: Exclude Sensitive Information from Backups
        • MASTG-BEST-0024: Store Data Encrypted in App Sandbox Directory
        • MASTG-BEST-0025: Use Secure Random Number Generator APIs
        • MASTG-BEST-0026: Preventing Keyboard Caching for Sensitive Text Inputs
        • MASTG-BEST-0027: Preventing Sensitive Data Exposure in Notifications
        • MASTG-BEST-0028: WebViews Cache Cleanup
        • MASTG-BEST-0029: Implementing Resilience and RASP Signals
        • MASTG-BEST-0030: Implementing Root Detection
        • MASTG-BEST-0031: Enforce Strong Biometrics for Sensitive Operations
        • MASTG-BEST-0032: Migrate from UIWebView to WKWebView
        • MASTG-BEST-0033: Securely Load File Content in a WebView
        • MASTG-BEST-0034: Validate WebView Input
        • MASTG-BEST-0035: Prefer Origin Scoped Messaging Over Legacy JavaScript Bridges
        • MASTG-BEST-0036: Use Cryptographic Binding for Biometric Authentication
        • MASTG-BEST-0037: Invalidate Biometric Keys on Enrollment Changes
        • MASTG-BEST-0038: Require Explicit User Confirmation for Biometric Authentication
        • MASTG-BEST-0039: Prevent SQL Injection in ContentProviders
        • MASTG-BEST-0040: Preventing Overlay Attacks
        • MASTG-BEST-0041: Hardening Against Runtime Hooking
        • MASTG-BEST-0042: Use Strong TLS Settings in ATS Configuration
        • MASTG-BEST-0043: Enforce Strong TLS Settings When ATS Doesn't Apply
        • MASTG-BEST-0044: Mask Sensitive Data in Text Input Fields
        • MASTG-BEST-0045: Limit Sensitive Data Exposure Through iOS IPC Channels
        • MASTG-BEST-0046: Hardening Against Emulation
        • MASTG-BEST-0047: Continuous Anti-Debugging Checks
        • MASTG-BEST-0048: Hardening Against Reverse Engineering Tools
        • MASTG-BEST-0049: Restrict and Validate Access to Exported Content Providers
        • MASTG-BEST-0050: Store Data Encrypted in App Sandbox Directory
        • MASTG-BEST-0051: Minimize iOS Permissions and Entitlements
        • MASTG-BEST-0052: Restrict Access to Android App Components
        • MASTG-BEST-0053: Hardening Against Virtual Devices
        • MASTG-BEST-0054: Validate Input Parameters in Custom URL Scheme Handlers
        • MASTG-BEST-0055: Validate Source Application in Custom URL Scheme Handlers
        • MASTG-BEST-0056: Use Explicit Intents for Internal IPC
        • MASTG-BEST-0057: Sanitize Data Coming from External Components
        • MASTG-BEST-0058: Restrict Native Functionality Exposed Through WebView Bridges
        • MASTG-BEST-0059: Render Sensitive UI as Native Views Over the WebView
        • MASTG-BEST-0060: Use Native Views for Sensitive Text Entry Over a WebView
        • MASTG-BEST-0061: Use WKContentWorld Isolation for DOM Inspection Scripts
        • MASTG-BEST-0062: Use WKScriptMessageHandlerWithReply to Return Data to JavaScript
        • MASTG-BEST-0063: Use Immutable PendingIntents with Explicit Intents
        • MASTG-BEST-0064: Use Safe APIs for Object Deserialization
        • MASTG-BEST-0065: Implementing Storage Integrity Checks on iOS
        • MASTG-BEST-0066: Implementing Storage Integrity Checks on Android
        • MASTG-BEST-0067: Implementing Source Code Integrity Checks on iOS
        • MASTG-BEST-0068: Secure Data Sharing Between App Extensions and Containing Apps
        • MASTG-BEST-0069: Keep Sensitive Input on the System Keyboard
        • MASTG-BEST-0070: Verify Android App Links with autoVerify and Digital Asset Links
        • MASTG-BEST-0071: Validate Input Parameters in Deep Link and Custom URL Scheme Handlers
        • MASTG-BEST-0072: Validate Input Parameters in Universal Link Handlers
        • MASTG-BEST-0073: Properly Validate Server Trust in URLSessionDelegate and WKNavigationDelegate
        • MASTG-BEST-0074: Implementing Anti-Debugging Checks on iOS
      • Knowledge
            • MASTG-KNOW-0036: Shared Preferences
            • MASTG-KNOW-0037: SQLite Database
            • MASTG-KNOW-0038: SQLCipher Database
            • MASTG-KNOW-0039: Firebase Real-time Databases
            • MASTG-KNOW-0040: Realm Databases
            • MASTG-KNOW-0041: Internal Storage
            • MASTG-KNOW-0042: External Storage
            • MASTG-KNOW-0043: Android KeyStore
            • MASTG-KNOW-0044: Key Attestation
            • MASTG-KNOW-0045: Secure Key Import into Keystore
            • MASTG-KNOW-0046: BouncyCastle KeyStore
            • MASTG-KNOW-0047: Cryptographic Key Storage
            • MASTG-KNOW-0048: KeyChain
            • MASTG-KNOW-0049: Logs
            • MASTG-KNOW-0050: Backups
            • MASTG-KNOW-0051: Process Memory
            • MASTG-KNOW-0052: User Interface Components
            • MASTG-KNOW-0053: Screenshots
            • MASTG-KNOW-0054: App Notifications
            • MASTG-KNOW-0055: Keyboard Cache
            • MASTG-KNOW-0011: Security Provider
            • MASTG-KNOW-0012: Key Generation
            • MASTG-KNOW-0013: Random Number Generation
            • MASTG-KNOW-0001: Biometric Authentication
            • MASTG-KNOW-0002: FingerprintManager
            • MASTG-KNOW-0014: Android Network Security Configuration
            • MASTG-KNOW-0015: Certificate Pinning
            • MASTG-KNOW-0016: TBD
            • MASTG-KNOW-0017: App Permissions
            • MASTG-KNOW-0018: WebViews
            • MASTG-KNOW-0019: Deep Links
            • MASTG-KNOW-0020: Inter-Process Communication (IPC) Mechanisms
            • MASTG-KNOW-0021: Object Serialization
            • MASTG-KNOW-0022: Overlay Attacks
            • MASTG-KNOW-0023: Enforced Updating
            • MASTG-KNOW-0024: Pending Intents
            • MASTG-KNOW-0025: Explicit vs Implicit Intents
            • MASTG-KNOW-0105: User-Initiated Screenshots and Screen Recording
            • MASTG-KNOW-0106: App-Initiated Screenshots and Screen Recording
            • MASTG-KNOW-0107: Screenshots and Screen Recording Detection
            • MASTG-KNOW-0132: Android Activities
            • MASTG-KNOW-0133: Android Services
            • MASTG-KNOW-0134: Android Broadcast Receivers
            • MASTG-KNOW-0004: Third-Party Libraries
            • MASTG-KNOW-0005: Memory Corruption Bugs
            • MASTG-KNOW-0006: Binary Protection Mechanisms
            • MASTG-KNOW-0008: Debugging Information and Debug Symbols
            • MASTG-KNOW-0009: StrictMode
            • MASTG-KNOW-0010: Exception Handling
            • MASTG-KNOW-0117: Android ContentProvider
            • MASTG-KNOW-0138: URI Schemes in Android Intent Results
            • MASTG-KNOW-0003: App Signing
            • MASTG-KNOW-0007: Debuggable Apps
            • MASTG-KNOW-0027: Root Detection
            • MASTG-KNOW-0028: Anti-Debugging
            • MASTG-KNOW-0029: File Integrity Checks
            • MASTG-KNOW-0030: Reverse Engineering Tool Detection
            • MASTG-KNOW-0031: Emulator Detection
            • MASTG-KNOW-0032: Runtime Integrity Verification
            • MASTG-KNOW-0033: Obfuscation
            • MASTG-KNOW-0034: Device Binding
            • MASTG-KNOW-0035: Google Play Integrity API
            • MASTG-KNOW-0118: Runtime Application Self-Protection (RASP)
            • MASTG-KNOW-0119: Key Attestation
            • MASTG-KNOW-0120: Device Attestation
            • MASTG-KNOW-0026: Third-party Services Embedded in the App
            • MASTG-KNOW-0091: File System APIs
            • MASTG-KNOW-0092: Binary Data Storage
            • MASTG-KNOW-0093: UserDefaults
            • MASTG-KNOW-0094: CoreData
            • MASTG-KNOW-0095: Firebase Real-time Databases
            • MASTG-KNOW-0096: Realm Databases
            • MASTG-KNOW-0097: Other Third-Party Databases
            • MASTG-KNOW-0098: User Interface Components
            • MASTG-KNOW-0099: Screenshots
            • MASTG-KNOW-0100: Keyboard Cache
            • MASTG-KNOW-0101: Logs
            • MASTG-KNOW-0102: Backups
            • MASTG-KNOW-0103: Process Memory
            • MASTG-KNOW-0108: App Sandbox Directories
            • MASTG-KNOW-0066: CryptoKit
            • MASTG-KNOW-0067: CommonCrypto, SecKey and Wrapper libraries
            • MASTG-KNOW-0068: Cryptographic Third-Party libraries
            • MASTG-KNOW-0069: Key Management
