{"owner":"OWASP","repo":"mastg","hasSkills":true,"totalSkillsCount":142,"totalTokensCount":46500,"categories":["anthropic-skill"],"hasMcp":false,"mcpConfig":null,"found":["rules/mastg-android-broken-encryption-modes.yaml","rules/mastg-android-root-detection.yaml","rules/mastg-android-hardcoded-security-provider.yaml",".github/skills/mastg-assign-ids/SKILL.md","tools/index.md","tools/android/MASTG-TOOL-0002.md","tools/android/MASTG-TOOL-0003.md","tools/android/MASTG-TOOL-0001.md","tools/android/MASTG-TOOL-0004.md","rules/mastg-android-broken-encryption-algorithms.yaml","rules/mastg-android-dangerous-app-permissions.yaml","tools/android/MASTG-TOOL-0005.md","tools/android/MASTG-TOOL-0006.md","tools/android/MASTG-TOOL-0007.md","tools/android/MASTG-TOOL-0008.md","tools/android/MASTG-TOOL-0009.md","tools/android/MASTG-TOOL-0010.md","tools/android/MASTG-TOOL-0011.md","tools/android/MASTG-TOOL-0012.md","tools/android/MASTG-TOOL-0013.md","tools/android/MASTG-TOOL-0014.md","tools/android/MASTG-TOOL-0015.md","tools/android/MASTG-TOOL-0016.md","tools/android/MASTG-TOOL-0017.md","tools/android/MASTG-TOOL-0018.md","tools/android/MASTG-TOOL-0019.md","tools/android/MASTG-TOOL-0020.md","tools/android/MASTG-TOOL-0021.md","tools/android/MASTG-TOOL-0022.md","tools/android/MASTG-TOOL-0023.md","tools/android/MASTG-TOOL-0024.md","tools/android/MASTG-TOOL-0025.md","tools/android/MASTG-TOOL-0026.md","tools/android/MASTG-TOOL-0027.md","tools/android/MASTG-TOOL-0028.md","tools/android/MASTG-TOOL-0029.md","tools/android/MASTG-TOOL-0030.md","tools/android/MASTG-TOOL-0099.md","tools/android/MASTG-TOOL-0103.md","tools/android/MASTG-TOOL-0107.md","tools/android/MASTG-TOOL-0112.md","tools/android/MASTG-TOOL-0116.md","tools/android/MASTG-TOOL-0120.md","tools/android/MASTG-TOOL-0123.md","tools/android/MASTG-TOOL-0124.md","tools/android/MASTG-TOOL-0125.md","tools/android/MASTG-TOOL-0130.md","tools/android/MASTG-TOOL-0140.md","tools/android/MASTG-TOOL-0146.md","tools/android/MASTG-TOOL-0147.md","tools/android/MASTG-TOOL-0148.md","tools/android/MASTG-TOOL-0149.md","tools/android/MASTG-TOOL-0151.md","tools/android/MASTG-TOOL-0152.md","tools/android/MASTG-TOOL-0153.md","tools/generic/MASTG-TOOL-0031.md","tools/generic/MASTG-TOOL-0032.md","tools/generic/MASTG-TOOL-0033.md","tools/generic/MASTG-TOOL-0034.md","tools/generic/MASTG-TOOL-0035.md","tools/generic/MASTG-TOOL-0036.md","tools/generic/MASTG-TOOL-0037.md","tools/generic/MASTG-TOOL-0038.md","tools/generic/MASTG-TOOL-0098.md","tools/generic/MASTG-TOOL-0100.md","tools/generic/MASTG-TOOL-0101.md","tools/generic/MASTG-TOOL-0104.md","tools/generic/MASTG-TOOL-0106.md","tools/generic/MASTG-TOOL-0108.md","tools/generic/MASTG-TOOL-0110.md","tools/generic/MASTG-TOOL-0129.md","tools/generic/MASTG-TOOL-0131.md","tools/generic/MASTG-TOOL-0132.md","tools/generic/MASTG-TOOL-0133.md","tools/generic/MASTG-TOOL-0134.md","tools/generic/MASTG-TOOL-0144.md","tools/generic/MASTG-TOOL-0145.md","tools/ios/MASTG-TOOL-0039.md","tools/ios/MASTG-TOOL-0040.md","tools/ios/MASTG-TOOL-0041.md","tools/ios/MASTG-TOOL-0042.md","tools/ios/MASTG-TOOL-0043.md","tools/ios/MASTG-TOOL-0044.md","tools/ios/MASTG-TOOL-0045.md","tools/ios/MASTG-TOOL-0046.md","tools/ios/MASTG-TOOL-0047.md","tools/ios/MASTG-TOOL-0048.md","tools/ios/MASTG-TOOL-0049.md","tools/ios/MASTG-TOOL-0050.md","tools/ios/MASTG-TOOL-0051.md","tools/ios/MASTG-TOOL-0053.md","tools/ios/MASTG-TOOL-0054.md","tools/ios/MASTG-TOOL-0055.md","tools/ios/MASTG-TOOL-0056.md","tools/ios/MASTG-TOOL-0057.md","tools/ios/MASTG-TOOL-0058.md","tools/ios/MASTG-TOOL-0059.md","tools/ios/MASTG-TOOL-0060.md","tools/ios/MASTG-TOOL-0061.md","tools/ios/MASTG-TOOL-0062.md","tools/ios/MASTG-TOOL-0063.md","tools/ios/MASTG-TOOL-0064.md","tools/ios/MASTG-TOOL-0065.md","tools/ios/MASTG-TOOL-0066.md","tools/ios/MASTG-TOOL-0067.md","tools/ios/MASTG-TOOL-0068.md","tools/ios/MASTG-TOOL-0069.md","tools/ios/MASTG-TOOL-0070.md","tools/ios/MASTG-TOOL-0071.md","tools/ios/MASTG-TOOL-0072.md","tools/ios/MASTG-TOOL-0073.md","tools/ios/MASTG-TOOL-0074.md","tools/ios/MASTG-TOOL-0102.md","tools/ios/MASTG-TOOL-0105.md","tools/ios/MASTG-TOOL-0111.md","tools/ios/MASTG-TOOL-0114.md","tools/ios/MASTG-TOOL-0117.md","tools/ios/MASTG-TOOL-0118.md","tools/ios/MASTG-TOOL-0121.md","tools/ios/MASTG-TOOL-0122.md","tools/ios/MASTG-TOOL-0126.md","tools/ios/MASTG-TOOL-0127.md","tools/ios/MASTG-TOOL-0128.md","tools/ios/MASTG-TOOL-0135.md","tools/ios/MASTG-TOOL-0136.md","tools/ios/MASTG-TOOL-0137.md","tools/ios/MASTG-TOOL-0138.md","tools/ios/MASTG-TOOL-0139.md","tools/ios/MASTG-TOOL-0141.md","tools/ios/MASTG-TOOL-0142.md","tools/ios/MASTG-TOOL-0150.md","tools/network/MASTG-TOOL-0075.md","tools/network/MASTG-TOOL-0076.md","tools/network/MASTG-TOOL-0077.md","tools/network/MASTG-TOOL-0078.md","tools/network/MASTG-TOOL-0079.md","tools/network/MASTG-TOOL-0080.md","tools/network/MASTG-TOOL-0081.md","tools/network/MASTG-TOOL-0097.md","tools/network/MASTG-TOOL-0109.md","tools/network/MASTG-TOOL-0115.md","tools/network/MASTG-TOOL-0143.md"],"skills":{"rules/mastg-android-broken-encryption-modes.yaml":"rules:\n - id: mastg-android-broken-encryption-modes\n languages:\n - java\n severity: WARNING\n metadata:\n summary: This rule looks for broken encryption modes.\n message: \"[MASVS-CRYPTO-1] Broken encryption modes found in use.\"\n pattern-either:\n - pattern: Cipher.getInstance(\"AES\")\n - pattern-regex: Cipher\\.getInstance\\(\"?[A-Za-z0-9]+/ECB(/[A-Za-z0-9]+)?\"?\\)\n\n \n","rules/mastg-android-root-detection.yaml":"rules:\n - id: mastg-android-root-detection-file-checks\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of file existence checks commonly used for root detection\n message: \"[MASVS-RESILIENCE-1] The app checks for file existence, which may be part of root detection implementation.\"\n pattern: new File($PATH).exists()\n metavariable-regex:\n metavariable: $PATH\n regex: '.*(su|magisk|Superuser\\.apk).*'\n\n - id: mastg-android-root-detection-package-check\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of package manager checks that may be used for root detection\n message: \"[MASVS-RESILIENCE-1] The app checks for installed packages, which may be looking for root management apps.\"\n pattern: $PM.getPackageInfo($PKG, ...)\n\n - id: mastg-android-root-detection-test-keys\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of test-keys build check for root/custom ROM detection\n message: \"[MASVS-RESILIENCE-1] The app checks Build.TAGS for test-keys, indicating custom ROM or root detection.\"\n pattern-either:\n - pattern: Build.TAGS.contains(\"test-keys\")\n - patterns:\n - pattern: $TAGS.contains(\"test-keys\")\n - pattern-inside: |\n $TAGS = Build.TAGS;\n ...\n - patterns:\n - pattern: StringsKt.contains$default(..., \"test-keys\", ...)\n - pattern-inside: |\n $TAGS = Build.TAGS;\n ...\n\n - id: mastg-android-root-detection-system-properties\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of system property checks via getprop\n message: \"[MASVS-RESILIENCE-1] The app reads system properties via getprop, which may be checking for root indicators.\"\n pattern-either:\n - pattern: Runtime.getRuntime().exec(\"getprop \" + $PROP)\n - pattern: Runtime.getRuntime().exec(new String[] { \"getprop\", $PROP })\n\n - id: mastg-android-root-detection-runtime-exec\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of Runtime.exec calls that may be used for root detection\n message: \"[MASVS-RESILIENCE-1] The app uses Runtime.exec(), which may be attempting to execute su or other commands for root detection.\"\n patterns:\n - pattern: Runtime.getRuntime().exec($CMD)\n - pattern-not: Runtime.getRuntime().exec(\"getprop \" + $PROP)\n - pattern-not: Runtime.getRuntime().exec(new String[] { \"getprop\", $PROP })\n","rules/mastg-android-hardcoded-security-provider.yaml":"rules:\n - id: mastg-android-hardcoded-security-provider\n languages:\n - java\n severity: WARNING\n metadata:\n summary: This rule looks for explicitly specified security providers in getInstance calls.\n message: \"[MASVS-CRYPTO-1] Explicitly specified security provider found. Do not hardcode a provider unless using AndroidKeyStore.\"\n patterns:\n - pattern-either:\n - pattern: $X.getInstance($ALGO, $PROVIDER)\n - pattern: $X.getInstance($ALGO, (String $PROVIDER))\n - pattern: $X.getInstance($ALGO, (java.security.Provider $PROVIDER))\n - pattern-not: KeyStore.getInstance(\"AndroidKeyStore\")\n - metavariable-regex:\n metavariable: $X\n regex: (Cipher|KeyGenerator|KeyPairGenerator|MessageDigest|Signature|Mac|SecretKeyFactory|KeyFactory|SecureRandom|KeyAgreement|AlgorithmParameters|AlgorithmParameterGenerator|CertificateFactory|CertPathBuilder|CertPathValidator|CertStore|KeyStore)\n\n",".github/skills/mastg-assign-ids/SKILL.md":"---\nname: mastg-assign-ids\ndescription: Assign real MASTG IDs to draft files that use fake placeholder IDs (e.g. MASTG-KNOW-0x01, MASTG-BEST-0x56). Use when finishing a PR that introduces new MASTG components with placeholder IDs, or when asked to \"fix fake IDs\", \"assign real IDs\", or \"use next available IDs\". Runs next_id.py to get the correct next IDs, renames all affected files, and replaces all in-content references.\n---\n\n# MASTG Assign IDs\n\nReplace all fake/placeholder component IDs (e.g. `MASTG-KNOW-0x01`, `MASTG-BEST-0x56`) with the next real sequential IDs across file names and file contents.\n\n## When to use\n\n- A PR adds new MASTG components using `0x##` placeholder IDs\n- You are asked to \"fix fake IDs\", \"assign real IDs\", or \"use next available IDs\"\n\n## Fake-ID convention\n\nNew draft items use the pattern `MASTG-TYPE-0x##` (hex suffix, e.g. `0x01`, `0x0a`).\nReal IDs use zero-padded 4-digit decimal: `MASTG-TYPE-NNNN` (e.g. `MASTG-KNOW-0122`).\n\n**Non-standard fake IDs**: Some draft items may use a different convention that is NOT caught by the `0x##` pattern — for example `MASTG-BEST-00ea` (lowercase hex digits without the `0x` prefix). These are still fake IDs and must be replaced. After running `find_fakes.sh`, manually scan the `git diff --name-only origin/master...HEAD` output for any ID-like suffix that contains lowercase letters (`a`–`f`) or is not exactly 4 decimal digits.\n\n## Step-by-step workflow\n\nAll scripts are in `scripts/` relative to this skill. Run from the repository root.\n\n### 1. Find all fake-ID files in the current branch\n\n```bash\nbash .github/skills/mastg-assign-ids/scripts/find_fakes.sh\n```\n\nSee [scripts/find_fakes.sh](scripts/find_fakes.sh).\n\n### 2. Get the next available real IDs\n\n```bash\npython3 .github/skills/mastg-assign-ids/scripts/next_id.py\n```\n\nPrints one line per component type, e.g.:\n\n```txt\nMASTG-APP-0034\nMASTG-BEST-0046\nMASTG-DEMO-0542\nMASTG-KNOW-0132\nMASTG-TECH-0156\nMASTG-TEST-0351\nMASTG-TOOL-0151\n```\n\nIf multiple new components of the same type are introduced in the same PR,\nallocate IDs sequentially: first new file → next_id, second → next_id+1, etc.\n\nSee [scripts/next_id.py](scripts/next_id.py).\n\n### 3. Build the replacement mapping\n\nMap each fake ID to the real ID you just allocated. Record the mapping explicitly before proceeding, e.g.:\n\n```txt\nMASTG-KNOW-0x01 → MASTG-KNOW-0122\nMASTG-KNOW-0x02 → MASTG-KNOW-0123\nMASTG-BEST-0x56 → MASTG-BEST-0045\n```\n\nImportant ordering rules: pass longer/more-specific patterns first (e.g. `0x0a` before `0x01`, `0xXX` before anything else).\n\n### 4. Rename files\n\nUse `git mv` to preserve history:\n\n```bash\ngit mv old-path/MASTG-TYPE-0x01.md new-path/MASTG-TYPE-NNNN.md\n```\n\nFor demos (directory-based IDs):\n\n```bash\ngit mv demos/ios/MASVS-CAT/MASTG-DEMO-0x01 demos/ios/MASVS-CAT/MASTG-DEMO-NNNN\n```\n\n### 5. Replace in-content references\n\nPass `OLD=NEW` pairs as arguments — longer patterns first:\n\n```bash\npython3 .github/skills/mastg-assign-ids/scripts/fix_ids.py \\\n MASTG-KNOW-0x0a=MASTG-KNOW-0131 \\\n MASTG-KNOW-0x01=MASTG-KNOW-0122 \\\n MASTG-BEST-0x56=MASTG-BEST-0045\n```\n\nThis covers frontmatter `id:` fields and `knowledge:` lists automatically (they live in `.md` files). See [scripts/fix_ids.py](scripts/fix_ids.py).\n\n### 6. Verify\n\n```bash\nbash .github/skills/mastg-assign-ids/scripts/verify.sh\npython3 .github/skills/mastg-assign-ids/scripts/next_id.py\n```\n\n`verify.sh` exits 1 if any fake IDs remain. `next_id.py` should now report incremented next IDs. See [scripts/verify.sh](scripts/verify.sh).\n\n### 7. Give the user a summary of the changes\n\nProvide a summary of the ID changes, e.g.:\n\n```md\nID assignments used in this PR:\n\n| Fake ID | Real ID |\n|---------|---------|\n| MASTG-KNOW-0x01 | MASTG-KNOW-0122 |\n| MASTG-KNOW-0x02 | MASTG-KNOW-0123 |\n| MASTG-BEST-0x56 | MASTG-BEST-0045 |\n```\n\n## Component locations\n\n| Type | Files/dirs |\n|------|-----------|\n| MASTG-APP | `apps/*.md` |\n| MASTG-BEST | `best-practices/*.md` |\n| MASTG-DEMO | `demos///MASTG-DEMO-NNNN/` (directory) |\n| MASTG-KNOW | `knowledge///MASTG-KNOW-NNNN.md` |\n| MASTG-TECH | `techniques//MASTG-TECH-NNNN.md` |\n| MASTG-TEST | `tests-beta///MASTG-TEST-NNNN.md` |\n| MASTG-TOOL | `tools//MASTG-TOOL-NNNN.md` |\n\n## Important notes\n\n- Always use `git mv`, never `mv`, so renames are tracked in history.\n- Always scope work to files changed in the current branch. Never touch the whole repo.\n- Exclude `.github/` from all searches and replacements (all scripts do this automatically).\n- The `id:` field in frontmatter must match the filename.\n","tools/index.md":"---\nhide: toc\ntitle: Testing Tools\n---\n\n??? info \"About the tools listed below\"\n\n The OWASP MASTG includes many tools to assist you in executing test cases, allowing you to perform static analysis, dynamic analysis, network interception, etc. These tools are intended to help you perform your own assessments, rather than provide a conclusive result on the security status of an app. It's important to review the output of these tools carefully, as it can contain both false positives and false negatives.\n\n These tools have been tested to work when added, but compatibility may vary depending on your OS version, the device you're testing, or whether you're using a rooted or jailbroken device. Tool functionality may also be affected by specific versions of the rooting/jailbreaking method or the tool itself. OWASP MASTG does not guarantee the functionality of the tools. If you encounter problems, try to search for solutions online or contact the tool owner (e.g. via GitHub Issues).\n\n Before proposing a new tool via GitHub Issues/Pull Requests, please check our [contribution guidelines](../../contributing/index.md#tool-inclusion-disclaimer-for-contributors).\n","tools/android/MASTG-TOOL-0002.md":"---\ntitle: MobSF (Android)\nplatform: android\nsource: https://github.com/MobSF/Mobile-Security-Framework-MobSF\n---\n\nAfter MobSF is done with its analysis, you will receive a one-page overview of all the tests that were executed. The page is split up into multiple sections, giving some first hints on the attack surface of the application.