Y-Security
Home
CVE
CWE
Mobile Security Testing Guide
OWASP Cheat Sheet Series
Web Security Testing Guide
Y-Security
Home
CVE
CVE
CVE Lookup
CWE
CWE
CWE ID Lookup
Mobile Security Testing Guide
Mobile Security Testing Guide
2023
2023
Foreword
Frontispiece
OWASP MASVS and MASTG Adoption
Acknowledgments
Introduction to the OWASP Mobile Application Security Project
Mobile Application Taxonomy
Mobile Application Security Testing
Mobile App Tampering and Reverse Engineering
Mobile App Authentication Architectures
Mobile App Network Communication
Mobile App Cryptography
Mobile App Code Quality
Mobile App User Privacy Protection
Android Platform Overview
Android Basic Security Testing
Android Tampering and Reverse Engineering
Android Data Storage
Android Cryptographic APIs
Android Local Authentication
Android Network Communication
Android Platform APIs
Android Code Quality and Build Settings
Android Anti-Reversing Defenses
iOS Platform Overview
iOS Basic Security Testing
iOS Tampering and Reverse Engineering
iOS Data Storage
iOS Cryptographic APIs
iOS Local Authentication
iOS Network Communication
iOS Platform APIs
iOS Code Quality and Build Settings
iOS Anti-Reversing Defenses
Testing Tools
Reference applications
Suggested Reading
Changelog
Summary
Crackmes
Crackmes
UnCrackable Mobile Apps
2022
2022
Foreword
Frontispiece
OWASP MASVS and MASTG Adoption
Acknowledgments
Introduction to the OWASP Mobile Application Security Project
Mobile Application Taxonomy
Mobile Application Security Testing
Mobile App Tampering and Reverse Engineering
Mobile App Authentication Architectures
Mobile App Network Communication
Mobile App Cryptography
Mobile App Code Quality
Mobile App User Privacy Protection
Android Platform Overview
Android Basic Security Testing
Android Tampering and Reverse Engineering
Android Data Storage
Android Cryptographic APIs
Android Local Authentication
Android Network Communication
Android Platform APIs
Android Code Quality and Build Settings
Android Anti-Reversing Defenses
iOS Platform Overview
iOS Basic Security Testing
iOS Tampering and Reverse Engineering
iOS Data Storage
iOS Cryptographic APIs
iOS Local Authentication
iOS Network Communication
iOS Platform APIs
iOS Code Quality and Build Settings
iOS Anti-Reversing Defenses
Testing Tools
Reference applications
Suggested Reading
Changelog
Summary
Crackmes
Crackmes
UnCrackable Mobile Apps
2021
2021
Foreword
Frontispiece
Overview
Mobile App Taxonomy
Mobile App Security Testing
Mobile App Tampering and Reverse Engineering
Mobile App Authentication Architectures
Mobile App Network Communication
Mobile App Cryptography
Mobile App Code Quality
Mobile App User Interaction
Android Platform Overview
Android Basic Security Testing
Android Tampering and Reverse Engineering
Android Data Storage
Android Cryptographic APIs
Android Local Authentication
Android Network APIs
Android Platform APIs
Android Code Quality and Build Settings
Android Anti-Reversing Defenses
iOS Platform Overview
iOS Basic Security Testing
iOS Tampering and Reverse Engineering
iOS Data Storage
iOS Cryptographic APIs
iOS Local Authentication
iOS Network APIs
iOS Platform APIs
iOS Code Quality and Build Settings
iOS Anti-Reversing Defenses
Appendix
Testing Tools
Suggested Reading
Changelog
Summary
OWASP Cheat Sheet Series
OWASP Cheat Sheet Series
AJAX Security Cheat Sheet
Abuse Case Cheat Sheet
DEPRECATED: Access Control Cheatsheet
Attack Surface Analysis Cheat Sheet
Authentication Cheat Sheet
Authorization Cheat Sheet
Authorization Testing Automation Cheat Sheet
Bean Validation Cheat Sheet
C-Based Toolchain Hardening Cheat Sheet
Choosing and Using Security Questions Cheat Sheet
Clickjacking Defense Cheat Sheet
Content Security Policy Cheat Sheet
Credential Stuffing Prevention Cheat Sheet
Cross-Site Request Forgery Prevention Cheat Sheet
Cross Site Scripting Prevention Cheat Sheet
Cryptographic Storage Cheat Sheet
DOM Clobbering Prevention Cheat Sheet
DOM based XSS Prevention Cheat Sheet
Database Security Cheat Sheet
Denial of Service Cheat Sheet
Deserialization Cheat Sheet
Django REST Framework (DRF) Cheat Sheet
Docker Security Cheat Sheet
DotNet Security Cheat Sheet
Error Handling Cheat Sheet
File Upload Cheat Sheet
Forgot Password Cheat Sheet
GraphQL Cheat Sheet
HTML5 Security Cheat Sheet
HTTP Security Response Headers Cheat Sheet
HTTP Strict Transport Security Cheat Sheet