            • MASTG-KNOW-0070: Random Number Generator
            • MASTG-KNOW-0056: Local Authentication Framework
            • MASTG-KNOW-0057: Keychain Services
            • MASTG-KNOW-0071: iOS App Transport Security
            • MASTG-KNOW-0072: Server Trust Evaluation
            • MASTG-KNOW-0073: iOS Network APIs
            • MASTG-KNOW-0074: Enforced Updating
            • MASTG-KNOW-0075: Object Serialization
            • MASTG-KNOW-0076: WebViews
            • MASTG-KNOW-0077: App Permissions
            • MASTG-KNOW-0078: Inter-Process Communication (IPC)
            • MASTG-KNOW-0079: Custom URL Schemes
            • MASTG-KNOW-0080: Universal Links
            • MASTG-KNOW-0081: UIActivity Sharing
            • MASTG-KNOW-0082: App Extensions
            • MASTG-KNOW-0083: Pasteboard
            • MASTG-KNOW-0104: Low-Level System IPC Mechanisms
            • MASTG-KNOW-0121: Text Input Field Masking in iOS
            • MASTG-KNOW-0122: Document Picker, Document Interaction, and Open in Place
            • MASTG-KNOW-0123: Handoff
            • MASTG-KNOW-0124: SiriKit and Siri Shortcuts
            • MASTG-KNOW-0125: App Groups
            • MASTG-KNOW-0126: Keychain Access Groups
            • MASTG-KNOW-0127: File Coordination APIs
            • MASTG-KNOW-0128: Bonjour
            • MASTG-KNOW-0129: App Intents and AI Agent Exposure
            • MASTG-KNOW-0130: Core Bluetooth
            • MASTG-KNOW-0131: Core NFC
            • MASTG-KNOW-0139: WKContentWorld
            • MASTG-KNOW-0141: Custom Keyboards
            • MASTG-KNOW-0058: App Signing
            • MASTG-KNOW-0059: Third-Party Libraries
            • MASTG-KNOW-0060: Memory Corruption Bugs
            • MASTG-KNOW-0061: Binary Protection Mechanisms
            • MASTG-KNOW-0062: Debuggable Apps
            • MASTG-KNOW-0063: Debugging Information and Debug Symbols
            • MASTG-KNOW-0064: Non-Production Resources
            • MASTG-KNOW-0065: Exception Handling
            • MASTG-KNOW-0084: Jailbreak Detection
            • MASTG-KNOW-0085: Anti-Debugging Detection
            • MASTG-KNOW-0086: Storage Integrity Checks
            • MASTG-KNOW-0087: Reverse Engineering Tools Detection
            • MASTG-KNOW-0088: iOS Simulator Detection
            • MASTG-KNOW-0089: Obfuscation
            • MASTG-KNOW-0090: Device Binding
            • MASTG-KNOW-0135: Virtual Devices Detection
            • MASTG-KNOW-0136: iOS Apps Running on macOS Detection
            • MASTG-KNOW-0140: Source Code Integrity Checks
          • MASVS-PRIVACY
      • Tests
            • MASTG-TEST-0001: Testing Local Storage for Sensitive Data
            • MASTG-TEST-0003: Testing Logs for Sensitive Data
            • MASTG-TEST-0004: Determining Whether Sensitive Data Is Shared with Third Parties via Embedded Services
            • MASTG-TEST-0005: Determining Whether Sensitive Data Is Shared with Third Parties via Notifications
            • MASTG-TEST-0006: Determining Whether the Keyboard Cache Is Disabled for Text Input Fields
            • MASTG-TEST-0009: Testing Backups for Sensitive Data
            • MASTG-TEST-0011: Testing Memory for Sensitive Data
            • MASTG-TEST-0012: Testing the Device-Access-Security Policy
            • MASTG-TEST-0200: Files Written to External Storage
            • MASTG-TEST-0201: Runtime Use of APIs to Access External Storage
            • MASTG-TEST-0202: References to APIs and Permissions for Accessing External Storage
            • MASTG-TEST-0203: Runtime Use of Logging APIs
            • MASTG-TEST-0207: Runtime Storage of Unencrypted Data in the App Sandbox
            • MASTG-TEST-0216: Sensitive Data Not Excluded From Backup
            • MASTG-TEST-0231: References to Logging APIs
            • MASTG-TEST-0262: References to Backup Configurations Not Excluding Sensitive Data
            • MASTG-TEST-0287: Runtime Storage of Unencrypted Data via the SharedPreferences API
            • MASTG-TEST-0304: References to Sensitive Data Unencrypted via Android Room Database
            • MASTG-TEST-0305: Sensitive Data Stored Unencrypted via DataStore
            • MASTG-TEST-0306: References to Sensitive Data Stored Unencrypted via Android Room DB
            • MASTG-TEST-0013: Testing Symmetric Cryptography
            • MASTG-TEST-0014: Testing the Configuration of Cryptographic Standard Algorithms
            • MASTG-TEST-0015: Testing the Purposes of Keys
            • MASTG-TEST-0016: Testing Random Number Generation
            • MASTG-TEST-0204: Insecure Random API Usage
            • MASTG-TEST-0205: Non-random Sources Usage
            • MASTG-TEST-0208: Insufficient Key Sizes
            • MASTG-TEST-0212: Use of Hardcoded Cryptographic Keys in Code
            • MASTG-TEST-0221: Broken Symmetric Encryption Algorithms
            • MASTG-TEST-0232: Broken Symmetric Encryption Modes
            • MASTG-TEST-0307: References to Asymmetric Key Pairs Used For Multiple Purposes
            • MASTG-TEST-0308: Runtime Use of Asymmetric Key Pairs Used For Multiple Purposes
            • MASTG-TEST-0309: References to Reused Initialization Vectors in Symmetric Encryption
            • MASTG-TEST-0310: Runtime Use of Reused Initialization Vectors in Symmetric Encryption
            • MASTG-TEST-0312: References to Explicit Security Provider in Cryptographic APIs
            • MASTG-TEST-0350: Runtime Use of Broken Symmetric Encryption Modes
            • MASTG-TEST-0017: Testing Confirm Credentials
            • MASTG-TEST-0018: Testing Biometric Authentication
            • MASTG-TEST-0326: References to APIs Allowing Fallback to Non-Biometric Authentication
            • MASTG-TEST-0327: References to APIs for Event-Bound Biometric Authentication
            • MASTG-TEST-0328: References to APIs Detecting Biometric Enrollment Changes
            • MASTG-TEST-0329: References to APIs Enforcing Authentication without Explicit User Action
            • MASTG-TEST-0330: References to APIs for Keys used in Biometric Authentication with Extended Validity Duration
            • MASTG-TEST-0019: Testing Data Encryption on the Network
            • MASTG-TEST-0020: Testing the TLS Settings
            • MASTG-TEST-0021: Testing Endpoint Identify Verification
            • MASTG-TEST-0022: Testing Custom Certificate Stores and Certificate Pinning
            • MASTG-TEST-0023: Testing the Security Provider
            • MASTG-TEST-0217: Insecure TLS Protocols Explicitly Allowed in Code
            • MASTG-TEST-0218: Insecure TLS Protocols in Network Traffic
            • MASTG-TEST-0233: Hardcoded HTTP URLs
            • MASTG-TEST-0234: Missing Implementation of Server Hostname Verification with SSLSockets
            • MASTG-TEST-0235: Android App Configurations Allowing Cleartext Traffic
            • MASTG-TEST-0236: Cleartext Traffic Observed on the Network
            • MASTG-TEST-0237: Cross-Platform Framework Configurations Allowing Cleartext Traffic
            • MASTG-TEST-0238: Runtime Use of Network APIs Transmitting Cleartext Traffic
            • MASTG-TEST-0239: Using low-level APIs (e.g. Socket) to set up a custom HTTP connection
            • MASTG-TEST-0242: Missing Certificate Pinning in Network Security Configuration
            • MASTG-TEST-0243: Expired Certificate Pins in the Network Security Configuration
            • MASTG-TEST-0244: Missing Certificate Pinning in Network Traffic
            • MASTG-TEST-0282: Unsafe Custom Trust Evaluation
            • MASTG-TEST-0283: Incorrect Implementation of Server Hostname Verification
            • MASTG-TEST-0284: Incorrect SSL Error Handling in WebViews
            • MASTG-TEST-0285: Outdated Android Version Allowing Trust in User-Provided CAs
            • MASTG-TEST-0286: Network Security Configuration Allowing Trust in User-Provided CAs
            • MASTG-TEST-0295: GMS Security Provider Not Updated
            • MASTG-TEST-0007: Determining Whether Sensitive Stored Data Has Been Exposed via IPC Mechanisms
            • MASTG-TEST-0008: Checking for Sensitive Data Disclosure Through the User Interface
            • MASTG-TEST-0010: Finding Sensitive Information in Auto-Generated Screenshots
            • MASTG-TEST-0024: Testing for App Permissions
