owasp/android-security-masterclassOWASP hands-on Android security training lab with 78 MASVS/MASTG modules pairing vulnerable, secure, and attacker apps to demonstrate mobile weaknesses and their fixes.
Official OWASP Project — A Hands-on OWASP MASVS/MASTG Security Training Lab for Android Developers & Pentesters — Mirror Architecture: Vulnerable ↔ Secure ↔ Attacker
The Android Security Masterclass is an official OWASP project designed with a Mirror Architecture to teach Android developers and security researchers exactly what vulnerabilities look like and exactly how to fix them using modern Android development practices.
Instead of hunting for bugs in outdated Java codebases, this project uses a state-of-the-art tech stack (Kotlin, Jetpack Compose, MVVM, Material 3) and is structured around a massively scalable "Package-by-Feature" system.
🌐 OWASP Project Portal & Documentation:
- OWASP Project Page: https://owasp.org/projects/android-security-masterclass
- Documentation Portal: https://owasp.github.io/Android-Security-Masterclass/
- Whitepaper & 78-Module Mapping Matrix: Available in the documentation portal.
graph TD
COMMON("🧱 :common<br/>Shared Data · Theme<br/>Dashboard Metadata")
subgraph FEATURES ["📦 Package-by-Feature (78 Isolated MASWE Modules)"]
direction LR
M1(":features:maswe0001<br/>Private Storage")
M2(":features:maswe0002<br/>External Storage")
M5(":features:maswe0005<br/>Logging Leaks")
MDOT("...<br/>... ")
M78(":features:maswe0078<br/>Privacy")
end
VULN("❌ :app-vulnerable<br/>Thin Shell Orchestrator")
SEC("✅ :app-secure<br/>Thin Shell Orchestrator")
ATK("😈 :app-attacker<br/>Simulated Malware")
COMMON --> FEATURES
FEATURES -- "Insecure Implementation" --> VULN
FEATURES -- "Hardened Implementation" --> SEC
VULN -. "Active Exploit<br/>IPC / Logcat" .-> ATK
classDef common fill:#4A90D9,stroke:#2C5F8A,color:#fff,stroke-width:2px,font-weight:bold
classDef feat fill:#F39C12,stroke:#D35400,color:#fff,stroke-width:2px,font-weight:bold
classDef vuln fill:#E74C3C,stroke:#C0392B,color:#fff,stroke-width:2px,font-weight:bold
classDef secure fill:#27AE60,stroke:#1E8449,color:#fff,stroke-width:2px,font-weight:bold
classDef attacker fill:#8E44AD,stroke:#6C3483,color:#fff,stroke-width:2px,font-weight:bold
class COMMON common
class M1,M2,M5,MDOT,M78 feat
class VULN vuln
class SEC secure
class ATK attacker
The project utilizes a Hyper-Modular architecture spanning over 80 total modules:
| Module Layer | Role | Status |
|---|---|---|
:common | The foundation. Contains the MasterclassData high-fidelity payload generator, Dashboard metadata, core UI theme, and generic navigation components. | Foundation ✅ |
:features:masweXXXX | 78 fully isolated Gradle modules (0001 to 0078). Each module contains both the vulnerable and secure logic for a single specific weakness, completely preventing cross-module code leakage. | 78 Modules Generated ✅ |
:app-vulnerable | A "Thin Shell" orchestrator app. It wires together the insecure UI components from all 78 feature modules to demonstrate the exact consequence of OWASP violations. | Active ✅ |
:app-secure | A "Thin Shell" orchestrator app. Wires together the secure implementations utilizing modern standards (Jetpack Security, Tink, SQLCipher, ProGuard). | Active ✅ |
:app-attacker | A simulated malicious third-party app. Demonstrates live IPC exploits via a secondary process running concurrently on the device. | Active ✅ |
MasterclassData High-Fidelity ModelUnlike other educational projects that use trivial data ("admin:password"), our leak simulations use regulation-grade payloads:
💡 Tip: You can view all of this simulated data live on your device by clicking the "Data Vault" button on the Dashboard of either the vulnerable or secure app.
We have mapped the entire OWASP MASVS standard into 78 distinct modules across 8 domains:
The following modules have their business logic, MVI architecture, unit tests, and attack/defense simulations fully implemented:
-assumenosideeffects) and SecureLog wrappers.adb backup or Google Drive cloud backup. Hardened via android:allowBackup="false", dataExtractionRules, and fullBackupContent.