Infrastructure as Code Security Cheat Sheet
Injection Prevention Cheat Sheet
Injection Prevention Cheat Sheet in Java
Input Validation Cheat Sheet
Insecure Direct Object Reference Prevention Cheat Sheet
JAAS Cheat Sheet
JSON Web Token Cheat Sheet for Java
Java Security Cheat Sheet
Key Management Cheat Sheet
Kubernetes Security Cheat Sheet
LDAP Injection Prevention Cheat Sheet
Laravel Cheat Sheet
Logging Cheat Sheet
Application Logging Vocabulary Cheat Sheet
Mass Assignment Cheat Sheet
Microservices Security Cheat Sheet
Microservices based Security Arch Doc Cheat Sheet
Multi-Factor Authentication Cheat Sheet
NPM Security best practices
Network segmentation Cheat Sheet
Node.js Docker Cheat Sheet
NodeJS Security Cheat Sheet
OS Command Injection Defense Cheat Sheet
PHP Configuration Cheat Sheet
Password Storage Cheat Sheet
Pinning Cheat Sheet
Prototype Pollution Prevention Cheat Sheet
Query Parameterization Cheat Sheet
REST Assessment Cheat Sheet
REST Security Cheat Sheet
Ruby on Rails Cheat Sheet
SAML Security Cheat Sheet
SQL Injection Prevention Cheat Sheet
Secrets Management Cheat Sheet
Cloud Architecture Security Cheat Sheet
Secure Product Design Cheat Sheet
Securing Cascading Style Sheets Cheat Sheet
Server-Side Request Forgery Prevention Cheat Sheet
Session Management Cheat Sheet
TLS Cipher String Cheat Sheet
Third Party JavaScript Management Cheat Sheet
Threat Modeling Cheat Sheet
Transaction Authorization Cheat Sheet
Transport Layer Protection Cheat Sheet
Unvalidated Redirects and Forwards Cheat Sheet
User Privacy Protection Cheat Sheet
Virtual Patching Cheat Sheet
Vulnerability Disclosure Cheat Sheet
Vulnerable Dependency Management Cheat Sheet
Web Service Security Cheat Sheet
XML External Entity Prevention Cheat Sheet
XML Security Cheat Sheet
XSS Filter Evasion Cheat Sheet
Cross-site leaks Cheat Sheet
Web Security Testing Guide
Web Security Testing Guide
2023
2023
Web Application Security Testing
00 Introduction and Objectives
00 Introduction and Objectives
0 Introduction and Objectives
01 Information Gathering
01 Information Gathering
1 Information Gathering
Conduct Search Engine Discovery Reconnaissance for Information Leakage
Fingerprint Web Server
Review Webserver Metafiles for Information Leakage
Enumerate Applications on Webserver
Review Web Page Content for Information Leakage
Identify Application Entry Points
Map Execution Paths Through Application
Fingerprint Web Application Framework
Fingerprint Web Application
Map Application Architecture
02 Configuration and Deployment Management Testing
02 Configuration and Deployment Management Testing
2 Configuration and Deployment Management Testing
Test Network Infrastructure Configuration
Test Application Platform Configuration
Test File Extensions Handling for Sensitive Information
Review Old Backup and Unreferenced Files for Sensitive Information
Enumerate Infrastructure and Application Admin Interfaces
Test HTTP Methods
Test HTTP Strict Transport Security
Test RIA Cross Domain Policy
Test File Permission
Test for Subdomain Takeover
Test Cloud Storage
Testing for Content Security Policy
Test Path Confusion
03 Identity Management Testing
03 Identity Management Testing
3 Identity Management Testing
Test Role Definitions
Test User Registration Process
Test Account Provisioning Process
Testing for Account Enumeration and Guessable User Account
Testing for Weak or Unenforced Username Policy
04 Authentication Testing
04 Authentication Testing
4 Authentication Testing
Testing for Credentials Transported over an Encrypted Channel
Testing for Default Credentials
Testing for Weak Lock Out Mechanism
Testing for Bypassing Authentication Schema
Testing for Vulnerable Remember Password
Testing for Browser Cache Weaknesses
Testing for Weak Password Policy
Testing for Weak Security Question Answer
Testing for Weak Password Change or Reset Functionalities
Testing for Weaker Authentication in Alternative Channel
Testing Multi-Factor Authentication (MFA)
05 Authorization Testing
05 Authorization Testing
5 Authorization Testing
Testing Directory Traversal File Include
Testing for Bypassing Authorization Schema
Testing for Privilege Escalation
Testing for Insecure Direct Object References
Testing for OAuth Weaknesses
Testing for OAuth Authorization Server Weaknesses
Testing for OAuth Client Weaknesses
06 Session Management Testing