            • MASTG-TEST-0028: Testing Deep Links
            • MASTG-TEST-0029: Testing for Sensitive Functionality Exposure Through IPC
            • MASTG-TEST-0030: Testing for Vulnerable Implementation of PendingIntent
            • MASTG-TEST-0031: Testing JavaScript Execution in WebViews
            • MASTG-TEST-0032: Testing WebView Protocol Handlers
            • MASTG-TEST-0033: Testing for Java Objects Exposed Through WebViews
            • MASTG-TEST-0035: Testing for Overlay Attacks
            • MASTG-TEST-0037: Testing WebViews Cleanup
            • MASTG-TEST-0250: References to Content Provider Access in WebViews
            • MASTG-TEST-0251: Runtime Use of Content Provider Access APIs in WebViews
            • MASTG-TEST-0252: References to Local File Access in WebViews
            • MASTG-TEST-0253: Runtime Use of Local File Access APIs in WebViews
            • MASTG-TEST-0258: References to Keyboard Caching Attributes in UI Elements
            • MASTG-TEST-0289: Runtime Verification of Sensitive Content Exposure in Screenshots During App Backgrounding
            • MASTG-TEST-0291: References to Screen Capturing Prevention APIs
            • MASTG-TEST-0292: `setRecentsScreenshotEnabled` Not Used to Prevent Screenshots When Backgrounded
            • MASTG-TEST-0293: `setSecure` Not Used to Prevent Screenshots in SurfaceViews
            • MASTG-TEST-0294: `SecureOn` Not Used to Prevent Screenshots in Compose Dialogs
            • MASTG-TEST-0315: Sensitive Data Exposed via Notifications
            • MASTG-TEST-0316: App Exposing User Authentication Data in Text Input Fields
            • MASTG-TEST-0320: WebViews Not Cleaning Up Sensitive Data
            • MASTG-TEST-0334: Native Code Exposed Through WebViews
            • MASTG-TEST-0340: References to Overlay Attack Protections
            • MASTG-TEST-0355: References to Unauthorized Database Access through Content Providers
            • MASTG-TEST-0356: Runtime Verification of Unauthorized Database Access through Content Providers
            • MASTG-TEST-0357: References to Oversharing of File-Based Content Providers
            • MASTG-TEST-0364: Exported And Unprotected Activities That Expose Sensitive Functionality
            • MASTG-TEST-0365: Exported And Unprotected Services That Expose Sensitive Functionality
            • MASTG-TEST-0366: Exported And Unprotected Broadcast Receivers That Expose Sensitive Functionality
            • MASTG-TEST-0381: References to Insecure PendingIntent Creation
            • MASTG-TEST-0393: Use of Unverified App Links
            • MASTG-TEST-0394: Missing Input Validation in Custom URL Scheme Handlers
            • MASTG-TEST-0002: Testing Local Storage for Input Validation
            • MASTG-TEST-0025: Testing for Injection Flaws
            • MASTG-TEST-0026: Testing Implicit Intents
            • MASTG-TEST-0027: Testing for URL Loading in WebViews
            • MASTG-TEST-0034: Testing Object Persistence
            • MASTG-TEST-0036: Testing Enforced Updating
            • MASTG-TEST-0042: Checking for Weaknesses in Third Party Libraries
            • MASTG-TEST-0043: Memory Corruption Bugs
            • MASTG-TEST-0044: Make Sure That Free Security Features Are Activated
            • MASTG-TEST-0222: Position Independent Code (PIC) Not Enabled
            • MASTG-TEST-0223: Stack Canaries Not Enabled
            • MASTG-TEST-0245: References to Platform Version APIs
            • MASTG-TEST-0272: Identify Dependencies with Known Vulnerabilities in the Android Project
            • MASTG-TEST-0274: Dependencies with Known Vulnerabilities in the App's SBOM
            • MASTG-TEST-0337: References to Object Deserialization of Untrusted Data
            • MASTG-TEST-0339: SQL Injection in Content Providers
            • MASTG-TEST-0372: Implicit Intents Used for Internal App Communication
            • MASTG-TEST-0374: References to Implicit Intents Carrying Sensitive Extras
            • MASTG-TEST-0375: Missing Validation of Data Returned from Implicit Intents
            • MASTG-TEST-0382: Runtime Use of Enforced Updating APIs
            • MASTG-TEST-0392: References to Enforced Updating APIs
            • MASTG-TEST-0398: References to WebViewClient URL Loading Handlers
            • MASTG-TEST-0399: SafeBrowsing Disabled
            • MASTG-TEST-0400: Runtime Use of WebViewClient URL Loading Handlers
            • MASTG-TEST-0038: Making Sure that the App is Properly Signed
            • MASTG-TEST-0039: Testing whether the App is Debuggable
            • MASTG-TEST-0040: Testing for Debugging Symbols
            • MASTG-TEST-0041: Testing for Debugging Code and Verbose Error Logging
            • MASTG-TEST-0045: Testing Root Detection
            • MASTG-TEST-0046: Testing Anti-Debugging Detection
            • MASTG-TEST-0047: Testing File Integrity Checks
            • MASTG-TEST-0048: Testing Reverse Engineering Tools Detection
            • MASTG-TEST-0049: Testing Emulator Detection
            • MASTG-TEST-0050: Testing Runtime Integrity Checks
            • MASTG-TEST-0051: Testing Obfuscation
            • MASTG-TEST-0224: Usage of Insecure APK Signature Version
            • MASTG-TEST-0225: Usage of Insecure APK Signature Key Size
            • MASTG-TEST-0226: Debuggable Flag Enabled in the AndroidManifest
            • MASTG-TEST-0227: Debugging Enabled for WebViews
            • MASTG-TEST-0247: References to APIs for Detecting Secure Screen Lock
            • MASTG-TEST-0249: Runtime Use of Secure Screen Lock Detection APIs
            • MASTG-TEST-0263: Logging of StrictMode Violations
            • MASTG-TEST-0264: Runtime Use of StrictMode APIs
            • MASTG-TEST-0265: References to StrictMode APIs
            • MASTG-TEST-0288: Debugging Symbols in Native Binaries
            • MASTG-TEST-0324: References to Root Detection Mechanisms
            • MASTG-TEST-0325: Runtime Use of Root Detection Techniques
            • MASTG-TEST-0338: References to Storage Integrity Check APIs
            • MASTG-TEST-0341: Runtime Use of Hook Detection Techniques
            • MASTG-TEST-0351: Runtime Use of Emulator Detection Techniques
            • MASTG-TEST-0352: References to Debugging Detection APIs
            • MASTG-TEST-0353: Runtime Use of Debugging Detection APIs
            • MASTG-TEST-0368: Insufficient Obfuscation of Security-Relevant Java/Kotlin Code
            • MASTG-TEST-0369: Insufficient Obfuscation of Security-Relevant Native Code
            • MASTG-TEST-0206: Undeclared PII in Network Traffic Capture
            • MASTG-TEST-0254: Dangerous App Permissions
            • MASTG-TEST-0255: Permission Requests Not Minimized
            • MASTG-TEST-0256: Missing Permission Rationale
            • MASTG-TEST-0257: Not Resetting Unused Permissions
            • MASTG-TEST-0318: References to SDK APIs Known to Handle Sensitive User Data
            • MASTG-TEST-0319: Runtime Use of SDK APIs Known to Handle Sensitive User Data
            • MASTG-TEST-0052: Testing Local Data Storage
            • MASTG-TEST-0053: Checking Logs for Sensitive Data
            • MASTG-TEST-0054: Determining Whether Sensitive Data Is Shared with Third Parties
            • MASTG-TEST-0055: Finding Sensitive Data in the Keyboard Cache
            • MASTG-TEST-0058: Testing Backups for Sensitive Data
            • MASTG-TEST-0060: Testing Memory for Sensitive Data
            • MASTG-TEST-0215: Sensitive Data Not Marked For Backup Exclusion
            • MASTG-TEST-0296: Sensitive Data Exposure in Logs
            • MASTG-TEST-0297: Sensitive Data Exposure Through Logging APIs
            • MASTG-TEST-0298: Runtime Monitoring of Files Eligible for Backup
            • MASTG-TEST-0299: Data Protection Classes for Files in Private Storage
            • MASTG-TEST-0300: References to APIs for Storing Unencrypted Data in Private Storage
            • MASTG-TEST-0301: Runtime Use of APIs for Storing Unencrypted Data in Private Storage
            • MASTG-TEST-0302: Sensitive Data Unencrypted in Private Storage Files
            • MASTG-TEST-0303: References to APIs for Storing Unencrypted Data in Shared Storage