\n\n\n\nThe following is displayed:\n\n- Basic information about the app and its binary file.\n- Some options to:\n - View the `AndroidManifest.xml` file.\n - View the IPC components of the app.\n- Signer certificate.\n- App permissions.\n- A security analysis showing known defects e.g. if the app backups are enabled.\n- List of libraries used by the app binary and list of all files inside the unzipped APK.\n- Malware analysis that checks for malicious URLs.\n\nRefer to [MobSF documentation](https://github.com/MobSF/Mobile-Security-Framework-MobSF/wiki/1.-Documentation \"MobSF documentation\") for more details.\n","tools/android/MASTG-TOOL-0003.md":"---\ntitle: nm (Android)\nplatform: android\nsource: https://ftp.gnu.org/gnu/binutils/\n---\n\nnm is a tool that displays the name list (symbol table) of the given binary. [More information for the Android (GNU)](https://ftp.gnu.org/old-gnu/Manuals/binutils-2.12/html_node/binutils_4.html \"nm -binutils\") version.\n","tools/android/MASTG-TOOL-0001.md":"---\ntitle: Frida (Android)\nplatform: android\nsource: https://github.com/frida/frida\n---\n\nFrida supports interaction with the Android Java runtime through the [Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\"). You'll be able to hook and call both Java and native functions inside the process and its native libraries. Your JavaScript snippets have full access to memory, e.g. to read and/or write any structured data.\n\nHere are some tasks that Frida APIs offer and are relevant or exclusive to Android:\n\n- Instantiate Java objects and call static and non-static class methods ([Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\")).\n- Replace Java method implementations ([Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\")).\n- Enumerate live instances of specific classes by scanning the Java heap ([Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\")).\n- Scan process memory for occurrences of a string ([Memory API](https://www.frida.re/docs/javascript-api/#memory \"Frida - Memory API\")).\n- Intercept native function calls to run your own code at function entry and exit ([Interceptor API](https://www.frida.re/docs/javascript-api/#interceptor \"Frida - Interceptor API\")).\n\nRemember that on Android, you can also benefit from the built-in tools provided when installing Frida, which include the Frida CLI (`frida`), `frida-ps`, `frida-ls-devices`, and `frida-trace`, to name some of them.\n\nFrida is often compared to @MASTG-TOOL-0027 or @MASTG-TOOL-0149. However, this comparison is far from fair, as both frameworks were designed with different goals in mind. This is important to understand as an app security tester so that you can know which framework to use in which situation:\n\n- Frida is standalone. All you need is to run the frida-server binary from a known location in your target Android device (see \"Installing Frida\" below). This means that, in contrast to Xposed, it is not _deep_ installed in the target OS.\n- Reversing an app is an iterative process. As a consequence of the previous point, you obtain a shorter feedback loop when testing, as you don't need to (soft) reboot to apply or simply update your hooks. So you might prefer to use Xposed when implementing more permanent hooks.\n- You may inject and update your Frida JavaScript code on the fly at any point during the runtime of your process (similarly to Cycript on iOS). This way, you can perform the so-called _early instrumentation_ by letting Frida spawn your app, or you may prefer to attach to a running app that you might have brought to a certain state.\n- Frida can handle both Java and native code (JNI), allowing you to modify both of them. This is, unfortunately, a limitation of Xposed, which lacks native code support.\n\n## Installing Frida on Android\n\nIn order to set up Frida on your Android device:\n\n- If your device is not rooted, you can also use Frida. Please refer to @MASTG-TECH-0026.\n- If you have a rooted device, simply follow the [official instructions](https://www.frida.re/docs/android/ \"Frida - Setting up your Android device\") or follow the hints below.\n\nWe assume a rooted device here unless otherwise noted. Download the frida-server binary from the [Frida releases page](https://github.com/frida/frida/releases). Make sure that you download the right frida-server binary for the architecture of your Android device or emulator: x86, x86_64, arm, or arm64. Make sure that the server version (at least the major version number) matches the version of your local Frida installation. PyPI usually installs the latest version of Frida. If you're unsure which version is installed, you can check with the Frida command line tool:\n\n```bash\nfrida --version\n```\n\nOr you can run the following command to automatically detect Frida version and download the right frida-server binary:\n\n```bash\nwget https://github.com/frida/frida/releases/download/$(frida --version)/frida-server-$(frida --version)-android-arm.xz\n```\n\nCopy frida-server to the device and run it:\n\n```bash\nadb push frida-server /data/local/tmp/\nadb shell \"chmod 755 /data/local/tmp/frida-server\"\nadb shell \"su -c /data/local/tmp/frida-server &\" # or if su needs a uid: adb shell \"su 0 /data/local/tmp/frida-server &\"\n```\n\n## Using Frida on Android\n\nWith frida-server running, you should now be able to get a list of running processes with the following command (use the `-U` option to indicate Frida to use a connected USB device or emulator):\n\n```bash\n$ frida-ps -U\n PID Name\n----- --------------------------------------------------------------\n 276 adbd\n 956 android.process.media\n 198 bridgemgrd\n30692 com.android.chrome\n30774 com.android.chrome:privileged_process0\n30747 com.android.chrome:sandboxed\n30834 com.android.chrome:sandboxed\n 3059 com.android.nfc\n 1526 com.android.phone\n17104 com.android.settings\n 1302 com.android.systemui\n(...)\n```\n\nOr restrict the list with the `-Uai` flag combination to get all apps (`-a`) currently installed (`-i`) on the connected USB device (`-U`):\n\n```bash\n$ frida-ps -Uai\n PID Name Identifier\n----- ---------------------------------------- ------------------------------\n 766 Android System android\n30692 Chrome com.android.chrome\n 3520 Contacts Storage com.android.providers.contacts\n - Uncrackable1 sg.vantagepoint.uncrackable1\n - drozer Agent com.mwr.dz\n```\n\nThis will show the names and identifiers of all apps. If they are currently running, it will also show their PIDs. Search for your app in the list and take a note of the PID or its name/identifier. From now on, you'll refer to your app by using one of them. A recommendation is to use the identifiers, as the PIDs will change on each run of the app. For example, let's take `com.android.chrome`. You can use this string now on all Frida tools, e.g. on the Frida CLI, on frida-trace, or from a Python script.\n\n## Tracing Native Libraries with frida-trace\n\nTo trace specific (low-level) library calls, you can use the `frida-trace` command line tool:\n\n```bash\nfrida-trace -U com.android.chrome -i \"open\"\n```\n\nThis generates a little JavaScript in `__handlers__/libc.so/open.js`, which Frida injects into the process. The script traces all calls to the `open` function in `libc.so`. You can modify the generated script according to your needs with Frida [JavaScript API](https://www.frida.re/docs/javascript-api/).\n\nUnfortunately, tracing high-level methods of Java classes is not yet supported (but might be [in the future](https://github.com/frida/frida-python/issues/70 \"Support for tracing high-level methods of Java Classes via patterns\")).\n\n## Frida CLI and the Java API\n\nUse the Frida CLI tool (`frida`) to work with Frida interactively. It hooks into a process and gives you a command-line interface to Frida's API.\n\n```bash\nfrida -U com.android.chrome\n```\n\nWith the `-l` option, you can also use the Frida CLI to load scripts, e.g., to load `myscript.js`:\n\n```bash\nfrida -U -l myscript.js com.android.chrome\n```\n\nFrida also provides a [Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\"), which is especially helpful for dealing with Android apps. It lets you work with Java classes and objects directly. Here is a script to overwrite the `onResume` function of an Activity class:\n\n```java\nJava.perform(function () {\n var Activity = Java.use(\"android.app.Activity\");\n Activity.onResume.implementation = function () {\n console.log(\"[*] onResume() got called!\");\n this.onResume();\n };\n});\n```\n\nThe above script calls `Java.perform` to make sure that your code gets executed in the context of the Java VM. It instantiates a wrapper for the `android.app.Activity` class via `Java.use` and overwrites the `onResume` function. The new `onResume` function implementation prints a notice to the console and calls the original `onResume` method by invoking `this.onResume` every time an activity is resumed in the app.\n\n@MASTG-TOOL-0018 can generate Frida snippets through its graphical code browser. To use this feature, open the APK or DEX with `jadx-gui`, browse to the target method, right-click the method name, and select \"Copy as frida snippet (f)\". For example, using the MASTG @MASTG-APP-0003:\n\n\n\nThe above steps place the following output in the pasteboard, which you can then paste into a JavaScript file and feed into `frida -U -l`.\n\n```javascript\nlet a = Java.use(\"sg.vantagepoint.a.a\");\na[\"a\"].implementation = function (bArr, bArr2) {\n console.log('a is called' + ', ' + 'bArr: ' + bArr + ', ' + 'bArr2: ' + bArr2);\n let ret = this.a(bArr, bArr2);\n console.log('a ret value is ' + ret);\n return ret;\n};\n```\n\nThe above code hooks the `a` method within the `sg.vantagepoint.a.a` class and logs its input parameters and return values.\n\nFrida also lets you search for and work with instantiated objects that are on the heap. The following script searches for instances of `android.view.View` objects and calls their `toString` method. The result is printed to the console:\n\n```java\nsetImmediate(function() {\n console.log(\"[*] Starting script\");\n Java.perform(function () {\n Java.choose(\"android.view.View\", {\n \"onMatch\":function(instance){\n console.log(\"[*] Instance found: \" + instance.toString());\n },\n \"onComplete\":function() {\n console.log(\"[*] Finished heap search\")\n }\n });\n });\n});\n```\n\nThe output would look like this:\n\n```bash\n[*] Starting script\n[*] Instance found: android.view.View{7ccea78 G.ED..... ......ID 0,0-0,0 #7f0c01fc app:id/action_bar_black_background}\n[*] Instance found: android.view.View{2809551 V.ED..... ........ 0,1731-0,1731 #7f0c01ff app:id/menu_anchor_stub}\n[*] Instance found: android.view.View{be471b6 G.ED..... ......I. 0,0-0,0 #7f0c01f5 app:id/location_bar_verbose_status_separator}\n[*] Instance found: android.view.View{3ae0eb7 V.ED..... ........ 0,0-1080,63 #102002f android:id/statusBarBackground}\n[*] Finished heap search\n```\n\nYou can also use Java's reflection capabilities. To list the public methods of the `android.view.View` class, you could create a wrapper for this class in Frida and call `getMethods` from the wrapper's `class` property:\n\n```java\nJava.perform(function () {\n var view = Java.use(\"android.view.View\");\n var methods = view.class.getMethods();\n for(var i = 0; i < methods.length; i++) {\n console.log(methods[i].toString());\n }\n});\n```\n\nThis will print a very long list of methods to the terminal:\n\n```java\npublic boolean android.view.View.canResolveLayoutDirection()\npublic boolean android.view.View.canResolveTextAlignment()\npublic boolean android.view.View.canResolveTextDirection()\npublic boolean android.view.View.canScrollHorizontally(int)\npublic boolean android.view.View.canScrollVertically(int)\npublic final void android.view.View.cancelDragAndDrop()\npublic void android.view.View.cancelLongPress()\npublic final void android.view.View.cancelPendingInputEvents()\n...\n```\n\nFor more practical examples, check out the [Android section in the Frida Handbook](https://learnfrida.info/java/).\n","tools/android/MASTG-TOOL-0004.md":"---\ntitle: adb\nplatform: android\nsource: https://developer.android.com/studio/command-line/adb\n---\n\nadb, shipped with the Android SDK, bridges the gap between your local development environment and a connected Android device. You'll usually leverage it to test apps on the emulator or a connected device via USB or Wi-Fi. Use the `adb devices` command to list the connected devices and execute it with the `-l` argument to retrieve more details on them.\n\n```bash\n$ adb devices -l\nList of devices attached\n090c285c0b97f748 device usb:1-1 product:razor model:Nexus_7 device:flo\nemulator-5554 device product:sdk_google_phone_x86 model:Android_SDK_built_for_x86 device:generic_x86 transport_id:1\n```\n\nadb provides other useful commands, such as `adb shell` to start an interactive shell on a target and `adb forward` to forward traffic on a specific host port to a different port on a connected device.\n\n```bash\nadb forward tcp: tcp:\n```\n\n```bash\n$ adb -s emulator-5554 shell\nroot@generic_x86:/ # ls\nacct\ncache\ncharger\nconfig\n...\n```\n\nYou'll come across different use cases on how you can use adb commands when testing later in this book. Note that you must define the serial number of the target device with the `-s` argument (as shown by the previous code snippet) in case you have multiple devices connected.\n","rules/mastg-android-broken-encryption-algorithms.yaml":"rules:\n - id: mastg-android-broken-encryption-algorithms\n languages:\n - java\n severity: WARNING\n metadata:\n summary: This rule looks for broken encryption algorithms.\n message: \"[MASVS-CRYPTO-1] Broken encryption algorithms found in use.\"\n pattern-regex: Cipher\\.getInstance\\(\"?(DES|DESede|RC4|Blowfish)(/[A-Za-z0-9]+(/[A-Za-z0-9]+)?)?\"?\\)\n","rules/mastg-android-dangerous-app-permissions.yaml":"rules:\n - id: detect-dangerous-android-permissions\n languages:\n - xml\n message: \"Dangerous Android permission found:\"\n severity: WARNING\n pattern-either:\n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n\n","tools/android/MASTG-TOOL-0005.md":"---\ntitle: Android NDK\nplatform: android\nsource: https://developer.android.com/ndk/guides/standalone_toolchain\n---\n\nThe Android NDK contains prebuilt versions of the native compiler and toolchain. Both the GCC and Clang compilers have traditionally been supported, but active support for GCC ended with NDK revision 14. The device architecture and host OS determine the appropriate version. The prebuilt toolchains are in the `toolchains` directory of the NDK, which contains one subdirectory for each architecture.