06 Session Management Testing
6 Session Management Testing
Testing for Session Management Schema
Testing for Cookies Attributes
Testing for Session Fixation
Testing for Exposed Session Variables
Testing for Cross Site Request Forgery
Testing for Logout Functionality
Testing Session Timeout
Testing for Session Puzzling
Testing for Session Hijacking
Testing JSON Web Tokens
07 Input Validation Testing
07 Input Validation Testing
7 Input Validation Testing
Testing for Reflected Cross Site Scripting
Testing for Stored Cross Site Scripting
Testing for HTTP Verb Tampering
Testing for HTTP Parameter Pollution
Testing for SQL Injection
Testing for Oracle
Testing for MySQL
Testing for SQL Server
Testing PostgreSQL
Testing for MS Access
Testing for NoSQL Injection
Testing for ORM Injection
Testing for Client-side
Testing for LDAP Injection
Testing for XML Injection
Testing for SSI Injection
Testing for XPath Injection
Testing for IMAP SMTP Injection
Testing for Code Injection
Testing for File Inclusion
Testing for Command Injection
Testing for Buffer Overflow
Testing for Format String Injection
Testing for Incubated Vulnerability
Testing for HTTP Splitting Smuggling
Testing for HTTP Incoming Requests
Testing for Host Header Injection
Testing for Server-side Template Injection
Testing for Server-Side Request Forgery
Testing for Mass Assignment
08 Testing for Error Handling
08 Testing for Error Handling
8 Testing for Error Handling
Testing for Improper Error Handling
Testing for Stack Traces
09 Testing for Weak Cryptography
09 Testing for Weak Cryptography
9 Testing for Weak Cryptography
Testing for Weak Transport Layer Security
Testing for Padding Oracle
Testing for Sensitive Information Sent via Unencrypted Channels
Testing for Weak Encryption
10 Business Logic Testing
10 Business Logic Testing
10 Business Logic Testing
Introduction to Business Logic
Test Business Logic Data Validation
Test Ability to Forge Requests
Test Integrity Checks
Test for Process Timing
Test Number of Times a Function Can Be Used Limits
Testing for the Circumvention of Work Flows
Test Defenses Against Application Misuse
Test Upload of Unexpected File Types
Test Upload of Malicious Files
Test Payment Functionality
11 Client side Testing
11 Client side Testing
11 Client-Side Testing
Testing for DOM-Based Cross Site Scripting
Testing for Self DOM Based Cross-Site Scripting
Testing for JavaScript Execution
Testing for HTML Injection
Testing for Client-side URL Redirect
Testing for CSS Injection
Testing for Client-side Resource Manipulation
Testing Cross Origin Resource Sharing
Testing for Cross Site Flashing
Testing for Clickjacking
Testing WebSockets
Testing Web Messaging
Testing Browser Storage
Testing for Cross Site Script Inclusion
Testing for Reverse Tabnabbing
12 API Testing
12 API Testing
12 API Testing
Testing GraphQL
2022
2022
Web Application Security Testing
00 Introduction and Objectives
00 Introduction and Objectives
0 Introduction and Objectives
01 Information Gathering
01 Information Gathering
1 Information Gathering
Conduct Search Engine Discovery Reconnaissance for Information Leakage
Fingerprint Web Server
Review Webserver Metafiles for Information Leakage
Enumerate Applications on Webserver
Review Webpage Content for Information Leakage
Identify Application Entry Points
Map Execution Paths Through Application
Fingerprint Web Application Framework
Fingerprint Web Application
Map Application Architecture
02 Configuration and Deployment Management Testing
02 Configuration and Deployment Management Testing
2 Configuration and Deployment Management Testing
Test Network Infrastructure Configuration
Test Application Platform Configuration
Test File Extensions Handling for Sensitive Information
Review Old Backup and Unreferenced Files for Sensitive Information
Enumerate Infrastructure and Application Admin Interfaces
Test HTTP Methods
Test HTTP Strict Transport Security
Test RIA Cross Domain Policy
Test File Permission
Test for Subdomain Takeover
Test Cloud Storage
Testing for Content Security Policy
03 Identity Management Testing
03 Identity Management Testing
3 Identity Management Testing
Test Role Definitions
Test User Registration Process
Test Account Provisioning Process
Testing for Account Enumeration and Guessable User Account
Testing for Weak or Unenforced Username Policy
04 Authentication Testing
04 Authentication Testing