            • MASTG-TEST-0313: References to APIs for Preventing Keyboard Caching of Text Fields
            • MASTG-TEST-0314: Runtime Monitoring of Text Fields Eligible for Keyboard Caching
            • MASTG-TEST-0388: References to Sensitive Data Stored Unprotected in Shared App Group Containers
            • MASTG-TEST-0061: Verifying the Configuration of Cryptographic Standard Algorithms
            • MASTG-TEST-0062: Testing Key Management
            • MASTG-TEST-0063: Testing Random Number Generation
            • MASTG-TEST-0209: Insufficient Key Sizes
            • MASTG-TEST-0210: Broken Symmetric Encryption Algorithms
            • MASTG-TEST-0211: Broken Hashing Algorithms
            • MASTG-TEST-0213: Use of Hardcoded Cryptographic Keys in Code
            • MASTG-TEST-0214: Hardcoded Cryptographic Keys in Files
            • MASTG-TEST-0311: Insecure Random API Usage
            • MASTG-TEST-0317: Broken Symmetric Encryption Modes
            • MASTG-TEST-0349: Runtime Use of Insecure Random APIs
            • MASTG-TEST-0064: Testing Biometric Authentication
            • MASTG-TEST-0266: References to APIs for Event-Bound Biometric Authentication
            • MASTG-TEST-0267: Runtime Use Of Event-Bound Biometric Authentication
            • MASTG-TEST-0268: References to APIs Allowing Fallback to Non-Biometric Authentication
            • MASTG-TEST-0269: Runtime Use Of APIs Allowing Fallback to Non-Biometric Authentication
            • MASTG-TEST-0270: References to APIs Detecting Biometric Enrollment Changes
            • MASTG-TEST-0271: Runtime Use Of APIs Detecting Biometric Enrollment Changes
            • MASTG-TEST-0065: Testing Data Encryption on the Network
            • MASTG-TEST-0066: Testing the TLS Settings
            • MASTG-TEST-0067: Testing Endpoint Identity Verification
            • MASTG-TEST-0068: Testing Custom Certificate Stores and Certificate Pinning
            • MASTG-TEST-0321: Hardcoded HTTP URLs
            • MASTG-TEST-0322: App Transport Security Configurations Allowing Cleartext Traffic
            • MASTG-TEST-0323: Uses of Low-Level Networking APIs for Cleartext Traffic
            • MASTG-TEST-0342: References to Weak ATS TLS Policy Exceptions in Info.plist
            • MASTG-TEST-0343: URLSession TLS Protocol Configuration
            • MASTG-TEST-0344: Network.framework TLS Protocol Configuration
            • MASTG-TEST-0345: Embedded or Third-party TLS Stack Configuration
            • MASTG-TEST-0348: Insecure TLS Protocols in Network Traffic
            • MASTG-TEST-0385: Missing Certificate Pinning in ATS
            • MASTG-TEST-0396: References to URLSessionDelegate Bypassing Certificate Validation
            • MASTG-TEST-0397: References to WKNavigationDelegate Bypassing Certificate Validation
            • MASTG-TEST-0056: Determining Whether Sensitive Data Is Exposed via IPC Mechanisms
            • MASTG-TEST-0057: Checking for Sensitive Data Disclosed Through the User Interface
            • MASTG-TEST-0059: Testing Auto-Generated Screenshots for Sensitive Information
            • MASTG-TEST-0069: Testing App Permissions
            • MASTG-TEST-0070: Testing Universal Links
            • MASTG-TEST-0071: Testing UIActivity Sharing
            • MASTG-TEST-0072: Testing App Extensions
            • MASTG-TEST-0073: Testing UIPasteboard
            • MASTG-TEST-0075: Testing Custom URL Schemes
            • MASTG-TEST-0076: Testing iOS WebViews
            • MASTG-TEST-0077: Testing WebView Protocol Handlers
            • MASTG-TEST-0078: Determining Whether Native Methods Are Exposed Through WebViews
            • MASTG-TEST-0276: Use of the iOS General Pasteboard
            • MASTG-TEST-0277: Sensitive Data in the iOS General Pasteboard at Runtime
            • MASTG-TEST-0278: Pasteboard Contents Not Cleared After Use
            • MASTG-TEST-0279: Pasteboard Contents Not Expiring
            • MASTG-TEST-0280: Pasteboard Contents Not Restricted to Local Device
            • MASTG-TEST-0290: Runtime Verification of Sensitive Content Exposure in Screenshots During App Backgrounding
            • MASTG-TEST-0331: Use of Deprecated WebView APIs
            • MASTG-TEST-0332: Attacker-Controlled URI in WebViews
            • MASTG-TEST-0333: Overly Broad File Read Access in WebViews
            • MASTG-TEST-0335: WebView File Origin Access Relaxed by Configuration
            • MASTG-TEST-0336: Runtime Setting of Relaxed WebView File Origin Policies
            • MASTG-TEST-0346: References to APIs Hiding Sensitive Data in Text Input Fields
            • MASTG-TEST-0347: Runtime Use of APIs Hiding Sensitive Data in Text Input Fields
            • MASTG-TEST-0370: Missing Input Validation in Custom URL Scheme Handlers
            • MASTG-TEST-0371: Missing Source Validation in Custom URL Scheme Handlers
            • MASTG-TEST-0376: References to Native Bridge APIs in WebViews
            • MASTG-TEST-0377: References to `evaluateJavaScript` Used as Bridge Reply in `WKScriptMessageHandler`
            • MASTG-TEST-0378: References to Password Fields in WebView-Loaded HTML
            • MASTG-TEST-0379: References to `evaluateJavaScript` Without Content World Isolation
            • MASTG-TEST-0380: References to `evaluateJavaScript` Writing Sensitive Data into WebView DOM
            • MASTG-TEST-0389: References to the App-Wide Restriction of Custom Keyboards
            • MASTG-TEST-0390: Full Access Requested by a Custom Keyboard Extension
            • MASTG-TEST-0395: Missing Input Validation in Universal Link Handlers
            • MASTG-TEST-0079: Testing Object Persistence
            • MASTG-TEST-0080: Testing Enforced Updating
            • MASTG-TEST-0085: Checking for Weaknesses in Third Party Libraries
            • MASTG-TEST-0086: Memory Corruption Bugs
            • MASTG-TEST-0087: Make Sure That Free Security Features Are Activated
            • MASTG-TEST-0228: Position Independent Code (PIC) not Enabled
            • MASTG-TEST-0229: Stack Canaries Not enabled
            • MASTG-TEST-0230: Automatic Reference Counting (ARC) not enabled
            • MASTG-TEST-0273: Identify Dependencies with Known Vulnerabilities by Scanning Dependency Managers Artifacts
            • MASTG-TEST-0275: Dependencies with Known Vulnerabilities in the App's SBOM
            • MASTG-TEST-0383: References to Enforced Updating APIs
            • MASTG-TEST-0384: Runtime Use of Enforced Updating APIs
            • MASTG-TEST-0386: References to Object Deserialization of Untrusted Data
            • MASTG-TEST-0081: Making Sure that the App Is Properly Signed
            • MASTG-TEST-0082: Testing whether the App is Debuggable
            • MASTG-TEST-0083: Testing for Debugging Symbols
            • MASTG-TEST-0084: Testing for Debugging Code and Verbose Error Logging
            • MASTG-TEST-0088: Testing Jailbreak Detection
            • MASTG-TEST-0089: Testing Anti-Debugging Detection
            • MASTG-TEST-0090: Testing File Integrity Checks
            • MASTG-TEST-0091: Testing Reverse Engineering Tools Detection
            • MASTG-TEST-0092: Testing Emulator Detection
            • MASTG-TEST-0093: Testing Obfuscation
            • MASTG-TEST-0219: Testing for Debugging Symbols
            • MASTG-TEST-0220: Usage of Outdated Code Signature Format
            • MASTG-TEST-0240: Jailbreak Detection in Code
            • MASTG-TEST-0241: Runtime Use of Jailbreak Detection Techniques
            • MASTG-TEST-0246: Runtime Use of Secure Screen Lock Detection APIs
            • MASTG-TEST-0248: References to APIs for Detecting Secure Screen Lock
            • MASTG-TEST-0261: Debuggable Entitlement Enabled in the entitlements.plist
            • MASTG-TEST-0354: Runtime Use of Hook Detection Techniques
            • MASTG-TEST-0358: Implementation Details Exposure Through Logging APIs
            • MASTG-TEST-0359: Implementation Details Exposure in Logs
            • MASTG-TEST-0367: Runtime Use of Virtual Device Detection Techniques
            • MASTG-TEST-0387: References to Storage Integrity Check APIs
            • MASTG-TEST-0391: Insufficient Obfuscation of Security-Relevant Native Code
            • MASTG-TEST-0401: References to Debugging Detection APIs