\n\n| Architecture | Toolchain name |\n| --- | --- |\n| ARM-based | arm-linux-androideabi-<gcc-version> |\n| x86-based | x86-<gcc-version> |\n| MIPS-based | mipsel-linux-android-<gcc-version> |\n| ARM64-based | aarch64-linux-android-<gcc-version> |\n| X86-64-based | x86_64-<gcc-version> |\n| MIPS64-based | mips64el-linux-android-<gcc-version> |\n\nBesides picking the right architecture, you need to specify the correct sysroot for the native API level you want to target. The sysroot is a directory that contains the system headers and libraries for your target. Native APIs vary by Android API level. Available sysroot directories for each Android API level can be found in `$NDK/platforms/`. Each API level directory contains subdirectories for the various CPUs and architectures.\n\nOne possibility for setting up the build system is exporting the compiler path and necessary flags as environment variables. To make things easier, however, the NDK allows you to create a so-called standalone toolchain, which is a temporary toolchain that incorporates the required settings.\n\nTo set up a standalone toolchain, download the [latest stable version of the NDK](https://developer.android.com/ndk/downloads/index.html#stable-downloads \"Android NDK Downloads\"). Extract the ZIP file, change into the NDK root directory, and run the following command:\n\n```bash\n./build/tools/make_standalone_toolchain.py --arch arm --api 24 --install-dir /tmp/android-7-toolchain\n```\n\nThis creates a standalone toolchain for Android 7.0 (API level 24) in the directory `/tmp/android-7-toolchain`. For convenience, you can export an environment variable that points to your toolchain directory (we'll be using this in the examples). Run the following command or add it to your `.bash_profile` or other startup script:\n\n```bash\nexport TOOLCHAIN=/tmp/android-7-toolchain\n```\n","tools/android/MASTG-TOOL-0006.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0006.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0006.md)","tools/android/MASTG-TOOL-0007.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0007.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0007.md)","tools/android/MASTG-TOOL-0008.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0008.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0008.md)","tools/android/MASTG-TOOL-0009.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0009.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0009.md)","tools/android/MASTG-TOOL-0010.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0010.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0010.md)","tools/android/MASTG-TOOL-0011.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0011.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0011.md)","tools/android/MASTG-TOOL-0012.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0012.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0012.md)","tools/android/MASTG-TOOL-0013.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0013.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0013.md)","tools/android/MASTG-TOOL-0014.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0014.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0014.md)","tools/android/MASTG-TOOL-0015.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0015.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0015.md)","tools/android/MASTG-TOOL-0016.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0016.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0016.md)","tools/android/MASTG-TOOL-0017.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0017.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0017.md)","tools/android/MASTG-TOOL-0018.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0018.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0018.md)","tools/android/MASTG-TOOL-0019.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0019.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0019.md)","tools/android/MASTG-TOOL-0020.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0020.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0020.md)","tools/android/MASTG-TOOL-0021.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0021.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0021.md)","tools/android/MASTG-TOOL-0022.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0022.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0022.md)","tools/android/MASTG-TOOL-0023.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0023.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0023.md)","tools/android/MASTG-TOOL-0024.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0024.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0024.md)","tools/android/MASTG-TOOL-0025.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0025.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0025.md)","tools/android/MASTG-TOOL-0026.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0026.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0026.md)","tools/android/MASTG-TOOL-0027.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0027.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0027.md)","tools/android/MASTG-TOOL-0028.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0028.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0028.md)","tools/android/MASTG-TOOL-0029.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0029.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0029.md)","tools/android/MASTG-TOOL-0030.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0030.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0030.md)","tools/android/MASTG-TOOL-0099.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0099.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0099.md)","tools/android/MASTG-TOOL-0103.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0103.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0103.md)","tools/android/MASTG-TOOL-0107.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0107.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0107.md)","tools/android/MASTG-TOOL-0112.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0112.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0112.md)","tools/android/MASTG-TOOL-0116.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0116.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0116.md)","tools/android/MASTG-TOOL-0120.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0120.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0120.md)","tools/android/MASTG-TOOL-0123.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0123.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0123.md)","tools/android/MASTG-TOOL-0124.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0124.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0124.md)","tools/android/MASTG-TOOL-0125.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0125.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0125.md)","tools/android/MASTG-TOOL-0130.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0130.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0130.md)","tools/android/MASTG-TOOL-0140.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0140.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0140.md)","tools/android/MASTG-TOOL-0146.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0146.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0146.md)","tools/android/MASTG-TOOL-0147.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0147.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0147.md)","tools/android/MASTG-TOOL-0148.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0148.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0148.md)","tools/android/MASTG-TOOL-0149.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0149.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0149.md)","tools/android/MASTG-TOOL-0151.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0151.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0151.md)","tools/android/MASTG-TOOL-0152.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0152.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0152.md)","tools/android/MASTG-TOOL-0153.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0153.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0153.md)","tools/generic/MASTG-TOOL-0031.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0031.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0031.md)","tools/generic/MASTG-TOOL-0032.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0032.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0032.md)","tools/generic/MASTG-TOOL-0033.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0033.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0033.md)","tools/generic/MASTG-TOOL-0034.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0034.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0034.md)","tools/generic/MASTG-TOOL-0035.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0035.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0035.md)","tools/generic/MASTG-TOOL-0036.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0036.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0036.md)","tools/generic/MASTG-TOOL-0037.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0037.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0037.md)","tools/generic/MASTG-TOOL-0038.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0038.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0038.md)","tools/generic/MASTG-TOOL-0098.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0098.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0098.md)","tools/generic/MASTG-TOOL-0100.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0100.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0100.md)","tools/generic/MASTG-TOOL-0101.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0101.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0101.md)","tools/generic/MASTG-TOOL-0104.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0104.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0104.md)","tools/generic/MASTG-TOOL-0106.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0106.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0106.md)","tools/generic/MASTG-TOOL-0108.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0108.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0108.md)","tools/generic/MASTG-TOOL-0110.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0110.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0110.md)","tools/generic/MASTG-TOOL-0129.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0129.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0129.md)","tools/generic/MASTG-TOOL-0131.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0131.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0131.md)","tools/generic/MASTG-TOOL-0132.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0132.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0132.md)","tools/generic/MASTG-TOOL-0133.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0133.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0133.md)","tools/generic/MASTG-TOOL-0134.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0134.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0134.md)","tools/generic/MASTG-TOOL-0144.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0144.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0144.md)","tools/generic/MASTG-TOOL-0145.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0145.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0145.md)","tools/ios/MASTG-TOOL-0039.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0039.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0039.md)","tools/ios/MASTG-TOOL-0040.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0040.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0040.md)","tools/ios/MASTG-TOOL-0041.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0041.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0041.md)","tools/ios/MASTG-TOOL-0042.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0042.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0042.md)","tools/ios/MASTG-TOOL-0043.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0043.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0043.md)","tools/ios/MASTG-TOOL-0044.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0044.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0044.md)","tools/ios/MASTG-TOOL-0045.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0045.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0045.md)","tools/ios/MASTG-TOOL-0046.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0046.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0046.md)","tools/ios/MASTG-TOOL-0047.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0047.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0047.md)","tools/ios/MASTG-TOOL-0048.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0048.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0048.md)","tools/ios/MASTG-TOOL-0049.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0049.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0049.md)","tools/ios/MASTG-TOOL-0050.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0050.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0050.md)","tools/ios/MASTG-TOOL-0051.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0051.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0051.md)","tools/ios/MASTG-TOOL-0053.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0053.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0053.md)","tools/ios/MASTG-TOOL-0054.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0054.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0054.md)","tools/ios/MASTG-TOOL-0055.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0055.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0055.md)","tools/ios/MASTG-TOOL-0056.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0056.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0056.md)","tools/ios/MASTG-TOOL-0057.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0057.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0057.md)","tools/ios/MASTG-TOOL-0058.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0058.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0058.md)","tools/ios/MASTG-TOOL-0059.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0059.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0059.md)","tools/ios/MASTG-TOOL-0060.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0060.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0060.md)","tools/ios/MASTG-TOOL-0061.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0061.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0061.md)","tools/ios/MASTG-TOOL-0062.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0062.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0062.md)","tools/ios/MASTG-TOOL-0063.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0063.