4 Authentication Testing
Testing for Credentials Transported over an Encrypted Channel
Testing for Default Credentials
Testing for Weak Lock Out Mechanism
Testing for Bypassing Authentication Schema
Testing for Vulnerable Remember Password
Testing for Browser Cache Weaknesses
Testing for Weak Password Policy
Testing for Weak Security Question Answer
Testing for Weak Password Change or Reset Functionalities
Testing for Weaker Authentication in Alternative Channel
Testing Multi-Factor Authentication (MFA)
05 Authorization Testing
05 Authorization Testing
5 Authorization Testing
Testing Directory Traversal File Include
Testing for Bypassing Authorization Schema
Testing for Privilege Escalation
Testing for Insecure Direct Object References
Testing for OAuth Weaknesses
Testing for OAuth Authorization Server Weaknesses
Testing for OAuth Client Weaknesses
06 Session Management Testing
06 Session Management Testing
6 Session Management Testing
Testing for Session Management Schema
Testing for Cookies Attributes
Testing for Session Fixation
Testing for Exposed Session Variables
Testing for Cross Site Request Forgery
Testing for Logout Functionality
Testing Session Timeout
Testing for Session Puzzling
Testing for Session Hijacking
Testing JSON Web Tokens
07 Input Validation Testing
07 Input Validation Testing
7 Input Validation Testing
Testing for Reflected Cross Site Scripting
Testing for Stored Cross Site Scripting
Testing for HTTP Verb Tampering
Testing for HTTP Parameter Pollution
Testing for SQL Injection
Testing for Oracle
Testing for MySQL
Testing for SQL Server
Testing PostgreSQL
Testing for MS Access
Testing for NoSQL Injection
Testing for ORM Injection
Testing for Client-side
Testing for LDAP Injection
Testing for XML Injection
Testing for SSI Injection
Testing for XPath Injection
Testing for IMAP SMTP Injection
Testing for Code Injection
Testing for File Inclusion
Testing for Command Injection
Testing for Buffer Overflow
Testing for Format String Injection
Testing for Incubated Vulnerability
Testing for HTTP Splitting Smuggling
Testing for HTTP Incoming Requests
Testing for Host Header Injection
Testing for Server-side Template Injection
Testing for Server-Side Request Forgery
Testing for Mass Assignment
08 Testing for Error Handling
08 Testing for Error Handling
8 Testing for Error Handling
Testing for Improper Error Handling
Testing for Stack Traces
09 Testing for Weak Cryptography
09 Testing for Weak Cryptography
9 Testing for Weak Cryptography
Testing for Weak Transport Layer Security
Testing for Padding Oracle
Testing for Sensitive Information Sent via Unencrypted Channels
Testing for Weak Encryption
10 Business Logic Testing
10 Business Logic Testing
10 Business Logic Testing
Introduction to Business Logic
Test Business Logic Data Validation
Test Ability to Forge Requests
Test Integrity Checks
Test for Process Timing
Test Number of Times a Function Can Be Used Limits
Testing for the Circumvention of Work Flows
Test Defenses Against Application Misuse
Test Upload of Unexpected File Types
Test Upload of Malicious Files
Test Payment Functionality
11 Client side Testing
11 Client side Testing
11 Client-Side Testing
Testing for DOM-Based Cross Site Scripting
Testing for Self DOM Based Cross-Site Scripting
Testing for JavaScript Execution
Testing for HTML Injection
Testing for Client-side URL Redirect
Testing for CSS Injection
Testing for Client-side Resource Manipulation
Testing Cross Origin Resource Sharing
Testing for Cross Site Flashing
Testing for Clickjacking
Testing WebSockets
Testing Web Messaging
Testing Browser Storage
Testing for Cross Site Script Inclusion
Testing for Reverse Tabnabbing
12 API Testing
12 API Testing
12 API Testing
Testing GraphQL
2021
2021
Web Application Security Testing
00 Introduction and Objectives
00 Introduction and Objectives
0 Introduction and Objectives
01 Information Gathering
01 Information Gathering
1 Information Gathering
Conduct Search Engine Discovery Reconnaissance for Information Leakage
Fingerprint Web Server
Review Webserver Metafiles for Information Leakage
Enumerate Applications on Webserver
Review Webpage Content for Information Leakage
Identify Application Entry Points
Map Execution Paths Through Application
Fingerprint Web Application Framework
Fingerprint Web Application
Map Application Architecture