            • MASTG-TEST-0402: Runtime Use of Debugging Detection APIs
            • MASTG-TEST-0281: Undeclared Known Tracking Domains
            • MASTG-TEST-0360: Purpose String Accuracy for Reachable Protected Resource Access
            • MASTG-TEST-0361: Runtime Use of Protected Resource APIs Without Accurate Purpose Strings
            • MASTG-TEST-0362: Entitlements for Unjustified Capability Exposure
            • MASTG-TEST-0363: Runtime Use of Entitlement-Backed APIs for Unjustified Capability Exposure
      • Demos
            • MASTG-DEMO-0001: File System Snapshots from External Storage
            • MASTG-DEMO-0002: External Storage APIs Tracing with Frida
            • MASTG-DEMO-0003: App Writing to External Storage without Scoped Storage Restrictions
            • MASTG-DEMO-0004: App Writing to External Storage with Scoped Storage Restrictions
            • MASTG-DEMO-0005: App Writing to External Storage via the MediaStore API
            • MASTG-DEMO-0006: Tracing Common Logging APIs Looking for Secrets
            • MASTG-DEMO-0010: File System Snapshots from Internal Storage
            • MASTG-DEMO-0020: Data Exclusion using backup_rules.xml with Backup Manager
            • MASTG-DEMO-0034: Backup and Restore App Data with semgrep
            • MASTG-DEMO-0035: Data Exclusion using backup_rules.xml with adb backup
            • MASTG-DEMO-0059: Using SharedPreferences to Write Sensitive Data Unencrypted to the App Sandbox
            • MASTG-DEMO-0060: App Writing Sensitive Data to Sandbox using EncryptedSharedPreferences
            • MASTG-DEMO-0064: Uses of Caching UI Elements with semgrep
            • MASTG-DEMO-0068: Sensitive Data in Unencrypted SQLite
            • MASTG-DEMO-0069: Sensitive Data Stored Unencrypted via DataStore
            • MASTG-DEMO-0070: Sensitive Data Stored Unencrypted via Room Database
            • MASTG-DEMO-0007: Common Uses of Insecure Random APIs
            • MASTG-DEMO-0008: Uses of Non-random Sources
            • MASTG-DEMO-0012: Cryptographic Key Generation With Insufficient Key Length
            • MASTG-DEMO-0017: Use of Hardcoded AES Key in SecretKeySpec with semgrep
            • MASTG-DEMO-0022: Uses of Broken Symmetric Encryption Algorithms in Cipher with semgrep
            • MASTG-DEMO-0023: Uses of Broken Encryption Modes in Cipher with semgrep
            • MASTG-DEMO-0058: Using KeyGenParameterSpec with a Broken ECB Block Mode
            • MASTG-DEMO-0071: References to Asymmetric Key Pairs Used For Multiple Purposes with Semgrep
            • MASTG-DEMO-0072: Runtime Use of Asymmetric Key Pairs Used For Multiple Purposes With Frida
            • MASTG-DEMO-0075: Uses of Explicit Security Providers in Cryptographic APIs with semgrep
            • MASTG-DEMO-0089: Uses of BiometricPrompt with Device Credential Fallback with semgrep
            • MASTG-DEMO-0090: Uses of BiometricPrompt with Event-Bound Authentication with semgrep
            • MASTG-DEMO-0091: Uses of setInvalidatedByBiometricEnrollment with semgrep
            • MASTG-DEMO-0092: Uses of BiometricPrompt without Explicit User Confirmation with semgrep
            • MASTG-DEMO-0093: Uses of Extended Validity Duration in setUserAuthenticationParameters with semgrep
            • MASTG-DEMO-0048: SSLSocket Connection to Wrong Host Server Allowed by Lack of HostnameVerifier
            • MASTG-DEMO-0049: SSLSocket Connection to Wrong Host Server Blocked by HostnameVerifier
            • MASTG-DEMO-0054: Use of a TrustManager that Does Not Validate Certificate Chains
            • MASTG-DEMO-0055: Use of the HostnameVerifier that Allows Any Hostname
            • MASTG-DEMO-0056: WebView Ignoring TLS Errors in onReceivedSslError
            • MASTG-DEMO-0057: Network Security Configuration Allows User-Added Certificates
            • MASTG-DEMO-0029: Uses of WebViews Allowing Content Access with semgrep
            • MASTG-DEMO-0030: Uses of WebViews Allowing Content Access with Frida
            • MASTG-DEMO-0031: Uses of WebViews Allowing Local File Access with Frida
            • MASTG-DEMO-0032: Uses of WebViews Allowing Local File Access with semgrep
            • MASTG-DEMO-0040: Debuggable Flag Enabled in the AndroidManifest with semgrep
            • MASTG-DEMO-0061: Uses of FLAG_SECURE with semgrep
            • MASTG-DEMO-0062: Enabling Screenshots in Recents via setRecentsScreenshotEnabled with semgrep
            • MASTG-DEMO-0063: Incorrectly Preventing Screenshots with SecureFlagPolicy in Compose Dialogs with semgrep
            • MASTG-DEMO-0078: App Leaking Sensitive Data via Notifications
            • MASTG-DEMO-0079: App Exposing Access and Verification Codes in Text Input Fields
            • MASTG-DEMO-0082: WebView WebStorage Cleanup
            • MASTG-DEMO-0097: Sensitive Data and Functionality Exposed Through WebView JavaScript Bridges
            • MASTG-DEMO-0103: Missing Overlay Protection on a Sensitive View
            • MASTG-DEMO-0104: App Requesting SYSTEM_ALERT_WINDOW Permission
            • MASTG-DEMO-0105: Activity-Level Overlay Protection Using setHideOverlayWindows
            • MASTG-DEMO-0120: Uses of Unauthorized Access to Exported Content Providers
            • MASTG-DEMO-0121: Unauthorized Access to Database Records through Exported Content Provider
            • MASTG-DEMO-0122: Oversharing via FileProvider with Unrestricted Path Configuration
            • MASTG-DEMO-0123: Exfiltration of Private Files via FileProvider URI Grant Oversharing
            • MASTG-DEMO-0128: Sensitive Data Exposed Through an Unprotected Activity
            • MASTG-DEMO-0129: Sensitive Action Exposed Through an Unprotected Service
            • MASTG-DEMO-0130: Sensitive Action Exposed Through an Unprotected Manifest-Declared Broadcast Receiver
            • MASTG-DEMO-0147: Uses of Insecure PendingIntent
            • MASTG-DEMO-0151: Deep Link Intent Filter Missing android:autoVerify with semgrep
            • MASTG-DEMO-0152: Custom URL Scheme Handler Without Input Validation with semgrep
            • MASTG-DEMO-0025: Uses of Build.VERSION.SDK_INT with semgrep
            • MASTG-DEMO-0050: Identifying Insecure Dependencies in Android Studio
            • MASTG-DEMO-0051: Identifying Insecure Dependencies through SBOM Creation
            • MASTG-DEMO-0100: Object Deserialization Using Serializable with semgrep
            • MASTG-DEMO-0102: SQL Injection via URI Path and Selection in Android Content Providers
            • MASTG-DEMO-0136: Internal Activity Communication via Implicit Intent
            • MASTG-DEMO-0138: Leaking Sensitive Information via Implicit Intents
            • MASTG-DEMO-0139: Path Traversal via Malicious ContentProvider Filename
            • MASTG-DEMO-0140: Attacker App Registering for Internal Implicit Intent
            • MASTG-DEMO-0141: Attacker App Returning Malicious ContentProvider Filename
            • MASTG-DEMO-0156: SafeBrowsing Disabled Detection with semgrep
            • MASTG-DEMO-0157: Uses of WebViewClient URL Loading Handlers with semgrep
            • MASTG-DEMO-0158: Runtime Use of WebViewClient URL Loading Handlers with Frida
            • MASTG-DEMO-0027: Runtime Use of KeyguardManager.isDeviceSecure and BiometricManager.canAuthenticate APIs with Frida
            • MASTG-DEMO-0028: Uses of KeyguardManager.isDeviceSecure and BiometricManager.canAuthenticate with semgrep
            • MASTG-DEMO-0037: App Leaking Information about Unclosed SQL Cursor via StrictMode
            • MASTG-DEMO-0038: Detecting StrictMode Uses with Frida
            • MASTG-DEMO-0039: Detecting StrictMode PenaltyLog Usage with Semgrep
            • MASTG-DEMO-0087: Uses of Root Detection Techniques with Semgrep
            • MASTG-DEMO-0088: Runtime Detection of Root Detection Mechanisms
            • MASTG-DEMO-0101: References to Storage Integrity Check APIs with semgrep
            • MASTG-DEMO-0106: Extracting Sensitive Data from Cipher.doFinal via Frida Hooking
            • MASTG-DEMO-0107: Detecting Frida hooks and terminating the application on response
            • MASTG-DEMO-0108: Bypassing Frida Detection in /proc/self/maps to Extract Sensitive Data
            • MASTG-DEMO-0114: Detecting Emulator Detection Checks with Frida
