{"id":13717259,"url":"https://github.com/OWASP/MASTG-Hacking-Playground","last_synced_at":"2025-05-07T07:30:51.463Z","repository":{"id":50477726,"uuid":"63831082","full_name":"OWASP/MASTG-Hacking-Playground","owner":"OWASP","description":null,"archived":false,"fork":false,"pushed_at":"2022-10-31T17:03:31.000Z","size":78089,"stargazers_count":589,"open_issues_count":11,"forks_count":138,"subscribers_count":53,"default_branch":"master","last_synced_at":"2024-10-29T16:58:11.428Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/OWASP.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.md","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-07-21T02:43:19.000Z","updated_at":"2024-10-28T17:34:25.000Z","dependencies_parsed_at":"2023-01-20T11:01:28.095Z","dependency_job_id":null,"html_url":"https://github.com/OWASP/MASTG-Hacking-Playground","commit_stats":null,"previous_names":["owasp/mstg-hacking-playground"],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OWASP%2FMASTG-Hacking-Playground","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OWASP%2FMASTG-Hacking-Playground/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OWASP%2FMASTG-Hacking-Playground/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OWASP%2FMASTG-Hacking-Playground/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/OWASP","download_url":"https://codeload.github.com/OWASP/MASTG-Hacking-Playground/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":224262144,"owners_count":17282267,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T00:01:19.950Z","updated_at":"2024-11-14T05:31:12.143Z","avatar_url":"https://github.com/OWASP.png","language":"Java","funding_links":[],"categories":["Mobile Security","Java"],"sub_categories":["Vulnerable Apps"],"readme":"# MASTG Hacking Playground\n\nWelcome to the MASTG Hacking Playground which is part of the [OWASP Mobile Application Security (MAS) project](https://mas.owasp.org/).\n\nThe MASTG Hacking Playground is a collection of educational iOS and Android mobile apps, that are intentionally build insecure in order to give practical guidance to developers, security researches and penetration testers.\n\nThe vulnerabilities used in these apps come from the [OWASP Mobile Application Security Testing Guide (MASTG)](https://github.com/OWASP/owasp-mastg/releases) (there is no full coverage of all test cases, but you are invited to extend the current coverage).\n\n- A developer can identify vulnerable code in the provided apps and can see the implications and risks if such patterns are used and can look for the best practices in the MASTG to mitigate the vulnerabilities.\n- Penetration testers / security researchers can identify bad practices, dangerous methods and classes they should look for when assessing a mobile app and can gain more knowledge through the information provided in the MASTG.\n- It is also encouraged to use these apps for education purpose during trainings and workshops.\n\nIf you want to contribute, please [contact us](https://mas.owasp.org/#connect-with-us). For instance, you could:\n\n- Extend MASTG test case coverage\n- Improve the user / hacker experience\n- Bug-fix them\n- Propose new ideas\n- etc.\n\n\u003e NOTE: The OWASP MAS project also includes [the MASTG Crackmes](https://github.com/OWASP/owasp-mastg/tree/master/Crackmes \"MASTG-Crackmes\") which include various solutions that can guide you through the reverse engineering process and help you learn and practice.\n\n_Currently, the code is being maintained by [@sushi2k](https://github.com/sushi2k \"Sven Schleier\"). If the app does not boot, or if there is another bug: [file an issue](https://github.com/OWASP/MASTG-Hacking-Playground/issues) at this repository._\n\n## Android\n\n### MASTG Android Java App\n\n- Author: [Sven Schleier](https://github.com/sushi2k \"Sven Schleier\")\n- Maintained by [Sven Schleier](https://github.com/sushi2k \"Sven Schleier\")\n\nThe sources can be found here: \u003chttps://github.com/OWASP/MASTG-Hacking-Playground/tree/master/Android/MSTG-Android-Java-App\u003e\n\n#### Installation\n\nThis app is compatible with Android 4.4 and up. Once you checkout the repo you can install the debug build:\n\n```bash\n$ adb install Android/MSTG-Android-Java-App/app/build/outputs/apk/debug/app-debug.apk  \n```\n\nThe APK is also available in the [release page](https://github.com/OWASP/MASTG-Hacking-Playground/releases/tag/1.0).\n\nScreenshot of app:\n\n![Test cases mapped to MASTG](https://raw.githubusercontent.com/OWASP/MASTG-Hacking-Playground/master/Android/screenshots/android-app-java.png \"Test cases mapped to MASTG\" )\n\n#### Available Test Cases\n\nCheck the [Wiki](https://github.com/OWASP/MASTG-Hacking-Playground/wiki/Android-App) for a description of all available test cases in the `MSTG-Android-Java-App`.\n\n### MASTG Android Kotlin App\n\n- Author: [Wen Bin Kong](https://github.com/kongwenbin \"Wen Bin Kong\")\n- Maintained by [Sven Schleier](https://github.com/sushi2k \"Sven Schleier\")\n\nThe sources can be found here: \u003chttps://github.com/OWASP/MASTG-Hacking-Playground/tree/master/Android/MSTG-Android-Kotlin-App\u003e\n\n#### Installation\n\nIn order to use the Kotlin App you need to deploy the [Ruby on Rails backend](https://github.com/OWASP/MASTG-Hacking-Playground/tree/master/Serverside/rails-api-original \"ror\")\n\nThis app is compatible with Android 4.4 and up. Once you checkout the repo you can install the debug build:\n\n```bash\n$ adb install Android/MSTG-Android-Kotlin-App/app/build/outputs/apk/debug/app-debug.apk\n```\n\nThe APK is also available in the [release page](https://github.com/OWASP/MASTG-Hacking-Playground/releases/tag/1.0).\n\n### Android Studio\n\nOpen the project directories `Android/MSTG-Android-Kotlin-App/` or `Android/MSTG-Android-Java-App/` in Android Studio. The apps can be compiled with Android Studio 3.5 (tested).\n\nIn order to get the `MSTG-Android-Java-App` running, besides the Android SDK, also the Android NDK needs to be available. If the NDK is not available, Android Studio will ask to download or specify a local path for the NDK when the project is opened. If parts of the SDK are missing, a prompt should show up to install the additional requirements. Afterwards the App can be build and can be run in an emulator or mobile device.\n\n## iOS\n\n### MASTG iOS Swift App\n\n- Author: [Sven Schleier](https://github.com/sushi2k \"Sven Schleier\")\n- Maintained by [Sven Schleier](https://github.com/sushi2k \"Sven Schleier\")\n\nThe sources can be found here: \u003chttps://github.com/OWASP/MASTG-Hacking-Playground/tree/master/iOS/MSTG-JWT\u003e\n\n#### Installation\n\nIn order to use the iOS App you need to deploy the [Ruby on Rails backend](https://github.com/OWASP/MASTG-Hacking-Playground/tree/master/Serverside/rails-api-original \"ror\")\n\nThe IPA is also available in the [release page](https://github.com/OWASP/MASTG-Hacking-Playground/releases/tag/1.0).\n\nThere are several ways available on how to install an IPA; [have a look at the MASTG](https://mas.owasp.org/MASTG/iOS/0x06b-Basic-Security-Testing/#installing-apps) to identify which one is the best for you.\n\n## License\n\nThis project is using the GNU General Public License v3.0.\n\n## Acknowledgements\n\nWen Bin Kong (@kongwenbin)\nNikhil Soni (@nikhil)\nRyan Teoh (@ryantzj)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FOWASP%2FMASTG-Hacking-Playground","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FOWASP%2FMASTG-Hacking-Playground","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FOWASP%2FMASTG-Hacking-Playground/lists"}