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0063.md)","tools/ios/MASTG-TOOL-0064.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0064.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0064.md)","tools/ios/MASTG-TOOL-0065.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0065.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0065.md)","tools/ios/MASTG-TOOL-0066.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0066.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0066.md)","tools/ios/MASTG-TOOL-0067.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0067.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0067.md)","tools/ios/MASTG-TOOL-0068.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0068.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0068.md)","tools/ios/MASTG-TOOL-0069.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0069.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0069.md)","tools/ios/MASTG-TOOL-0070.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0070.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0070.md)","tools/ios/MASTG-TOOL-0071.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0071.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0071.md)","tools/ios/MASTG-TOOL-0072.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0072.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0072.md)","tools/ios/MASTG-TOOL-0073.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0073.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0073.md)","tools/ios/MASTG-TOOL-0074.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0074.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0074.md)","tools/ios/MASTG-TOOL-0102.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0102.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0102.md)","tools/ios/MASTG-TOOL-0105.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0105.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0105.md)","tools/ios/MASTG-TOOL-0111.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0111.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0111.md)","tools/ios/MASTG-TOOL-0114.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0114.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0114.md)","tools/ios/MASTG-TOOL-0117.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0117.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0117.md)","tools/ios/MASTG-TOOL-0118.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0118.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0118.md)","tools/ios/MASTG-TOOL-0121.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0121.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0121.md)","tools/ios/MASTG-TOOL-0122.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0122.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0122.md)","tools/ios/MASTG-TOOL-0126.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0126.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0126.md)","tools/ios/MASTG-TOOL-0127.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0127.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0127.md)","tools/ios/MASTG-TOOL-0128.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0128.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0128.md)","tools/ios/MASTG-TOOL-0135.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0135.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0135.md)","tools/ios/MASTG-TOOL-0136.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0136.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0136.md)","tools/ios/MASTG-TOOL-0137.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0137.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0137.md)","tools/ios/MASTG-TOOL-0138.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0138.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0138.md)","tools/ios/MASTG-TOOL-0139.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0139.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0139.md)","tools/ios/MASTG-TOOL-0141.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0141.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0141.md)","tools/ios/MASTG-TOOL-0142.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0142.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0142.md)","tools/ios/MASTG-TOOL-0150.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0150.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0150.md)","tools/network/MASTG-TOOL-0075.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0075.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0075.md)","tools/network/MASTG-TOOL-0076.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0076.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0076.md)","tools/network/MASTG-TOOL-0077.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0077.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0077.md)","tools/network/MASTG-TOOL-0078.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0078.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0078.md)","tools/network/MASTG-TOOL-0079.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0079.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0079.md)","tools/network/MASTG-TOOL-0080.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0080.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0080.md)","tools/network/MASTG-TOOL-0081.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0081.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0081.md)","tools/network/MASTG-TOOL-0097.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0097.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0097.md)","tools/network/MASTG-TOOL-0109.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0109.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0109.md)","tools/network/MASTG-TOOL-0115.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0115.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0115.md)","tools/network/MASTG-TOOL-0143.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0143.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0143.md)"},"files":{"rules/mastg-android-broken-encryption-modes.yaml":"rules:\n - id: mastg-android-broken-encryption-modes\n languages:\n - java\n severity: WARNING\n metadata:\n summary: This rule looks for broken encryption modes.\n message: \"[MASVS-CRYPTO-1] Broken encryption modes found in use.\"\n pattern-either:\n - pattern: Cipher.getInstance(\"AES\")\n - pattern-regex: Cipher\\.getInstance\\(\"?[A-Za-z0-9]+/ECB(/[A-Za-z0-9]+)?\"?\\)\n\n \n","rules/mastg-android-root-detection.yaml":"rules:\n - id: mastg-android-root-detection-file-checks\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of file existence checks commonly used for root detection\n message: \"[MASVS-RESILIENCE-1] The app checks for file existence, which may be part of root detection implementation.\"\n pattern: new File($PATH).exists()\n metavariable-regex:\n metavariable: $PATH\n regex: '.*(su|magisk|Superuser\\.apk).*'\n\n - id: mastg-android-root-detection-package-check\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of package manager checks that may be used for root detection\n message: \"[MASVS-RESILIENCE-1] The app checks for installed packages, which may be looking for root management apps.\"\n pattern: $PM.getPackageInfo($PKG, ...)\n\n - id: mastg-android-root-detection-test-keys\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of test-keys build check for root/custom ROM detection\n message: \"[MASVS-RESILIENCE-1] The app checks Build.TAGS for test-keys, indicating custom ROM or root detection.\"\n pattern-either:\n - pattern: Build.TAGS.contains(\"test-keys\")\n - patterns:\n - pattern: $TAGS.contains(\"test-keys\")\n - pattern-inside: |\n $TAGS = Build.TAGS;\n ...\n - patterns:\n - pattern: StringsKt.contains$default(..., \"test-keys\", ...)\n - pattern-inside: |\n $TAGS = Build.TAGS;\n ...\n\n - id: mastg-android-root-detection-system-properties\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of system property checks via getprop\n message: \"[MASVS-RESILIENCE-1] The app reads system properties via getprop, which may be checking for root indicators.\"\n pattern-either:\n - pattern: Runtime.getRuntime().exec(\"getprop \" + $PROP)\n - pattern: Runtime.getRuntime().exec(new String[] { \"getprop\", $PROP })\n\n - id: mastg-android-root-detection-runtime-exec\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of Runtime.exec calls that may be used for root detection\n message: \"[MASVS-RESILIENCE-1] The app uses Runtime.exec(), which may be attempting to execute su or other commands for root detection.\"\n patterns:\n - pattern: Runtime.getRuntime().exec($CMD)\n - pattern-not: Runtime.getRuntime().exec(\"getprop \" + $PROP)\n - pattern-not: Runtime.getRuntime().exec(new String[] { \"getprop\", $PROP })\n","rules/mastg-android-hardcoded-security-provider.yaml":"rules:\n - id: mastg-android-hardcoded-security-provider\n languages:\n - java\n severity: WARNING\n metadata:\n summary: This rule looks for explicitly specified security providers in getInstance calls.\n message: \"[MASVS-CRYPTO-1] Explicitly specified security provider found. Do not hardcode a provider unless using AndroidKeyStore.\"\n patterns:\n - pattern-either:\n - pattern: $X.getInstance($ALGO, $PROVIDER)\n - pattern: $X.getInstance($ALGO, (String $PROVIDER))\n - pattern: $X.getInstance($ALGO, (java.security.Provider $PROVIDER))\n - pattern-not: KeyStore.getInstance(\"AndroidKeyStore\")\n - metavariable-regex:\n metavariable: $X\n regex: (Cipher|KeyGenerator|KeyPairGenerator|MessageDigest|Signature|Mac|SecretKeyFactory|KeyFactory|SecureRandom|KeyAgreement|AlgorithmParameters|AlgorithmParameterGenerator|CertificateFactory|CertPathBuilder|CertPathValidator|CertStore|KeyStore)\n\n",".github/skills/mastg-assign-ids/SKILL.md":"---\nname: mastg-assign-ids\ndescription: Assign real MASTG IDs to draft files that use fake placeholder IDs (e.g. MASTG-KNOW-0x01, MASTG-BEST-0x56). Use when finishing a PR that introduces new MASTG components with placeholder IDs, or when asked to \"fix fake IDs\", \"assign real IDs\", or \"use next available IDs\". Runs next_id.py to get the correct next IDs, renames all affected files, and replaces all in-content references.\n---\n\n# MASTG Assign IDs\n\nReplace all fake/placeholder component IDs (e.g. `MASTG-KNOW-0x01`, `MASTG-BEST-0x56`) with the next real sequential IDs across file names and file contents.\n\n## When to use\n\n- A PR adds new MASTG components using `0x##` placeholder IDs\n- You are asked to \"fix fake IDs\", \"assign real IDs\", or \"use next available IDs\"\n\n## Fake-ID convention\n\nNew draft items use the pattern `MASTG-TYPE-0x##` (hex suffix, e.g. `0x01`, `0x0a`).\nReal IDs use zero-padded 4-digit decimal: `MASTG-TYPE-NNNN` (e.g. `MASTG-KNOW-0122`).\n\n**Non-standard fake IDs**: Some draft items may use a different convention that is NOT caught by the `0x##` pattern — for example `MASTG-BEST-00ea` (lowercase hex digits without the `0x` prefix). These are still fake IDs and must be replaced. After running `find_fakes.sh`, manually scan the `git diff --name-only origin/master...HEAD` output for any ID-like suffix that contains lowercase letters (`a`–`f`) or is not exactly 4 decimal digits.\n\n## Step-by-step workflow\n\nAll scripts are in `scripts/` relative to this skill. Run from the repository root.\n\n### 1. Find all fake-ID files in the current branch\n\n```bash\nbash .github/skills/mastg-assign-ids/scripts/find_fakes.sh\n```\n\nSee [scripts/find_fakes.sh](scripts/find_fakes.sh).\n\n### 2. Get the next available real IDs\n\n```bash\npython3 .github/skills/mastg-assign-ids/scripts/next_id.py\n```\n\nPrints one line per component type, e.g.:\n\n```txt\nMASTG-APP-0034\nMASTG-BEST-0046\nMASTG-DEMO-0542\nMASTG-KNOW-0132\nMASTG-TECH-0156\nMASTG-TEST-0351\nMASTG-TOOL-0151\n```\n\nIf multiple new components of the same type are introduced in the same PR,\nallocate IDs sequentially: first new file → next_id, second → next_id+1, etc.\n\nSee [scripts/next_id.py](scripts/next_id.py).\n\n### 3. Build the replacement mapping\n\nMap each fake ID to the real ID you just allocated. Record the mapping explicitly before proceeding, e.g.:\n\n```txt\nMASTG-KNOW-0x01 → MASTG-KNOW-0122\nMASTG-KNOW-0x02 → MASTG-KNOW-0123\nMASTG-BEST-0x56 → MASTG-BEST-0045\n```\n\nImportant ordering rules: pass longer/more-specific patterns first (e.g. `0x0a` before `0x01`, `0xXX` before anything else).\n\n### 4. Rename files\n\nUse `git mv` to preserve history:\n\n```bash\ngit mv old-path/MASTG-TYPE-0x01.md new-path/MASTG-TYPE-NNNN.md\n```\n\nFor demos (directory-based IDs):\n\n```bash\ngit mv demos/ios/MASVS-CAT/MASTG-DEMO-0x01 demos/ios/MASVS-CAT/MASTG-DEMO-NNNN\n```\n\n### 5. Replace in-content references\n\nPass `OLD=NEW` pairs as arguments — longer patterns first:\n\n```bash\npython3 .github/skills/mastg-assign-ids/scripts/fix_ids.py \\\n MASTG-KNOW-0x0a=MASTG-KNOW-0131 \\\n MASTG-KNOW-0x01=MASTG-KNOW-0122 \\\n MASTG-BEST-0x56=MASTG-BEST-0045\n```\n\nThis covers frontmatter `id:` fields and `knowledge:` lists automatically (they live in `.md` files). See [scripts/fix_ids.py](scripts/fix_ids.py).\n\n### 6. Verify\n\n```bash\nbash .github/skills/mastg-assign-ids/scripts/verify.sh\npython3 .github/skills/mastg-assign-ids/scripts/next_id.py\n```\n\n`verify.sh` exits 1 if any fake IDs remain. `next_id.py` should now report incremented next IDs. See [scripts/verify.sh](scripts/verify.sh).\n\n### 7. Give the user a summary of the changes\n\nProvide a summary of the ID changes, e.g.:\n\n```md\nID assignments used in this PR:\n\n| Fake ID | Real ID |\n|---------|---------|\n| MASTG-KNOW-0x01 | MASTG-KNOW-0122 |\n| MASTG-KNOW-0x02 | MASTG-KNOW-0123 |\n| MASTG-BEST-0x56 | MASTG-BEST-0045 |\n```\n\n## Component locations\n\n| Type | Files/dirs |\n|------|-----------|\n| MASTG-APP | `apps/*.md` |\n| MASTG-BEST | `best-practices/*.md` |\n| MASTG-DEMO | `demos///MASTG-DEMO-NNNN/` (directory) |\n| MASTG-KNOW | `knowledge///MASTG-KNOW-NNNN.md` |\n| MASTG-TECH | `techniques//MASTG-TECH-NNNN.md` |\n| MASTG-TEST | `tests-beta///MASTG-TEST-NNNN.md` |\n| MASTG-TOOL | `tools//MASTG-TOOL-NNNN.md` |\n\n## Important notes\n\n- Always use `git mv`, never `mv`, so renames are tracked in history.\n- Always scope work to files changed in the current branch. Never touch the whole repo.\n- Exclude `.github/` from all searches and replacements (all scripts do this automatically).\n- The `id:` field in frontmatter must match the filename.\n","tools/index.md":"---\nhide: toc\ntitle: Testing Tools\n---\n\n??? info \"About the tools listed below\"\n\n The OWASP MASTG includes many tools to assist you in executing test cases, allowing you to perform static analysis, dynamic analysis, network interception, etc. These tools are intended to help you perform your own assessments, rather than provide a conclusive result on the security status of an app. It's important to review the output of these tools carefully, as it can contain both false positives and false negatives.