            • MASTG-DEMO-0115: JDWP Debugging Checks in App Code
            • MASTG-DEMO-0116: Native Anti-Debugging Checks with TracerPid and ptrace
            • MASTG-DEMO-0132: Root Detection Logic in Java/Kotlin Layer Only Protected by Identifier Renaming
            • MASTG-DEMO-0133: Root Detection Logic in Native Layer with Insufficient Obfuscation
            • MASTG-DEMO-0009: Detecting Undeclared PII in Network Traffic
            • MASTG-DEMO-0033: Dangerous Permissions in the AndroidManifest with semgrep
            • MASTG-DEMO-0081: Sensitive User Data Sent to Firebase Analytics with Frida
            • MASTG-DEMO-0019: Uses of isExcludedFromBackupKey with r2
            • MASTG-DEMO-0065: Uses of Logging APIs with r2
            • MASTG-DEMO-0066: Sensitive Data Logging with idevicesyslog
            • MASTG-DEMO-0067: Runtime Tracking of Files Eligible for Backup with Frida
            • MASTG-DEMO-0076: Keyboard Caching Not Prevented for Sensitive Data with r2
            • MASTG-DEMO-0077: Runtime Monitoring of Text Fields Eligible for Keyboard Caching with Frida
            • MASTG-DEMO-0011: Uses of Insufficient Key Size in SecKeyCreateRandomKey with r2
            • MASTG-DEMO-0013: Use of Hardcoded RSA Private Key in SecKeyCreateWithData with r2
            • MASTG-DEMO-0014: Use of Hardcoded ECDSA Private Key in CryptoKit with r2
            • MASTG-DEMO-0015: Uses of Broken Hashing Algorithms in CommonCrypto with r2
            • MASTG-DEMO-0016: Uses of Broken Hashing Algorithms in CryptoKit with r2
            • MASTG-DEMO-0018: Uses of Broken Encryption Algorithms in CommonCrypto with r2
            • MASTG-DEMO-0073: Uses of Insecure Random Number Generation with r2
            • MASTG-DEMO-0074: Uses of Insecure Random Number Generation with frida-trace
            • MASTG-DEMO-0080: Uses of Broken Encryption Modes in CommonCrypto with r2
            • MASTG-DEMO-0041: Uses of LAContext.evaluatePolicy with r2
            • MASTG-DEMO-0042: Runtime Use of LAContext.evaluatePolicy with Frida
            • MASTG-DEMO-0043: Uses of kSecAccessControlUserPresence with r2
            • MASTG-DEMO-0044: Runtime Use of kSecAccessControlUserPresence with Frida
            • MASTG-DEMO-0045: Uses of kSecAccessControlBiometryCurrentSet with r2
            • MASTG-DEMO-0046: Runtime Use of kSecAccessControlBiometryCurrentSet with Frida
            • MASTG-DEMO-0047: Runtime Use of the Keychain Not Requiring User Presence with Frida
            • MASTG-DEMO-0083: Insecure ATS Configuration Allowing Cleartext Traffic
            • MASTG-DEMO-0084: Hardcoded HTTP URLs in iOS Binary
            • MASTG-DEMO-0085: Uses of Network Framework Bypassing ATS
            • MASTG-DEMO-0086: Uses of BSD Sockets Bypassing ATS
            • MASTG-DEMO-0109: ATS TLS Policy Exceptions in Info.plist
            • MASTG-DEMO-0110: URLSession Minimum TLS Version Lowered in Code
            • MASTG-DEMO-0111: Network.framework TLS Minimum Version Lowered via sec_protocol_options
            • MASTG-DEMO-0148: Missing Certificate Pinning in ATS
            • MASTG-DEMO-0154: URLSessionDelegate Accepting Any Server Certificate
            • MASTG-DEMO-0155: WKNavigationDelegate Accepting Any Server Certificate
            • MASTG-DEMO-0094: Use of the Deprecated UIWebView
            • MASTG-DEMO-0095: Attacker-Controlled Input in a WebView Leading to Unintended Navigation
            • MASTG-DEMO-0096: HTML Injection in a Local WebView Leading to Local File Access
            • MASTG-DEMO-0098: References to File Access in WebViews with radare2
            • MASTG-DEMO-0099: Runtime Monitoring of WebView File Access with Frida
            • MASTG-DEMO-0112: Text Input Fields Not Hiding Sensitive Data
            • MASTG-DEMO-0113: Runtime Monitoring of Text Input Fields Not Hiding Sensitive Data
            • MASTG-DEMO-0134: Custom URL Scheme Handler Without Input Validation
            • MASTG-DEMO-0135: Custom URL Scheme Handler with Source Validation
            • MASTG-DEMO-0142: Sensitive Data and Functionality Exposed Through a WKWebView Native Bridge
            • MASTG-DEMO-0143: Sensitive Data Returned to Page JavaScript via evaluateJavaScript in a WKScriptMessageHandler
            • MASTG-DEMO-0144: Password Field Rendered in WebView DOM Without Native Overlay
            • MASTG-DEMO-0145: DOM Inspection Using evaluateJavaScript Without Content World Isolation
            • MASTG-DEMO-0146: Sensitive Data Written into WebView DOM via evaluateJavaScript
            • MASTG-DEMO-0153: Universal Link Handler Without Input Validation
            • MASTG-DEMO-0052: Scanning Package Manager Artifacts for Insecure iOS Dependencies
            • MASTG-DEMO-0053: Identifying Insecure Dependencies in SwiftPM through SBOM creation
            • MASTG-DEMO-0149: References to Object Deserialization of a URL Scheme Payload with r2
            • MASTG-DEMO-0021: Uses of Jailbreak Detection Techniques with r2
            • MASTG-DEMO-0024: Uses of LAContext.canEvaluatePolicy with r2
            • MASTG-DEMO-0026: Runtime Use of LAContext.canEvaluatePolicy with Frida
            • MASTG-DEMO-0036: Debuggable Entitlement Enabled in the entitlements.plist with rabin2
            • MASTG-DEMO-0117: Extracting Sensitive Data from CCCrypt via Frida Hooking
            • MASTG-DEMO-0118: Detecting Frida Hooks Before Sensitive Cryptographic Operations
            • MASTG-DEMO-0119: Bypassing Frida D-Bus Port Detection to Extract Sensitive Data
            • MASTG-DEMO-0124: Logging APIs Exposing Implementation Details with r2
            • MASTG-DEMO-0125: Implementation Details Exposed in App Logs
            • MASTG-DEMO-0131: Detecting Virtual Device Detection Checks with Frida
            • MASTG-DEMO-0150: References to Storage Integrity Check APIs with radare2
      • Techniques
          • MASTG-TECH-0047: Reverse Engineering
          • MASTG-TECH-0048: Static Analysis
          • MASTG-TECH-0049: Dynamic Analysis
          • MASTG-TECH-0050: Binary Analysis
          • MASTG-TECH-0051: Tampering and Runtime Instrumentation
          • MASTG-TECH-0071: Retrieving Strings
          • MASTG-TECH-0119: Intercepting HTTP Traffic by Hooking Network APIs at the Application Layer
          • MASTG-TECH-0120: Intercepting HTTP Traffic Using an Interception Proxy
          • MASTG-TECH-0121: Intercepting Non-HTTP Traffic Using an Interception Proxy
          • MASTG-TECH-0122: Passive Eavesdropping
          • MASTG-TECH-0123: Achieving a MITM Position via ARP Spoofing
          • MASTG-TECH-0124: Achieving a MITM Position Using a Rogue Access Point
          • MASTG-TECH-0125: Intercepting Xamarin Traffic
          • MASTG-TECH-0001: Accessing the Device Shell
          • MASTG-TECH-0002: Host-Device Data Transfer
          • MASTG-TECH-0003: Obtaining and Extracting Apps
          • MASTG-TECH-0004: Repackaging Apps
          • MASTG-TECH-0005: Installing Apps
          • MASTG-TECH-0006: Listing Installed Apps
          • MASTG-TECH-0007: Exploring the App Package
          • MASTG-TECH-0008: Accessing App Data Directories
          • MASTG-TECH-0009: Monitoring System Logs
          • MASTG-TECH-0010: Basic Network Monitoring/Sniffing
          • MASTG-TECH-0011: Setting Up an Interception Proxy
          • MASTG-TECH-0012: Bypassing Certificate Pinning
          • MASTG-TECH-0013: Reverse Engineering Android Apps
          • MASTG-TECH-0014: Static Analysis on Android
          • MASTG-TECH-0015: Dynamic Analysis on Android
          • MASTG-TECH-0016: Disassembling Code to Smali
          • MASTG-TECH-0017: Decompiling Java Code
          • MASTG-TECH-0018: Disassembling Native Code
          • MASTG-TECH-0019: Retrieving Strings
          • MASTG-TECH-0020: Retrieving Cross References
          • MASTG-TECH-0021: Information Gathering - API Usage
          • MASTG-TECH-0022: Information Gathering - Network Communication
          • MASTG-TECH-0023: Reviewing Decompiled Java Code
          • MASTG-TECH-0024: Reviewing Disassembled Native Code
          • MASTG-TECH-0025: Automated Static Analysis
          • MASTG-TECH-0026: Dynamic Analysis on Non-Rooted Devices
          • MASTG-TECH-0027: Get Open Files
