Lion Cipher Lab
Test an Android App Against the OWASP MASTG (Manual Static Analysis)
- AppSec / DevSecOps
- Intermediate
- ~90 min
- Free · no account required
Why it matters
An automated scanner like MobSF is a fantastic first pass, but it has a blind spot every professional runs into: it tells you WHAT it flagged, not HOW it knew, and it cannot reason about your app's specific logic. When a scanner reports 'possible hardcoded secret' or 'insecure storage', someone has to confirm the finding is real, judge how bad it is, and sometimes find the issue the scanner missed entirely. That someone does it BY HAND, and the recognized playbook for doing it is the OWASP Mobile Application Security Testing Guide (MASTG) -- the industry's step-by-step manual for testing a…
What you'll learn
- standing up an Android testing environment from zero: Android Studio, an emulator (AVD), and adb
- installing a deliberately-vulnerable teaching APK onto your own emulator with adb
- understanding the OWASP mobile standard as a system: MASVS (what a secure app must do) and MASTG (how to test it)
- decoding an APK's binary manifest back to readable XML by hand with apktool
- reading AndroidManifest.xml manually for exported components, debuggable, and allowBackup
- decompiling an APK to Java with jadx and hunting hardcoded secrets in the real source
- pulling an app's stored data (shared_prefs, databases) off the emulator with adb to prove insecure storage at rest
- mapping each finding you make to a named MASVS category (STORAGE, PLATFORM, CRYPTO)
- understanding the difference between an automated scan (MobSF) and manual MASTG verification, and why both matter
Steps in this lab
- What this Part 2 is, why it is legal and safe, and how it differs from the MobSF scan
- The standard you are testing against: MASVS and MASTG, from zero
- Stand up an Android testing environment: Android Studio, an emulator, and adb
- Get the deliberately-vulnerable app and install it on your emulator
- MASTG static check 1 -- decode the manifest by hand with apktool
- MASTG static check 2 -- decompile the code with jadx and hunt hardcoded secrets
- MASTG check 3 -- pull the app's stored data off the emulator and see it in cleartext
- Write it up: map every finding to a MASVS category, and where this goes next