\n\n These tools have been tested to work when added, but compatibility may vary depending on your OS version, the device you're testing, or whether you're using a rooted or jailbroken device. Tool functionality may also be affected by specific versions of the rooting/jailbreaking method or the tool itself. OWASP MASTG does not guarantee the functionality of the tools. If you encounter problems, try to search for solutions online or contact the tool owner (e.g. via GitHub Issues).\n\n Before proposing a new tool via GitHub Issues/Pull Requests, please check our [contribution guidelines](../../contributing/index.md#tool-inclusion-disclaimer-for-contributors).\n","tools/android/MASTG-TOOL-0002.md":"---\ntitle: MobSF (Android)\nplatform: android\nsource: https://github.com/MobSF/Mobile-Security-Framework-MobSF\n---\n\nAfter MobSF is done with its analysis, you will receive a one-page overview of all the tests that were executed. The page is split up into multiple sections, giving some first hints on the attack surface of the application.\n\n\n\nThe following is displayed:\n\n- Basic information about the app and its binary file.\n- Some options to:\n - View the `AndroidManifest.xml` file.\n - View the IPC components of the app.\n- Signer certificate.\n- App permissions.\n- A security analysis showing known defects e.g. if the app backups are enabled.\n- List of libraries used by the app binary and list of all files inside the unzipped APK.\n- Malware analysis that checks for malicious URLs.\n\nRefer to [MobSF documentation](https://github.com/MobSF/Mobile-Security-Framework-MobSF/wiki/1.-Documentation \"MobSF documentation\") for more details.\n","tools/android/MASTG-TOOL-0003.md":"---\ntitle: nm (Android)\nplatform: android\nsource: https://ftp.gnu.org/gnu/binutils/\n---\n\nnm is a tool that displays the name list (symbol table) of the given binary. [More information for the Android (GNU)](https://ftp.gnu.org/old-gnu/Manuals/binutils-2.12/html_node/binutils_4.html \"nm -binutils\") version.\n","tools/android/MASTG-TOOL-0001.md":"---\ntitle: Frida (Android)\nplatform: android\nsource: https://github.com/frida/frida\n---\n\nFrida supports interaction with the Android Java runtime through the [Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\"). You'll be able to hook and call both Java and native functions inside the process and its native libraries. Your JavaScript snippets have full access to memory, e.g. to read and/or write any structured data.\n\nHere are some tasks that Frida APIs offer and are relevant or exclusive to Android:\n\n- Instantiate Java objects and call static and non-static class methods ([Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\")).\n- Replace Java method implementations ([Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\")).\n- Enumerate live instances of specific classes by scanning the Java heap ([Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\")).\n- Scan process memory for occurrences of a string ([Memory API](https://www.frida.re/docs/javascript-api/#memory \"Frida - Memory API\")).\n- Intercept native function calls to run your own code at function entry and exit ([Interceptor API](https://www.frida.re/docs/javascript-api/#interceptor \"Frida - Interceptor API\")).\n\nRemember that on Android, you can also benefit from the built-in tools provided when installing Frida, which include the Frida CLI (`frida`), `frida-ps`, `frida-ls-devices`, and `frida-trace`, to name some of them.\n\nFrida is often compared to @MASTG-TOOL-0027 or @MASTG-TOOL-0149. However, this comparison is far from fair, as both frameworks were designed with different goals in mind. This is important to understand as an app security tester so that you can know which framework to use in which situation:\n\n- Frida is standalone. All you need is to run the frida-server binary from a known location in your target Android device (see \"Installing Frida\" below). This means that, in contrast to Xposed, it is not _deep_ installed in the target OS.\n- Reversing an app is an iterative process. As a consequence of the previous point, you obtain a shorter feedback loop when testing, as you don't need to (soft) reboot to apply or simply update your hooks. So you might prefer to use Xposed when implementing more permanent hooks.\n- You may inject and update your Frida JavaScript code on the fly at any point during the runtime of your process (similarly to Cycript on iOS). This way, you can perform the so-called _early instrumentation_ by letting Frida spawn your app, or you may prefer to attach to a running app that you might have brought to a certain state.\n- Frida can handle both Java and native code (JNI), allowing you to modify both of them. This is, unfortunately, a limitation of Xposed, which lacks native code support.\n\n## Installing Frida on Android\n\nIn order to set up Frida on your Android device:\n\n- If your device is not rooted, you can also use Frida. Please refer to @MASTG-TECH-0026.\n- If you have a rooted device, simply follow the [official instructions](https://www.frida.re/docs/android/ \"Frida - Setting up your Android device\") or follow the hints below.\n\nWe assume a rooted device here unless otherwise noted. Download the frida-server binary from the [Frida releases page](https://github.com/frida/frida/releases). Make sure that you download the right frida-server binary for the architecture of your Android device or emulator: x86, x86_64, arm, or arm64. Make sure that the server version (at least the major version number) matches the version of your local Frida installation. PyPI usually installs the latest version of Frida. If you're unsure which version is installed, you can check with the Frida command line tool:\n\n```bash\nfrida --version\n```\n\nOr you can run the following command to automatically detect Frida version and download the right frida-server binary:\n\n```bash\nwget https://github.com/frida/frida/releases/download/$(frida --version)/frida-server-$(frida --version)-android-arm.xz\n```\n\nCopy frida-server to the device and run it:\n\n```bash\nadb push frida-server /data/local/tmp/\nadb shell \"chmod 755 /data/local/tmp/frida-server\"\nadb shell \"su -c /data/local/tmp/frida-server &\" # or if su needs a uid: adb shell \"su 0 /data/local/tmp/frida-server &\"\n```\n\n## Using Frida on Android\n\nWith frida-server running, you should now be able to get a list of running processes with the following command (use the `-U` option to indicate Frida to use a connected USB device or emulator):\n\n```bash\n$ frida-ps -U\n PID Name\n----- --------------------------------------------------------------\n 276 adbd\n 956 android.process.media\n 198 bridgemgrd\n30692 com.android.chrome\n30774 com.android.chrome:privileged_process0\n30747 com.android.chrome:sandboxed\n30834 com.android.chrome:sandboxed\n 3059 com.android.nfc\n 1526 com.android.phone\n17104 com.android.settings\n 1302 com.android.systemui\n(...)\n```\n\nOr restrict the list with the `-Uai` flag combination to get all apps (`-a`) currently installed (`-i`) on the connected USB device (`-U`):\n\n```bash\n$ frida-ps -Uai\n PID Name Identifier\n----- ---------------------------------------- ------------------------------\n 766 Android System android\n30692 Chrome com.android.chrome\n 3520 Contacts Storage com.android.providers.contacts\n - Uncrackable1 sg.vantagepoint.uncrackable1\n - drozer Agent com.mwr.dz\n```\n\nThis will show the names and identifiers of all apps. If they are currently running, it will also show their PIDs. Search for your app in the list and take a note of the PID or its name/identifier. From now on, you'll refer to your app by using one of them. A recommendation is to use the identifiers, as the PIDs will change on each run of the app. For example, let's take `com.android.chrome`. You can use this string now on all Frida tools, e.g. on the Frida CLI, on frida-trace, or from a Python script.\n\n## Tracing Native Libraries with frida-trace\n\nTo trace specific (low-level) library calls, you can use the `frida-trace` command line tool:\n\n```bash\nfrida-trace -U com.android.chrome -i \"open\"\n```\n\nThis generates a little JavaScript in `__handlers__/libc.so/open.js`, which Frida injects into the process. The script traces all calls to the `open` function in `libc.so`. You can modify the generated script according to your needs with Frida [JavaScript API](https://www.frida.re/docs/javascript-api/).\n\nUnfortunately, tracing high-level methods of Java classes is not yet supported (but might be [in the future](https://github.com/frida/frida-python/issues/70 \"Support for tracing high-level methods of Java Classes via patterns\")).\n\n## Frida CLI and the Java API\n\nUse the Frida CLI tool (`frida`) to work with Frida interactively. It hooks into a process and gives you a command-line interface to Frida's API.\n\n```bash\nfrida -U com.android.chrome\n```\n\nWith the `-l` option, you can also use the Frida CLI to load scripts, e.g., to load `myscript.js`:\n\n```bash\nfrida -U -l myscript.js com.android.chrome\n```\n\nFrida also provides a [Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\"), which is especially helpful for dealing with Android apps. It lets you work with Java classes and objects directly. Here is a script to overwrite the `onResume` function of an Activity class:\n\n```java\nJava.perform(function () {\n var Activity = Java.use(\"android.app.Activity\");\n Activity.onResume.implementation = function () {\n console.log(\"[*] onResume() got called!\");\n this.onResume();\n };\n});\n```\n\nThe above script calls `Java.perform` to make sure that your code gets executed in the context of the Java VM. It instantiates a wrapper for the `android.app.Activity` class via `Java.use` and overwrites the `onResume` function. The new `onResume` function implementation prints a notice to the console and calls the original `onResume` method by invoking `this.onResume` every time an activity is resumed in the app.\n\n@MASTG-TOOL-0018 can generate Frida snippets through its graphical code browser. To use this feature, open the APK or DEX with `jadx-gui`, browse to the target method, right-click the method name, and select \"Copy as frida snippet (f)\". For example, using the MASTG @MASTG-APP-0003:\n\n\n\nThe above steps place the following output in the pasteboard, which you can then paste into a JavaScript file and feed into `frida -U -l`.\n\n```javascript\nlet a = Java.use(\"sg.vantagepoint.a.a\");\na[\"a\"].implementation = function (bArr, bArr2) {\n console.log('a is called' + ', ' + 'bArr: ' + bArr + ', ' + 'bArr2: ' + bArr2);\n let ret = this.a(bArr, bArr2);\n console.log('a ret value is ' + ret);\n return ret;\n};\n```\n\nThe above code hooks the `a` method within the `sg.vantagepoint.a.a` class and logs its input parameters and return values.\n\nFrida also lets you search for and work with instantiated objects that are on the heap. The following script searches for instances of `android.view.View` objects and calls their `toString` method. The result is printed to the console:\n\n```java\nsetImmediate(function() {\n console.log(\"[*] Starting script\");\n Java.perform(function () {\n Java.choose(\"android.view.View\", {\n \"onMatch\":function(instance){\n console.log(\"[*] Instance found: \" + instance.toString());\n },\n \"onComplete\":function() {\n console.log(\"[*] Finished heap search\")\n }\n });\n });\n});\n```\n\nThe output would look like this:\n\n```bash\n[*] Starting script\n[*] Instance found: android.view.View{7ccea78 G.ED..... ......ID 0,0-0,0 #7f0c01fc app:id/action_bar_black_background}\n[*] Instance found: android.view.View{2809551 V.ED..... ........ 0,1731-0,1731 #7f0c01ff app:id/menu_anchor_stub}\n[*] Instance found: android.view.View{be471b6 G.ED..... ......I. 0,0-0,0 #7f0c01f5 app:id/location_bar_verbose_status_separator}\n[*] Instance found: android.view.View{3ae0eb7 V.ED..... ........ 0,0-1080,63 #102002f android:id/statusBarBackground}\n[*] Finished heap search\n```\n\nYou can also use Java's reflection capabilities. To list the public methods of the `android.view.View` class, you could create a wrapper for this class in Frida and call `getMethods` from the wrapper's `class` property:\n\n```java\nJava.perform(function () {\n var view = Java.use(\"android.view.View\");\n var methods = view.class.getMethods();\n for(var i = 0; i < methods.length; i++) {\n console.log(methods[i].toString());\n }\n});\n```\n\nThis will print a very long list of methods to the terminal:\n\n```java\npublic boolean android.view.View.canResolveLayoutDirection()\npublic boolean android.view.View.canResolveTextAlignment()\npublic boolean android.view.View.canResolveTextDirection()\npublic boolean android.view.View.canScrollHorizontally(int)\npublic boolean android.view.View.canScrollVertically(int)\npublic final void android.view.View.cancelDragAndDrop()\npublic void android.view.View.cancelLongPress()\npublic final void android.view.View.cancelPendingInputEvents()\n...\n```\n\nFor more practical examples, check out the [Android section in the Frida Handbook](https://learnfrida.info/java/).\n","tools/android/MASTG-TOOL-0004.md":"---\ntitle: adb\nplatform: android\nsource: https://developer.android.com/studio/command-line/adb\n---\n\nadb, shipped with the Android SDK, bridges the gap between your local development environment and a connected Android device. You'll usually leverage it to test apps on the emulator or a connected device via USB or Wi-Fi. Use the `adb devices` command to list the connected devices and execute it with the `-l` argument to retrieve more details on them.\n\n```bash\n$ adb devices -l\nList of devices attached\n090c285c0b97f748 device usb:1-1 product:razor model:Nexus_7 device:flo\nemulator-5554 device product:sdk_google_phone_x86 model:Android_SDK_built_for_x86 device:generic_x86 transport_id:1\n```\n\nadb provides other useful commands, such as `adb shell` to start an interactive shell on a target and `adb forward` to forward traffic on a specific host port to a different port on a connected device.\n\n```bash\nadb forward tcp: tcp:\n```\n\n```bash\n$ adb -s emulator-5554 shell\nroot@generic_x86:/ # ls\nacct\ncache\ncharger\nconfig\n...\n```\n\nYou'll come across different use cases on how you can use adb commands when testing later in this book. Note that you must define the serial number of the target device with the `-s` argument (as shown by the previous code snippet) in case you have multiple devices connected.\n","rules/mastg-android-broken-encryption-algorithms.yaml":"rules:\n - id: mastg-android-broken-encryption-algorithms\n languages:\n - java\n severity: WARNING\n metadata:\n summary: This rule looks for broken encryption algorithms.\n message: \"[MASVS-CRYPTO-1] Broken encryption algorithms found in use.