          • MASTG-TECH-0028: Get Open Connections
          • MASTG-TECH-0029: Listing Loaded Native Libraries
          • MASTG-TECH-0030: Sandbox Inspection
          • MASTG-TECH-0031: Debugging
          • MASTG-TECH-0032: Execution Tracing
          • MASTG-TECH-0033: Method Tracing
          • MASTG-TECH-0034: Native Code Tracing
          • MASTG-TECH-0035: JNI Tracing
          • MASTG-TECH-0036: Emulation-based Analysis
          • MASTG-TECH-0037: Symbolic Execution
          • MASTG-TECH-0038: Patching
          • MASTG-TECH-0039: Repackaging & Re-Signing
          • MASTG-TECH-0040: Waiting for the Debugger
          • MASTG-TECH-0041: Library Injection
          • MASTG-TECH-0042: Getting Loaded Classes and Methods Dynamically
          • MASTG-TECH-0043: Method Hooking
          • MASTG-TECH-0044: Process Exploration
          • MASTG-TECH-0045: Runtime Reverse Engineering
          • MASTG-TECH-0100: Logging Sensitive Data from Network Traffic
          • MASTG-TECH-0108: Taint Analysis
          • MASTG-TECH-0109: Intercepting Flutter HTTPS Traffic
          • MASTG-TECH-0115: Obtaining Compiler-Provided Security Features
          • MASTG-TECH-0116: Obtaining Information about the APK Signature
          • MASTG-TECH-0117: Obtaining Information from the AndroidManifest
          • MASTG-TECH-0126: Obtaining App Permissions
          • MASTG-TECH-0127: Inspecting an App's Backup Data
          • MASTG-TECH-0128: Performing a Backup and Restore of App Data
          • MASTG-TECH-0129: Verifying Android Dependencies at Runtime
          • MASTG-TECH-0130: Software Composition Analysis (SCA) of Android Dependencies by Creating a SBOM
          • MASTG-TECH-0131: Software Composition Analysis (SCA) of Android Dependencies at Build Time
          • MASTG-TECH-0140: Obtaining Debugging Information and Symbols
          • MASTG-TECH-0141: Inspecting the Merged AndroidManifest
          • MASTG-TECH-0142: Inspecting WebView Storage
          • MASTG-TECH-0143: Monitor File System Operations in WebViews
          • MASTG-TECH-0144: Bypassing Root Detection
          • MASTG-TECH-0145: Working with XAPK Files
          • MASTG-TECH-0148: Interacting with Android ContentProviders
          • MASTG-TECH-0150: Analyzing the AndroidManifest
          • MASTG-TECH-0151: Analyzing the Network Security Configuration
          • MASTG-TECH-0156: Reverse Engineering Flutter Applications
          • MASTG-TECH-0157: Extracting Bundled Native Libraries
          • MASTG-TECH-0159: Verify Usage of File-Based Content Providers
          • MASTG-TECH-0160: Enumerating Activities
          • MASTG-TECH-0161: Enumerating Services
          • MASTG-TECH-0162: Enumerating Broadcast Receivers
          • MASTG-TECH-0163: Enumerating Content Providers
          • MASTG-TECH-0164: Sniffing Implicit Intents and Broadcasts
          • MASTG-TECH-0165: Identifying Compilers, Obfuscators, and Packers in Android Apps
          • MASTG-TECH-0172: Listing Deep Links
          • MASTG-TECH-0173: Monitoring Deep Link Handlers at Runtime with Frida
          • MASTG-TECH-0174: Verifying App Link Website Association
          • MASTG-TECH-0052: Accessing the Device Shell
          • MASTG-TECH-0053: Host-Device Data Transfer
          • MASTG-TECH-0054: Obtaining and Extracting Apps
          • MASTG-TECH-0055: Launching a Repackaged App in Debug Mode
          • MASTG-TECH-0056: Installing Apps
          • MASTG-TECH-0057: Listing Installed Apps
          • MASTG-TECH-0058: Exploring the App Package
          • MASTG-TECH-0059: Accessing App Data Directories
          • MASTG-TECH-0060: Monitoring System Logs
          • MASTG-TECH-0061: Dumping KeyChain Data
          • MASTG-TECH-0062: Basic Network Monitoring/Sniffing
          • MASTG-TECH-0063: Setting up an Interception Proxy
          • MASTG-TECH-0064: Bypassing Certificate Pinning
          • MASTG-TECH-0065: Reverse Engineering iOS Apps
          • MASTG-TECH-0066: Static Analysis on iOS
          • MASTG-TECH-0067: Dynamic Analysis on iOS
          • MASTG-TECH-0068: Disassembling Native Code
          • MASTG-TECH-0069: Decompiling Native Code
          • MASTG-TECH-0070: Extracting Information from the Application Binary
          • MASTG-TECH-0072: Retrieving Cross References
          • MASTG-TECH-0073: Information Gathering - API Usage
          • MASTG-TECH-0074: Information Gathering - Network Communication
          • MASTG-TECH-0075: Reviewing Decompiled Objective-C and Swift Code
          • MASTG-TECH-0076: Reviewing Disassembled Objective-C and Swift Code
          • MASTG-TECH-0077: Reviewing Disassembled Native Code
          • MASTG-TECH-0078: Automated Static Analysis
          • MASTG-TECH-0079: Obtaining a Developer Provisioning Profile
          • MASTG-TECH-0080: Get Open Files
          • MASTG-TECH-0081: Get Open Connections
          • MASTG-TECH-0082: Extracting Bundled Libraries
          • MASTG-TECH-0083: TBD
          • MASTG-TECH-0084: Debugging
          • MASTG-TECH-0085: Execution Tracing
          • MASTG-TECH-0086: Method Tracing
          • MASTG-TECH-0087: Native Code Tracing
          • MASTG-TECH-0088: Emulation-based Analysis
          • MASTG-TECH-0089: Symbolic Execution
          • MASTG-TECH-0090: Injecting Frida Gadget into an IPA Automatically
          • MASTG-TECH-0091: Injecting Libraries into an IPA Manually
          • MASTG-TECH-0092: Signing IPA files
          • MASTG-TECH-0093: Waiting for the debugger
          • MASTG-TECH-0094: Getting Loaded Classes and Methods dynamically
          • MASTG-TECH-0095: Method Hooking
          • MASTG-TECH-0096: Process Exploration
          • MASTG-TECH-0097: Runtime Reverse Engineering
          • MASTG-TECH-0098: Patching React Native Apps
          • MASTG-TECH-0110: Intercepting Flutter HTTPS Traffic
          • MASTG-TECH-0111: Extracting Entitlements from MachO Binaries
          • MASTG-TECH-0112: Obtaining the Code Signature Format Version
          • MASTG-TECH-0113: Obtaining Debugging Symbols
          • MASTG-TECH-0114: Demangling Symbols
          • MASTG-TECH-0118: Obtaining Compiler-Provided Security Features
          • MASTG-TECH-0132: Software Composition Analysis (SCA) of iOS Dependencies by Creating a SBOM
          • MASTG-TECH-0133: Software Composition Analysis (SCA) of iOS Dependencies by Scanning Package Manager Artifacts
          • MASTG-TECH-0134: Monitoring the Pasteboard
          • MASTG-TECH-0135: Bypassing Biometric Authentication
          • MASTG-TECH-0136: Retrieving PrivacyInfo.xcprivacy Files
          • MASTG-TECH-0137: Analyzing PrivacyInfo.xcprivacy Files
          • MASTG-TECH-0138: Convert Plist Files to JSON
          • MASTG-TECH-0139: Attach to WKWebView
          • MASTG-TECH-0146: Dynamic Analysis on Non-Jailbroken Devices
          • MASTG-TECH-0147: Patching
          • MASTG-TECH-0149: Validating ATS TLS Settings at Runtime Using nscurl
          • MASTG-TECH-0152: Bypassing Jailbreak Detection
          • MASTG-TECH-0153: Retrieving Info.plist Files
          • MASTG-TECH-0154: Analyzing Info.plist Files
          • MASTG-TECH-0155: Analyzing the ATS Configuration
          • MASTG-TECH-0158: Extracting Loaded Libraries
          • MASTG-TECH-0166: Identifying Custom URL Scheme Registrations in iOS Apps
          • MASTG-TECH-0167: Monitoring UIActivity Data Sharing
          • MASTG-TECH-0168: Monitoring UIActivity Data Receiving
          • MASTG-TECH-0169: Opening Deep Links
          • MASTG-TECH-0170: Enumerating App Extensions
          • MASTG-TECH-0171: Monitoring Data Sharing Between App Extensions and Containing Apps
          • MASTG-TECH-0175: Verifying Universal Link Domain Association
          • MASTG-TECH-0176: Monitoring Universal Link Handlers at Runtime with Frida
      • Tools
          • MASTG-TOOL-0031: Frida
          • MASTG-TOOL-0032: Frida CodeShare
          • MASTG-TOOL-0033: Ghidra
          • MASTG-TOOL-0034: LIEF
          • MASTG-TOOL-0035: MobSF
          • MASTG-TOOL-0036: r2frida
          • MASTG-TOOL-0037: RMS Runtime Mobile Security
          • MASTG-TOOL-0038: objection
          • MASTG-TOOL-0098: iaito
          • MASTG-TOOL-0100: reFlutter
          • MASTG-TOOL-0101: disable-flutter-tls-verification
