owasp/android-security-masterclassOWASP hands-on Android security training lab with 78 MASVS/MASTG modules pairing vulnerable, secure, and attacker apps to demonstrate mobile weaknesses and their fixes.
Official OWASP Project — A Hands-on OWASP MASVS/MASTG Security Training Lab for Android Developers & Pentesters — Mirror Architecture: Vulnerable ↔ Secure ↔ Attacker
The Android Security Masterclass is an official OWASP project designed with a Mirror Architecture to teach Android developers and security researchers exactly what vulnerabilities look like and exactly how to fix them using modern Android development practices.
Instead of hunting for bugs in outdated Java codebases, this project uses a state-of-the-art tech stack (Kotlin, Jetpack Compose, MVVM, Material 3) and is structured around a massively scalable "Package-by-Feature" system.
🌐 OWASP Project Portal & Documentation:
- OWASP Project Page: https://owasp.org/projects/android-security-masterclass
- Documentation Portal: https://owasp.github.io/Android-Security-Masterclass/
- Whitepaper & 78-Module Mapping Matrix: Available in the documentation portal.
graph TD
COMMON("🧱 :common<br/>Shared Data · Theme<br/>Dashboard Metadata")
subgraph FEATURES ["📦 Package-by-Feature (78 Isolated MASWE Modules)"]
direction LR
M1(":features:maswe0001<br/>Private Storage")
M2(":features:maswe0002<br/>External Storage")
M5(":features:maswe0005<br/>Logging Leaks")
MDOT("...<br/>... ")
M78(":features:maswe0078<br/>Privacy")
end
VULN("❌ :app-vulnerable<br/>Thin Shell Orchestrator")
SEC("✅ :app-secure<br/>Thin Shell Orchestrator")
ATK("😈 :app-attacker<br/>Simulated Malware")
COMMON --> FEATURES
FEATURES -- "Insecure Implementation" --> VULN
FEATURES -- "Hardened Implementation" --> SEC
VULN -. "Active Exploit<br/>IPC / Logcat" .-> ATK
classDef common fill:#4A90D9,stroke:#2C5F8A,color:#fff,stroke-width:2px,font-weight:bold
classDef feat fill:#F39C12,stroke:#D35400,color:#fff,stroke-width:2px,font-weight:bold
classDef vuln fill:#E74C3C,stroke:#C0392B,color:#fff,stroke-width:2px,font-weight:bold
classDef secure fill:#27AE60,stroke:#1E8449,color:#fff,stroke-width:2px,font-weight:bold
classDef attacker fill:#8E44AD,stroke:#6C3483,color:#fff,stroke-width:2px,font-weight:bold
class COMMON common
class M1,M2,M5,MDOT,M78 feat
class VULN vuln
class SEC secure
class ATK attackerThe project utilizes a Hyper-Modular architecture spanning over 80 total modules:
MasterclassData High-Fidelity ModelUnlike other educational projects that use trivial data ("admin:password"), our leak simulations use regulation-grade payloads:
💡 Tip: You can view all of this simulated data live on your device by clicking the "Data Vault" button on the Dashboard of either the vulnerable or secure app.
We have mapped the entire OWASP MASVS standard into 78 distinct modules across 8 domains:
The following modules have their business logic, MVI architecture, unit tests, and attack/defense simulations fully implemented:
-assumenosideeffects) and SecureLog wrappers.adb backup or Google Drive cloud backup. Hardened via android:allowBackup="false", dataExtractionRules, and fullBackupContent.(See the docs/mapping_matrix.md on the MkDocs site for the full 78-vector breakdown).
app-vulnerable or app-secure run configuration and deploy to an emulator.Build Variants tool window and select debug. Run the app and check Logcat. You will see the leaks in the vulnerable app.release. R8 (ProGuard) minification will kick in. In app-secure, all critical logs will be stripped out entirely!:app-attacker)To see the real consequences of these vulnerabilities, install the :app-attacker module alongside :app-vulnerable on the same device.
graph LR
subgraph VICTIM ["❌ :app-vulnerable"]
direction TB
LOG("📋 Log.d sends PII<br/>to system Logcat")
FP("📂 FileProvider<br/>exported paths")
end
subgraph MALWARE ["😈 :app-attacker"]
direction TB
LE("🔍 LogcatExploitScreen<br/>reads all logs")
ER("📥 ExploitReceiverScreen<br/>steals files via URI")
end
LOG -- "READ_LOGS permission" --> LE
FP -- "content:// URI interception" --> ER
classDef victim fill:#E74C3C,stroke:#C0392B,color:#fff,stroke-width:2px
classDef malware fill:#8E44AD,stroke:#6C3483,color:#fff,stroke-width:2px
class LOG,FP victim
class LE,ER malwareGranting READ_LOGS Permission (For MASWE-0005):
By default, Android does not allow apps to read system logs. To demonstrate how a malicious app can read logs if granted permission (or on rooted/older devices), you must grant this permission manually via ADB:
adb shell pm grant com.hasantuncay.mobsec.attacker android.permission.READ_LOGS
Note for Physical Devices: If testing on MIUI, ColorOS, etc., you must go to Developer Options and enable "USB debugging (Security settings)" to allow ADB to grant permissions.
This project is created strictly for educational purposes. The vulnerabilities demonstrated in the :app-vulnerable module are real and dangerous. Do not use the code from the :app-vulnerable module in production environments. Always refer to the :app-secure module for best practices.
We welcome contributions from the community! Please read our comprehensive Contributing Guide before opening a Pull Request. It covers our project philosophy (Package-by-Feature Mirror Architecture), coding standards, and the step-by-step process for generating and implementing logic inside the :features:masweXXXX modules.
Project Leader:
Community & Support:
| Module Layer | Role | Status |
|---|
:common | The foundation. Contains the MasterclassData high-fidelity payload generator, Dashboard metadata, core UI theme, and generic navigation components. | Foundation ✅ |
:features:masweXXXX | 78 fully isolated Gradle modules (0001 to 0078). Each module contains both the vulnerable and secure logic for a single specific weakness, completely preventing cross-module code leakage. | 78 Modules Generated ✅ |
:app-vulnerable | A "Thin Shell" orchestrator app. It wires together the insecure UI components from all 78 feature modules to demonstrate the exact consequence of OWASP violations. | Active ✅ |
:app-secure | A "Thin Shell" orchestrator app. Wires together the secure implementations utilizing modern standards (Jetpack Security, Tink, SQLCipher, ProGuard). | Active ✅ |
:app-attacker | A simulated malicious third-party app. Demonstrates live IPC exploits via a secondary process running concurrently on the device. | Active ✅ |