\"\n pattern-regex: Cipher\\.getInstance\\(\"?(DES|DESede|RC4|Blowfish)(/[A-Za-z0-9]+(/[A-Za-z0-9]+)?)?\"?\\)\n","rules/mastg-android-dangerous-app-permissions.yaml":"rules:\n - id: detect-dangerous-android-permissions\n languages:\n - xml\n message: \"Dangerous Android permission found:\"\n severity: WARNING\n pattern-either:\n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n\n","tools/android/MASTG-TOOL-0005.md":"---\ntitle: Android NDK\nplatform: android\nsource: https://developer.android.com/ndk/guides/standalone_toolchain\n---\n\nThe Android NDK contains prebuilt versions of the native compiler and toolchain. Both the GCC and Clang compilers have traditionally been supported, but active support for GCC ended with NDK revision 14. The device architecture and host OS determine the appropriate version. The prebuilt toolchains are in the `toolchains` directory of the NDK, which contains one subdirectory for each architecture.\n\n| Architecture | Toolchain name |\n| --- | --- |\n| ARM-based | arm-linux-androideabi-<gcc-version> |\n| x86-based | x86-<gcc-version> |\n| MIPS-based | mipsel-linux-android-<gcc-version> |\n| ARM64-based | aarch64-linux-android-<gcc-version> |\n| X86-64-based | x86_64-<gcc-version> |\n| MIPS64-based | mips64el-linux-android-<gcc-version> |\n\nBesides picking the right architecture, you need to specify the correct sysroot for the native API level you want to target. The sysroot is a directory that contains the system headers and libraries for your target. Native APIs vary by Android API level. Available sysroot directories for each Android API level can be found in `$NDK/platforms/`. Each API level directory contains subdirectories for the various CPUs and architectures.\n\nOne possibility for setting up the build system is exporting the compiler path and necessary flags as environment variables. To make things easier, however, the NDK allows you to create a so-called standalone toolchain, which is a temporary toolchain that incorporates the required settings.\n\nTo set up a standalone toolchain, download the [latest stable version of the NDK](https://developer.android.com/ndk/downloads/index.html#stable-downloads \"Android NDK Downloads\"). Extract the ZIP file, change into the NDK root directory, and run the following command:\n\n```bash\n./build/tools/make_standalone_toolchain.py --arch arm --api 24 --install-dir /tmp/android-7-toolchain\n```\n\nThis creates a standalone toolchain for Android 7.0 (API level 24) in the directory `/tmp/android-7-toolchain`. For convenience, you can export an environment variable that points to your toolchain directory (we'll be using this in the examples). Run the following command or add it to your `.bash_profile` or other startup script:\n\n```bash\nexport TOOLCHAIN=/tmp/android-7-toolchain\n```\n","tools/android/MASTG-TOOL-0006.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0006.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0006.md)","tools/android/MASTG-TOOL-0007.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0007.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0007.md)","tools/android/MASTG-TOOL-0008.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0008.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0008.md)","tools/android/MASTG-TOOL-0009.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0009.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0009.md)","tools/android/MASTG-TOOL-0010.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0010.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0010.md)","tools/android/MASTG-TOOL-0011.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0011.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0011.md)","tools/android/MASTG-TOOL-0012.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0012.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0012.md)","tools/android/MASTG-TOOL-0013.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0013.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0013.md)","tools/android/MASTG-TOOL-0014.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0014.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0014.md)","tools/android/MASTG-TOOL-0015.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0015.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0015.md)","tools/android/MASTG-TOOL-0016.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0016.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0016.md)","tools/android/MASTG-TOOL-0017.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0017.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0017.md)","tools/android/MASTG-TOOL-0018.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0018.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0018.md)","tools/android/MASTG-TOOL-0019.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0019.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0019.md)","tools/android/MASTG-TOOL-0020.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0020.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0020.md)","tools/android/MASTG-TOOL-0021.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0021.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0021.md)","tools/android/MASTG-TOOL-0022.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0022.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0022.md)","tools/android/MASTG-TOOL-0023.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0023.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0023.md)","tools/android/MASTG-TOOL-0024.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0024.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0024.md)","tools/android/MASTG-TOOL-0025.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0025.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0025.md)","tools/android/MASTG-TOOL-0026.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0026.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0026.md)","tools/android/MASTG-TOOL-0027.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0027.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0027.md)","tools/android/MASTG-TOOL-0028.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0028.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0028.md)","tools/android/MASTG-TOOL-0029.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0029.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0029.md)","tools/android/MASTG-TOOL-0030.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0030.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0030.md)","tools/android/MASTG-TOOL-0099.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0099.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0099.md)","tools/android/MASTG-TOOL-0103.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0103.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0103.md)","tools/android/MASTG-TOOL-0107.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0107.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0107.md)","tools/android/MASTG-TOOL-0112.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0112.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0112.md)","tools/android/MASTG-TOOL-0116.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0116.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0116.md)","tools/android/MASTG-TOOL-0120.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0120.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0120.md)","tools/android/MASTG-TOOL-0123.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0123.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0123.md)","tools/android/MASTG-TOOL-0124.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0124.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0124.md)","tools/android/MASTG-TOOL-0125.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0125.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0125.md)","tools/android/MASTG-TOOL-0130.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0130.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0130.md)","tools/android/MASTG-TOOL-0140.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0140.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0140.md)","tools/android/MASTG-TOOL-0146.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0146.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0146.md)","tools/android/MASTG-TOOL-0147.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0147.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0147.md)","tools/android/MASTG-TOOL-0148.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0148.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0148.md)","tools/android/MASTG-TOOL-0149.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0149.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0149.md)","tools/android/MASTG-TOOL-0151.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0151.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0151.md)","tools/android/MASTG-TOOL-0152.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0152.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0152.md)","tools/android/MASTG-TOOL-0153.md":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0153.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0153.md)","tools/generic/MASTG-TOOL-0031.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0031.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0031.md)","tools/generic/MASTG-TOOL-0032.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0032.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0032.md)","tools/generic/MASTG-TOOL-0033.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0033.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0033.md)","tools/generic/MASTG-TOOL-0034.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0034.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0034.md)","tools/generic/MASTG-TOOL-0035.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0035.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0035.md)","tools/generic/MASTG-TOOL-0036.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0036.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0036.md)","tools/generic/MASTG-TOOL-0037.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0037.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0037.md)","tools/generic/MASTG-TOOL-0038.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0038.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0038.md)","tools/generic/MASTG-TOOL-0098.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0098.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0098.md)","tools/generic/MASTG-TOOL-0100.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0100.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0100.md)","tools/generic/MASTG-TOOL-0101.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0101.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0101.md)","tools/generic/MASTG-TOOL-0104.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0104.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0104.md)","tools/generic/MASTG-TOOL-0106.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0106.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0106.md)","tools/generic/MASTG-TOOL-0108.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0108.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0108.md)","tools/generic/MASTG-TOOL-0110.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0110.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0110.md)","tools/generic/MASTG-TOOL-0129.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0129.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0129.md)","tools/generic/MASTG-TOOL-0131.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0131.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0131.md)","tools/generic/MASTG-TOOL-0132.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0132.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0132.md)","tools/generic/MASTG-TOOL-0133.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0133.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0133.md)","tools/generic/MASTG-TOOL-0134.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0134.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0134.md)","tools/generic/MASTG-TOOL-0144.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0144.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0144.md)","tools/generic/MASTG-TOOL-0145.md":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0145.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0145.md)","tools/ios/MASTG-TOOL-0039.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0039.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0039.md)","tools/ios/MASTG-TOOL-0040.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0040.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0040.md)","tools/ios/MASTG-TOOL-0041.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0041.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0041.md)","tools/ios/MASTG-TOOL-0042.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0042.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0042.md)","tools/ios/MASTG-TOOL-0043.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0043.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0043.md)","tools/ios/MASTG-TOOL-0044.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0044.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0044.md)","tools/ios/MASTG-TOOL-0045.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0045.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0045.md)","tools/ios/MASTG-TOOL-0046.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0046.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0046.md)","tools/ios/MASTG-TOOL-0047.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0047.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0047.md)","tools/ios/MASTG-TOOL-0048.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0048.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0048.md)","tools/ios/MASTG-TOOL-0049.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0049.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0049.md)","tools/ios/MASTG-TOOL-0050.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0050.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0050.md)","tools/ios/MASTG-TOOL-0051.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0051.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0051.md)","tools/ios/MASTG-TOOL-0053.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0053.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0053.md)","tools/ios/MASTG-TOOL-0054.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0054.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0054.md)","tools/ios/MASTG-TOOL-0055.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0055.