02 Configuration and Deployment Management Testing
02 Configuration and Deployment Management Testing
2 Configuration and Deployment Management Testing
Test Network Infrastructure Configuration
Test Application Platform Configuration
Test File Extensions Handling for Sensitive Information
Review Old Backup and Unreferenced Files for Sensitive Information
Enumerate Infrastructure and Application Admin Interfaces
Test HTTP Methods
Test HTTP Strict Transport Security
Test RIA Cross Domain Policy
Test File Permission
Test for Subdomain Takeover
Test Cloud Storage
03 Identity Management Testing
03 Identity Management Testing
3 Identity Management Testing
Test Role Definitions
Test User Registration Process
Test Account Provisioning Process
Testing for Account Enumeration and Guessable User Account
Testing for Weak or Unenforced Username Policy
04 Authentication Testing
04 Authentication Testing
4 Authentication Testing
Testing for Credentials Transported over an Encrypted Channel
Testing for Default Credentials
Testing for Weak Lock Out Mechanism
Testing for Bypassing Authentication Schema
Testing for Vulnerable Remember Password
Testing for Browser Cache Weaknesses
Testing for Weak Password Policy
Testing for Weak Security Question Answer
Testing for Weak Password Change or Reset Functionalities
Testing for Weaker Authentication in Alternative Channel
05 Authorization Testing
05 Authorization Testing
5 Authorization Testing
Testing Directory Traversal File Include
Testing for Bypassing Authorization Schema
Testing for Privilege Escalation
Testing for Insecure Direct Object References
06 Session Management Testing
06 Session Management Testing
6 Session Management Testing
Testing for Session Management Schema
Testing for Cookies Attributes
Testing for Session Fixation
Testing for Exposed Session Variables
Testing for Cross Site Request Forgery
Testing for Logout Functionality
Testing Session Timeout
Testing for Session Puzzling
Testing for Session Hijacking
07 Input Validation Testing
07 Input Validation Testing
7 Input Validation Testing
Testing for Reflected Cross Site Scripting
Testing for Stored Cross Site Scripting
Testing for HTTP Verb Tampering
Testing for HTTP Parameter Pollution
Testing for SQL Injection
Testing for Oracle
Testing for MySQL
Testing for SQL Server
Testing PostgreSQL
Testing for MS Access
Testing for NoSQL Injection
Testing for ORM Injection
Testing for Client-side
Testing for LDAP Injection
Testing for XML Injection
Testing for SSI Injection
Testing for XPath Injection
Testing for IMAP SMTP Injection
Testing for Code Injection
Testing for Local File Inclusion
Testing for Remote File Inclusion
Testing for Command Injection
Testing for Buffer Overflow
Testing for Format String Injection
Testing for Incubated Vulnerability
Testing for HTTP Splitting Smuggling
Testing for HTTP Incoming Requests
Testing for Host Header Injection
Testing for Server-side Template Injection
Testing for Server-Side Request Forgery
08 Testing for Error Handling
08 Testing for Error Handling
8 Testing for Error Handling
Testing for Improper Error Handling
Testing for Stack Traces
09 Testing for Weak Cryptography
09 Testing for Weak Cryptography
9 Testing for Weak Cryptography
Testing for Weak Transport Layer Security
Testing for Padding Oracle
Testing for Sensitive Information Sent via Unencrypted Channels
Testing for Weak Encryption
10 Business Logic Testing
10 Business Logic Testing
10 Business Logic Testing
Introduction to Business Logic
Test Business Logic Data Validation
Test Ability to Forge Requests
Test Integrity Checks
Test for Process Timing
Test Number of Times a Function Can Be Used Limits
Testing for the Circumvention of Work Flows
Test Defenses Against Application Misuse
Test Upload of Unexpected File Types
Test Upload of Malicious Files
11 Client side Testing
11 Client side Testing
11 Client-Side Testing
Testing for DOM-Based Cross Site Scripting
Testing for JavaScript Execution
Testing for HTML Injection
Testing for Client-side URL Redirect
Testing for CSS Injection
Testing for Client-side Resource Manipulation
Testing Cross Origin Resource Sharing
Testing for Cross Site Flashing
Testing for Clickjacking
Testing WebSockets
Testing Web Messaging
Testing Browser Storage
Testing for Cross Site Script Inclusion
12 API Testing
12 API Testing
12 API Testing
Testing GraphQL
404 - Not found
Back to top