          • MASTG-TOOL-0104: hermes-dec
          • MASTG-TOOL-0106: Fridump
          • MASTG-TOOL-0108: Corellium
          • MASTG-TOOL-0110: semgrep
          • MASTG-TOOL-0129: rabin2
          • MASTG-TOOL-0131: dependency-check
          • MASTG-TOOL-0132: dependency-track
          • MASTG-TOOL-0133: Visual Studio Code (vscode)
          • MASTG-TOOL-0134: cdxgen
          • MASTG-TOOL-0144: gitleaks
          • MASTG-TOOL-0145: Frooky
          • MASTG-TOOL-0001: Frida (Android)
          • MASTG-TOOL-0002: MobSF (Android)
          • MASTG-TOOL-0003: nm (Android)
          • MASTG-TOOL-0004: adb
          • MASTG-TOOL-0005: Android NDK
          • MASTG-TOOL-0006: Android SDK
          • MASTG-TOOL-0007: Android Studio
          • MASTG-TOOL-0008: Android-SSL-TrustKiller
          • MASTG-TOOL-0009: APKiD
          • MASTG-TOOL-0010: APKLab
          • MASTG-TOOL-0011: Apktool
          • MASTG-TOOL-0012: apkx
          • MASTG-TOOL-0013: Busybox
          • MASTG-TOOL-0014: Bytecode Viewer
          • MASTG-TOOL-0015: drozer
          • MASTG-TOOL-0016: gplaycli
          • MASTG-TOOL-0017: House
          • MASTG-TOOL-0018: jadx
          • MASTG-TOOL-0019: jdb
          • MASTG-TOOL-0020: JustTrustMe
          • MASTG-TOOL-0021: Magisk
          • MASTG-TOOL-0022: ProGuard
          • MASTG-TOOL-0023: RootCloak Plus
          • MASTG-TOOL-0024: Scrcpy
          • MASTG-TOOL-0025: SSLUnpinning
          • MASTG-TOOL-0026: Termux
          • MASTG-TOOL-0027: Xposed
          • MASTG-TOOL-0028: radare2 for Android
          • MASTG-TOOL-0029: objection (Android)
          • MASTG-TOOL-0030: Angr
          • MASTG-TOOL-0099: FlowDroid
          • MASTG-TOOL-0103: uber-apk-signer
          • MASTG-TOOL-0107: jnitrace
          • MASTG-TOOL-0112: pidcat
          • MASTG-TOOL-0116: blutter
          • MASTG-TOOL-0120: ProxyDroid
          • MASTG-TOOL-0123: apksigner
          • MASTG-TOOL-0124: aapt2
          • MASTG-TOOL-0125: Apkleaks
          • MASTG-TOOL-0130: blint
          • MASTG-TOOL-0140: frida-multiple-unpinning
          • MASTG-TOOL-0146: RootBeer
          • MASTG-TOOL-0147: Android RASP
          • MASTG-TOOL-0148: apkeep
          • MASTG-TOOL-0149: LSPosed
          • MASTG-TOOL-0151: debugmepLS
          • MASTG-TOOL-0152: lldb (Android)
          • MASTG-TOOL-0153: dProtect
          • MASTG-TOOL-0039: Frida (iOS)
          • MASTG-TOOL-0040: MobSF (iOS)
          • MASTG-TOOL-0041: nm (iOS)
          • MASTG-TOOL-0042: BinaryCookieReader
          • MASTG-TOOL-0043: class-dump
          • MASTG-TOOL-0044: class-dump-z
          • MASTG-TOOL-0045: class-dump-dyld
          • MASTG-TOOL-0046: Cycript
          • MASTG-TOOL-0047: Cydia
          • MASTG-TOOL-0048: dsdump
          • MASTG-TOOL-0049: Frida-cycript
          • MASTG-TOOL-0050: Frida-ios-dump
          • MASTG-TOOL-0051: gdb
          • MASTG-TOOL-0053: iOSbackup
          • MASTG-TOOL-0054: ios-deploy
          • MASTG-TOOL-0055: iproxy
          • MASTG-TOOL-0056: Keychain-Dumper
          • MASTG-TOOL-0057: lldb (iOS)
          • MASTG-TOOL-0058: MachoOView
          • MASTG-TOOL-0059: optool
          • MASTG-TOOL-0060: otool
          • MASTG-TOOL-0061: Grapefruit
          • MASTG-TOOL-0062: Plutil
          • MASTG-TOOL-0063: security
          • MASTG-TOOL-0064: Sileo
          • MASTG-TOOL-0065: simctl
          • MASTG-TOOL-0066: SSL Kill Switch 3
          • MASTG-TOOL-0067: swift-demangle
          • MASTG-TOOL-0068: SwiftShield
          • MASTG-TOOL-0069: Usbmuxd
          • MASTG-TOOL-0070: Xcode
          • MASTG-TOOL-0071: Xcode Command Line Tools
          • MASTG-TOOL-0072: xcrun
          • MASTG-TOOL-0073: radare2 (iOS)
          • MASTG-TOOL-0074: objection (iOS)
          • MASTG-TOOL-0102: ios-app-signer
          • MASTG-TOOL-0105: ipsw
          • MASTG-TOOL-0111: ldid
          • MASTG-TOOL-0114: codesign
          • MASTG-TOOL-0117: fastlane
          • MASTG-TOOL-0118: Sideloadly
          • MASTG-TOOL-0121: objdump (iOS)
          • MASTG-TOOL-0122: c++filt
          • MASTG-TOOL-0126: libimobiledevice suite
          • MASTG-TOOL-0127: AppSync Unified
          • MASTG-TOOL-0128: Filza
          • MASTG-TOOL-0135: PlistBuddy
          • MASTG-TOOL-0136: plistlib
          • MASTG-TOOL-0137: GlobalWebInspect
          • MASTG-TOOL-0138: ipainstaller
          • MASTG-TOOL-0139: ElleKit
          • MASTG-TOOL-0141: IOSSecuritySuite
          • MASTG-TOOL-0142: Choicy
          • MASTG-TOOL-0150: xpcspy
          • MASTG-TOOL-0075: tcpdump (Android)
          • MASTG-TOOL-0076: bettercap
          • MASTG-TOOL-0077: Burp Suite
          • MASTG-TOOL-0078: MITM Relay
          • MASTG-TOOL-0079: ZAP (Zed Attack Proxy)
          • MASTG-TOOL-0080: tcpdump
          • MASTG-TOOL-0081: Wireshark
          • MASTG-TOOL-0097: mitmproxy
          • MASTG-TOOL-0109: Nope-Proxy
          • MASTG-TOOL-0115: HTTP Toolkit
          • MASTG-TOOL-0143: badssl
      • Apps
          • MASTG-APP-0001: AndroGoat
          • MASTG-APP-0002: Android License Validator
          • MASTG-APP-0003: Android UnCrackable L1
          • MASTG-APP-0004: Android UnCrackable L2
          • MASTG-APP-0005: Android UnCrackable L3
          • MASTG-APP-0006: Digitalbank
          • MASTG-APP-0007: DIVA Android
          • MASTG-APP-0008: DodoVulnerableBank
          • MASTG-APP-0009: DVHMA
          • MASTG-APP-0010: InsecureBankv2
          • MASTG-APP-0011: MASTG Hacking Playground (Java)
          • MASTG-APP-0012: MASTG Hacking Playground (Kotlin)
          • MASTG-APP-0013: OVAA
          • MASTG-APP-0014: InsecureShop
          • MASTG-APP-0015: Android UnCrackable L4
          • MASTG-APP-0016: Finstergram
          • MASTG-APP-0017: Disable-flutter-tls-verification
          • MASTG-APP-0018: MASTestApp-Android-NETWORK
          • MASTG-APP-0029: BugBazaar
          • MASTG-APP-0031: VulnForum
          • MASTG-APP-0032: RootBeer Sample
          • MASTG-APP-0033: Android RASP Sample
          • MASTG-APP-0023: DVIA
          • MASTG-APP-0024: DVIA-v2
          • MASTG-APP-0025: iOS UnCrackable L1
          • MASTG-APP-0026: iOS UnCrackable L2
          • MASTG-APP-0027: Disable-flutter-tls-verification
          • MASTG-APP-0028: iGoat-Swift
          • MASTG-APP-0030: iBugBazaar
    • MAS Checklist
      • MASVS-STORAGE
      • MASVS-CRYPTO
      • MASVS-AUTH
      • MASVS-NETWORK
      • MASVS-PLATFORM
      • MASVS-CODE
      • MASVS-RESILIENCE
      • MASVS-PRIVACY
    • MAS Crackmes
      • Android Crackmes
      • iOS Crackmes
    • News
        • 2026
        • 2025
        • 2024
        • 2023
        • 2022
        • 2021
        • 2020
        • 2019
        • 2018
        • 2017
        • 2016
    • 🎙 Talks
    • ⭐ Contribute
      • How Can You Contribute?
      • Getting Started
      • Pull Requests & Reviews
      • Add a New Language
      • Style Guide
      • Add a Crackme
      • How to Run the OWASP MAS Website Locally
      • Writing Content
        • Style and Formatting for MASTG Markdown Files
        • Writing MASTG App Files
        • Writing MASTG Best Practices Files
        • Writing MASTG Demo Files
        • Writing Frida scripts for MASTG demos
        • Writing MASTG Frooky Hook Configurations
        • Writing MASTG Knowledge Files
        • Writing mitmproxy Python scripts for MASTG demos
        • Writing r2 scripts (radare2) for MASTG demos
        • Writing MASTG SAST Rules
        • Writing MASTG Technique Files
        • Writing MASTG Test Files
        • Writing MASTG Tool Files
        • Porting MASTG v1 tests to v2
      • Donations
      • How to Donate
      • Donation Packages
    • 💬 Connect with Us
    android tool

    MASTG-TOOL-0020: JustTrustMe

    JustTrustMe is an LSPosed module to bypass SSL certificate pinning.

    © OWASP Foundation 2026. This work is licensed under CC-BY-4.0. For any reuse or distribution, you must make clear to others the license terms of this work.
    OWASP ® is a registered trademark of the OWASP Foundation, Inc. This website uses cookies to analyze our traffic and only share that information with our analytics partners. Learn more.
    Made with Material for MkDocs | Website and covers designed by Carlos Holguera.