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0055.md)","tools/ios/MASTG-TOOL-0056.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0056.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0056.md)","tools/ios/MASTG-TOOL-0057.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0057.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0057.md)","tools/ios/MASTG-TOOL-0058.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0058.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0058.md)","tools/ios/MASTG-TOOL-0059.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0059.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0059.md)","tools/ios/MASTG-TOOL-0060.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0060.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0060.md)","tools/ios/MASTG-TOOL-0061.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0061.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0061.md)","tools/ios/MASTG-TOOL-0062.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0062.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0062.md)","tools/ios/MASTG-TOOL-0063.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0063.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0063.md)","tools/ios/MASTG-TOOL-0064.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0064.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0064.md)","tools/ios/MASTG-TOOL-0065.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0065.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0065.md)","tools/ios/MASTG-TOOL-0066.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0066.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0066.md)","tools/ios/MASTG-TOOL-0067.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0067.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0067.md)","tools/ios/MASTG-TOOL-0068.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0068.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0068.md)","tools/ios/MASTG-TOOL-0069.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0069.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0069.md)","tools/ios/MASTG-TOOL-0070.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0070.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0070.md)","tools/ios/MASTG-TOOL-0071.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0071.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0071.md)","tools/ios/MASTG-TOOL-0072.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0072.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0072.md)","tools/ios/MASTG-TOOL-0073.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0073.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0073.md)","tools/ios/MASTG-TOOL-0074.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0074.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0074.md)","tools/ios/MASTG-TOOL-0102.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0102.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0102.md)","tools/ios/MASTG-TOOL-0105.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0105.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0105.md)","tools/ios/MASTG-TOOL-0111.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0111.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0111.md)","tools/ios/MASTG-TOOL-0114.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0114.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0114.md)","tools/ios/MASTG-TOOL-0117.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0117.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0117.md)","tools/ios/MASTG-TOOL-0118.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0118.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0118.md)","tools/ios/MASTG-TOOL-0121.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0121.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0121.md)","tools/ios/MASTG-TOOL-0122.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0122.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0122.md)","tools/ios/MASTG-TOOL-0126.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0126.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0126.md)","tools/ios/MASTG-TOOL-0127.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0127.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0127.md)","tools/ios/MASTG-TOOL-0128.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0128.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0128.md)","tools/ios/MASTG-TOOL-0135.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0135.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0135.md)","tools/ios/MASTG-TOOL-0136.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0136.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0136.md)","tools/ios/MASTG-TOOL-0137.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0137.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0137.md)","tools/ios/MASTG-TOOL-0138.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0138.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0138.md)","tools/ios/MASTG-TOOL-0139.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0139.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0139.md)","tools/ios/MASTG-TOOL-0141.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0141.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0141.md)","tools/ios/MASTG-TOOL-0142.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0142.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0142.md)","tools/ios/MASTG-TOOL-0150.md":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0150.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0150.md)","tools/network/MASTG-TOOL-0075.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0075.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0075.md)","tools/network/MASTG-TOOL-0076.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0076.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0076.md)","tools/network/MASTG-TOOL-0077.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0077.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0077.md)","tools/network/MASTG-TOOL-0078.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0078.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0078.md)","tools/network/MASTG-TOOL-0079.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0079.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0079.md)","tools/network/MASTG-TOOL-0080.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0080.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0080.md)","tools/network/MASTG-TOOL-0081.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0081.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0081.md)","tools/network/MASTG-TOOL-0097.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0097.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0097.md)","tools/network/MASTG-TOOL-0109.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0109.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0109.md)","tools/network/MASTG-TOOL-0115.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0115.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0115.md)","tools/network/MASTG-TOOL-0143.md":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0143.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0143.md)"},"items":[{"name":"SKILL.md","path":".github/skills/mastg-assign-ids/SKILL.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/.github/skills/mastg-assign-ids/SKILL.md","title":"mastg-assign-ids","category":"anthropic-skill","format":"markdown","content":"---\nname: mastg-assign-ids\ndescription: Assign real MASTG IDs to draft files that use fake placeholder IDs (e.g. MASTG-KNOW-0x01, MASTG-BEST-0x56). Use when finishing a PR that introduces new MASTG components with placeholder IDs, or when asked to \"fix fake IDs\", \"assign real IDs\", or \"use next available IDs\". Runs next_id.py to get the correct next IDs, renames all affected files, and replaces all in-content references.\n---\n\n# MASTG Assign IDs\n\nReplace all fake/placeholder component IDs (e.g. `MASTG-KNOW-0x01`, `MASTG-BEST-0x56`) with the next real sequential IDs across file names and file contents.\n\n## When to use\n\n- A PR adds new MASTG components using `0x##` placeholder IDs\n- You are asked to \"fix fake IDs\", \"assign real IDs\", or \"use next available IDs\"\n\n## Fake-ID convention\n\nNew draft items use the pattern `MASTG-TYPE-0x##` (hex suffix, e.g. `0x01`, `0x0a`).\nReal IDs use zero-padded 4-digit decimal: `MASTG-TYPE-NNNN` (e.g. `MASTG-KNOW-0122`).\n\n**Non-standard fake IDs**: Some draft items may use a different convention that is NOT caught by the `0x##` pattern — for example `MASTG-BEST-00ea` (lowercase hex digits without the `0x` prefix). These are still fake IDs and must be replaced. After running `find_fakes.sh`, manually scan the `git diff --name-only origin/master...HEAD` output for any ID-like suffix that contains lowercase letters (`a`–`f`) or is not exactly 4 decimal digits.\n\n## Step-by-step workflow\n\nAll scripts are in `scripts/` relative to this skill. Run from the repository root.\n\n### 1. Find all fake-ID files in the current branch\n\n```bash\nbash .github/skills/mastg-assign-ids/scripts/find_fakes.sh\n```\n\nSee [scripts/find_fakes.sh](scripts/find_fakes.sh).\n\n### 2. Get the next available real IDs\n\n```bash\npython3 .github/skills/mastg-assign-ids/scripts/next_id.py\n```\n\nPrints one line per component type, e.g.:\n\n```txt\nMASTG-APP-0034\nMASTG-BEST-0046\nMASTG-DEMO-0542\nMASTG-KNOW-0132\nMASTG-TECH-0156\nMASTG-TEST-0351\nMASTG-TOOL-0151\n```\n\nIf multiple new components of the same type are introduced in the same PR,\nallocate IDs sequentially: first new file → next_id, second → next_id+1, etc.\n\nSee [scripts/next_id.py](scripts/next_id.py).\n\n### 3. Build the replacement mapping\n\nMap each fake ID to the real ID you just allocated. Record the mapping explicitly before proceeding, e.g.:\n\n```txt\nMASTG-KNOW-0x01 → MASTG-KNOW-0122\nMASTG-KNOW-0x02 → MASTG-KNOW-0123\nMASTG-BEST-0x56 → MASTG-BEST-0045\n```\n\nImportant ordering rules: pass longer/more-specific patterns first (e.g. `0x0a` before `0x01`, `0xXX` before anything else).\n\n### 4. Rename files\n\nUse `git mv` to preserve history:\n\n```bash\ngit mv old-path/MASTG-TYPE-0x01.md new-path/MASTG-TYPE-NNNN.md\n```\n\nFor demos (directory-based IDs):\n\n```bash\ngit mv demos/ios/MASVS-CAT/MASTG-DEMO-0x01 demos/ios/MASVS-CAT/MASTG-DEMO-NNNN\n```\n\n### 5. Replace in-content references\n\nPass `OLD=NEW` pairs as arguments — longer patterns first:\n\n```bash\npython3 .github/skills/mastg-assign-ids/scripts/fix_ids.py \\\n MASTG-KNOW-0x0a=MASTG-KNOW-0131 \\\n MASTG-KNOW-0x01=MASTG-KNOW-0122 \\\n MASTG-BEST-0x56=MASTG-BEST-0045\n```\n\nThis covers frontmatter `id:` fields and `knowledge:` lists automatically (they live in `.md` files). See [scripts/fix_ids.py](scripts/fix_ids.py).\n\n### 6. Verify\n\n```bash\nbash .github/skills/mastg-assign-ids/scripts/verify.sh\npython3 .github/skills/mastg-assign-ids/scripts/next_id.py\n```\n\n`verify.sh` exits 1 if any fake IDs remain. `next_id.py` should now report incremented next IDs. See [scripts/verify.sh](scripts/verify.sh).\n\n### 7. Give the user a summary of the changes\n\nProvide a summary of the ID changes, e.g.:\n\n```md\nID assignments used in this PR:\n\n| Fake ID | Real ID |\n|---------|---------|\n| MASTG-KNOW-0x01 | MASTG-KNOW-0122 |\n| MASTG-KNOW-0x02 | MASTG-KNOW-0123 |\n| MASTG-BEST-0x56 | MASTG-BEST-0045 |\n```\n\n## Component locations\n\n| Type | Files/dirs |\n|------|-----------|\n| MASTG-APP | `apps/*.md` |\n| MASTG-BEST | `best-practices/*.md` |\n| MASTG-DEMO | `demos///MASTG-DEMO-NNNN/` (directory) |\n| MASTG-KNOW | `knowledge///MASTG-KNOW-NNNN.md` |\n| MASTG-TECH | `techniques//MASTG-TECH-NNNN.md` |\n| MASTG-TEST | `tests-beta///MASTG-TEST-NNNN.md` |\n| MASTG-TOOL | `tools//MASTG-TOOL-NNNN.md` |\n\n## Important notes\n\n- Always use `git mv`, never `mv`, so renames are tracked in history.\n- Always scope work to files changed in the current branch. Never touch the whole repo.\n- Exclude `.github/` from all searches and replacements (all scripts do this automatically).\n- The `id:` field in frontmatter must match the filename.\n","frontmatter":{"name":"mastg-assign-ids","description":"Assign real MASTG IDs to draft files that use fake placeholder IDs (e.g. MASTG-KNOW-0x01, MASTG-BEST-0x56). Use when finishing a PR that introduces new MASTG components with placeholder IDs, or when asked to \"fix fake IDs\", \"assign real IDs\", or \"use next available IDs\". Runs next_id.py to get the correct next IDs, renames all affected files, and replaces all in-content references."},"isInternal":false,"tokens":1468,"sizeBytes":4643},{"name":"mastg-android-broken-encryption-algorithms.yaml","path":"rules/mastg-android-broken-encryption-algorithms.yaml","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/rules/mastg-android-broken-encryption-algorithms.yaml","title":"Rules Skill","category":"anthropic-skill","format":"yaml","content":"rules:\n - id: mastg-android-broken-encryption-algorithms\n languages:\n - java\n severity: WARNING\n metadata:\n summary: This rule looks for broken encryption algorithms.\n message: \"[MASVS-CRYPTO-1] Broken encryption algorithms found in use.\"\n pattern-regex: Cipher\\.getInstance\\(\"?(DES|DESede|RC4|Blowfish)(/[A-Za-z0-9]+(/[A-Za-z0-9]+)?)?\"?\\)\n","isInternal":false,"tokens":104,"sizeBytes":366},{"name":"mastg-android-broken-encryption-modes.yaml","path":"rules/mastg-android-broken-encryption-modes.yaml","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/rules/mastg-android-broken-encryption-modes.yaml","title":"Rules Skill","category":"anthropic-skill","format":"yaml","content":"rules:\n - id: mastg-android-broken-encryption-modes\n languages:\n - java\n severity: WARNING\n metadata:\n summary: This rule looks for broken encryption modes.\n message: \"[MASVS-CRYPTO-1] Broken encryption modes found in use.\"\n pattern-either:\n - pattern: Cipher.getInstance(\"AES\")\n - pattern-regex: Cipher\\.getInstance\\(\"?[A-Za-z0-9]+/ECB(/[A-Za-z0-9]+)?\"?\\)\n\n \n","isInternal":false,"tokens":109,"sizeBytes":401},{"name":"mastg-android-dangerous-app-permissions.yaml","path":"rules/mastg-android-dangerous-app-permissions.yaml","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/rules/mastg-android-dangerous-app-permissions.yaml","title":"Rules Skill","category":"anthropic-skill","format":"yaml","content":"rules:\n - id: detect-dangerous-android-permissions\n languages:\n - xml\n message: \"Dangerous Android permission found:\"\n severity: WARNING\n pattern-either:\n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n\n","isInternal":false,"tokens":842,"sizeBytes":4056},{"name":"mastg-android-hardcoded-security-provider.yaml","path":"rules/mastg-android-hardcoded-security-provider.yaml","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/rules/mastg-android-hardcoded-security-provider.yaml","title":"Rules Skill","category":"anthropic-skill","format":"yaml","content":"rules:\n - id: mastg-android-hardcoded-security-provider\n languages:\n - java\n severity: WARNING\n metadata:\n summary: This rule looks for explicitly specified security providers in getInstance calls.\n message: \"[MASVS-CRYPTO-1] Explicitly specified security provider found. Do not hardcode a provider unless using AndroidKeyStore.\"\n patterns:\n - pattern-either:\n - pattern: $X.getInstance($ALGO, $PROVIDER)\n - pattern: $X.getInstance($ALGO, (String $PROVIDER))\n - pattern: $X.getInstance($ALGO, (java.security.Provider $PROVIDER))\n - pattern-not: KeyStore.getInstance(\"AndroidKeyStore\")\n - metavariable-regex:\n metavariable: $X\n regex: (Cipher|KeyGenerator|KeyPairGenerator|MessageDigest|Signature|Mac|SecretKeyFactory|KeyFactory|SecureRandom|KeyAgreement|AlgorithmParameters|AlgorithmParameterGenerator|CertificateFactory|CertPathBuilder|CertPathValidator|CertStore|KeyStore)\n\n","isInternal":false,"tokens":222,"sizeBytes":962},{"name":"mastg-android-root-detection.yaml","path":"rules/mastg-android-root-detection.yaml","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/rules/mastg-android-root-detection.yaml","title":"Rules Skill","category":"anthropic-skill","format":"yaml","content":"rules:\n - id: mastg-android-root-detection-file-checks\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of file existence checks commonly used for root detection\n message: \"[MASVS-RESILIENCE-1] The app checks for file existence, which may be part of root detection implementation.\"\n pattern: new File($PATH).exists()\n metavariable-regex:\n metavariable: $PATH\n regex: '.*(su|magisk|Superuser\\.apk).*'\n\n - id: mastg-android-root-detection-package-check\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of package manager checks that may be used for root detection\n message: \"[MASVS-RESILIENCE-1] The app checks for installed packages, which may be looking for root management apps.\"\n pattern: $PM.getPackageInfo($PKG, ...)\n\n - id: mastg-android-root-detection-test-keys\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of test-keys build check for root/custom ROM detection\n message: \"[MASVS-RESILIENCE-1] The app checks Build.TAGS for test-keys, indicating custom ROM or root detection.\"\n pattern-either:\n - pattern: Build.TAGS.contains(\"test-keys\")\n - patterns:\n - pattern: $TAGS.contains(\"test-keys\")\n - pattern-inside: |\n $TAGS = Build.TAGS;\n ...\n - patterns:\n - pattern: StringsKt.contains$default(..., \"test-keys\", ...)\n - pattern-inside: |\n $TAGS = Build.TAGS;\n ...\n\n - id: mastg-android-root-detection-system-properties\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of system property checks via getprop\n message: \"[MASVS-RESILIENCE-1] The app reads system properties via getprop, which may be checking for root indicators.\"\n pattern-either:\n - pattern: Runtime.getRuntime().exec(\"getprop \" + $PROP)\n - pattern: Runtime.getRuntime().exec(new String[] { \"getprop\", $PROP })\n\n - id: mastg-android-root-detection-runtime-exec\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of Runtime.exec calls that may be used for root detection\n message: \"[MASVS-RESILIENCE-1] The app uses Runtime.exec(), which may be attempting to execute su or other commands for root detection.\"\n patterns:\n - pattern: Runtime.getRuntime().exec($CMD)\n - pattern-not: Runtime.getRuntime().exec(\"getprop \" + $PROP)\n - pattern-not: Runtime.getRuntime().exec(new String[] { \"getprop\", $PROP })\n","isInternal":false,"tokens":595,"sizeBytes":2502},{"name":"MASTG-TOOL-0001.md","path":"tools/android/MASTG-TOOL-0001.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0001.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"---\ntitle: Frida (Android)\nplatform: android\nsource: https://github.com/frida/frida\n---\n\nFrida supports interaction with the Android Java runtime through the [Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\"). You'll be able to hook and call both Java and native functions inside the process and its native libraries. Your JavaScript snippets have full access to memory, e.g. to read and/or write any structured data.\n\nHere are some tasks that Frida APIs offer and are relevant or exclusive to Android:\n\n- Instantiate Java objects and call static and non-static class methods ([Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\")).\n- Replace Java method implementations ([Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\")).\n- Enumerate live instances of specific classes by scanning the Java heap ([Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\")).\n- Scan process memory for occurrences of a string ([Memory API](https://www.frida.re/docs/javascript-api/#memory \"Frida - Memory API\")).\n- Intercept native function calls to run your own code at function entry and exit ([Interceptor API](https://www.frida.re/docs/javascript-api/#interceptor \"Frida - Interceptor API\")).\n\nRemember that on Android, you can also benefit from the built-in tools provided when installing Frida, which include the Frida CLI (`frida`), `frida-ps`, `frida-ls-devices`, and `frida-trace`, to name some of them.\n\nFrida is often compared to @MASTG-TOOL-0027 or @MASTG-TOOL-0149. However, this comparison is far from fair, as both frameworks were designed with different goals in mind. This is important to understand as an app security tester so that you can know which framework to use in which situation:\n\n- Frida is standalone. All you need is to run the frida-server binary from a known location in your target Android device (see \"Installing Frida\" below). This means that, in contrast to Xposed, it is not _deep_ installed in the target OS.\n- Reversing an app is an iterative process. As a consequence of the previous point, you obtain a shorter feedback loop when testing, as you don't need to (soft) reboot to apply or simply update your hooks. So you might prefer to use Xposed when implementing more permanent hooks.\n- You may inject and update your Frida JavaScript code on the fly at any point during the runtime of your process (similarly to Cycript on iOS). This way, you can perform the so-called _early instrumentation_ by letting Frida spawn your app, or you may prefer to attach to a running app that you might have brought to a certain state.\n- Frida can handle both Java and native code (JNI), allowing you to modify both of them. This is, unfortunately, a limitation of Xposed, which lacks native code support.\n\n## Installing Frida on Android\n\nIn order to set up Frida on your Android device:\n\n- If your device is not rooted, you can also use Frida. Please refer to @MASTG-TECH-0026.\n- If you have a rooted device, simply follow the [official instructions](https://www.frida.re/docs/android/ \"Frida - Setting up your Android device\") or follow the hints below.\n\nWe assume a rooted device here unless otherwise noted. Download the frida-server binary from the [Frida releases page](https://github.com/frida/frida/releases). Make sure that you download the right frida-server binary for the architecture of your Android device or emulator: x86, x86_64, arm, or arm64. Make sure that the server version (at least the major version number) matches the version of your local Frida installation. PyPI usually installs the latest version of Frida. If you're unsure which version is installed, you can check with the Frida command line tool:\n\n```bash\nfrida --version\n```\n\nOr you can run the following command to automatically detect Frida version and download the right frida-server binary:\n\n```bash\nwget https://github.com/frida/frida/releases/download/$(frida --version)/frida-server-$(frida --version)-android-arm.xz\n```\n\nCopy frida-server to the device and run it:\n\n```bash\nadb push frida-server /data/local/tmp/\nadb shell \"chmod 755 /data/local/tmp/frida-server\"\nadb shell \"su -c /data/local/tmp/frida-server &\" # or if su needs a uid: adb shell \"su 0 /data/local/tmp/frida-server &\"\n```\n\n## Using Frida on Android\n\nWith frida-server running, you should now be able to get a list of running processes with the following command (use the `-U` option to indicate Frida to use a connected USB device or emulator):\n\n```bash\n$ frida-ps -U\n PID Name\n----- --------------------------------------------------------------\n 276 adbd\n 956 android.process.media\n 198 bridgemgrd\n30692 com.android.chrome\n30774 com.android.chrome:privileged_process0\n30747 com.android.chrome:sandboxed\n30834 com.android.chrome:sandboxed\n 3059 com.android.nfc\n 1526 com.android.phone\n17104 com.android.settings\n 1302 com.android.systemui\n(...)\n```\n\nOr restrict the list with the `-Uai` flag combination to get all apps (`-a`) currently installed (`-i`) on the connected USB device (`-U`):\n\n```bash\n$ frida-ps -Uai\n PID Name Identifier\n----- ---------------------------------------- ------------------------------\n 766 Android System android\n30692 Chrome com.android.chrome\n 3520 Contacts Storage com.android.providers.contacts\n - Uncrackable1 sg.vantagepoint.uncrackable1\n - drozer Agent com.mwr.dz\n```\n\nThis will show the names and identifiers of all apps. If they are currently running, it will also show their PIDs. Search for your app in the list and take a note of the PID or its name/identifier. From now on, you'll refer to your app by using one of them. A recommendation is to use the identifiers, as the PIDs will change on each run of the app. For example, let's take `com.android.chrome`. You can use this string now on all Frida tools, e.g. on the Frida CLI, on frida-trace, or from a Python script.\n\n## Tracing Native Libraries with frida-trace\n\nTo trace specific (low-level) library calls, you can use the `frida-trace` command line tool:\n\n```bash\nfrida-trace -U com.android.chrome -i \"open\"\n```\n\nThis generates a little JavaScript in `__handlers__/libc.so/open.js`, which Frida injects into the process. The script traces all calls to the `open` function in `libc.so`. You can modify the generated script according to your needs with Frida [JavaScript API](https://www.frida.re/docs/javascript-api/).\n\nUnfortunately, tracing high-level methods of Java classes is not yet supported (but might be [in the future](https://github.com/frida/frida-python/issues/70 \"Support for tracing high-level methods of Java Classes via patterns\")).\n\n## Frida CLI and the Java API\n\nUse the Frida CLI tool (`frida`) to work with Frida interactively. It hooks into a process and gives you a command-line interface to Frida's API.\n\n```bash\nfrida -U com.android.chrome\n```\n\nWith the `-l` option, you can also use the Frida CLI to load scripts, e.g., to load `myscript.js`:\n\n```bash\nfrida -U -l myscript.js com.android.chrome\n```\n\nFrida also provides a [Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\"), which is especially helpful for dealing with Android apps. It lets you work with Java classes and objects directly. Here is a script to overwrite the `onResume` function of an Activity class:\n\n```java\nJava.perform(function () {\n var Activity = Java.use(\"android.app.Activity\");\n Activity.onResume.implementation = function () {\n console.log(\"[*] onResume() got called!\");\n this.onResume();\n };\n});\n```\n\nThe above script calls `Java.perform` to make sure that your code gets executed in the context of the Java VM. It instantiates a wrapper for the `android.app.Activity` class via `Java.use` and overwrites the `onResume` function. The new `onResume` function implementation prints a notice to the console and calls the original `onResume` method by invoking `this.onResume` every time an activity is resumed in the app.\n\n@MASTG-TOOL-0018 can generate Frida snippets through its graphical code browser. To use this feature, open the APK or DEX with `jadx-gui`, browse to the target method, right-click the method name, and select \"Copy as frida snippet (f)\". For example, using the MASTG @MASTG-APP-0003:\n\n\n\nThe above steps place the following output in the pasteboard, which you can then paste into a JavaScript file and feed into `frida -U -l`.\n\n```javascript\nlet a = Java.use(\"sg.vantagepoint.a.a\");\na[\"a\"].implementation = function (bArr, bArr2) {\n console.log('a is called' + ', ' + 'bArr: ' + bArr + ', ' + 'bArr2: ' + bArr2);\n let ret = this.a(bArr, bArr2);\n console.log('a ret value is ' + ret);\n return ret;\n};\n```\n\nThe above code hooks the `a` method within the `sg.vantagepoint.a.a` class and logs its input parameters and return values.\n\nFrida also lets you search for and work with instantiated objects that are on the heap. The following script searches for instances of `android.view.View` objects and calls their `toString` method. The result is printed to the console:\n\n```java\nsetImmediate(function() {\n console.log(\"[*] Starting script\");\n Java.perform(function () {\n Java.choose(\"android.view.View\", {\n \"onMatch\":function(instance){\n console.log(\"[*] Instance found: \" + instance.toString());\n },\n \"onComplete\":function() {\n console.log(\"[*] Finished heap search\")\n }\n });\n });\n});\n```\n\nThe output would look like this:\n\n```bash\n[*] Starting script\n[*] Instance found: android.view.View{7ccea78 G.ED..... ......ID 0,0-0,0 #7f0c01fc app:id/action_bar_black_background}\n[*] Instance found: android.view.View{2809551 V.ED..... ........ 0,1731-0,1731 #7f0c01ff app:id/menu_anchor_stub}\n[*] Instance found: android.view.View{be471b6 G.ED..... ......I. 0,0-0,0 #7f0c01f5 app:id/location_bar_verbose_status_separator}\n[*] Instance found: android.view.View{3ae0eb7 V.ED..... ........ 0,0-1080,63 #102002f android:id/statusBarBackground}\n[*] Finished heap search\n```\n\nYou can also use Java's reflection capabilities. To list the public methods of the `android.view.View` class, you could create a wrapper for this class in Frida and call `getMethods` from the wrapper's `class` property:\n\n```java\nJava.perform(function () {\n var view = Java.use(\"android.view.View\");\n var methods = view.class.getMethods();\n for(var i = 0; i < methods.length; i++) {\n console.log(methods[i].toString());\n }\n});\n```\n\nThis will print a very long list of methods to the terminal:\n\n```java\npublic boolean android.view.View.canResolveLayoutDirection()\npublic boolean android.view.View.canResolveTextAlignment()\npublic boolean android.view.View.canResolveTextDirection()\npublic boolean android.view.View.canScrollHorizontally(int)\npublic boolean android.view.View.canScrollVertically(int)\npublic final void android.view.View.cancelDragAndDrop()\npublic void android.view.View.cancelLongPress()\npublic final void android.view.View.cancelPendingInputEvents()\n...\n```\n\nFor more practical examples, check out the [Android section in the Frida Handbook](https://learnfrida.info/java/).\n","frontmatter":{"title":"Frida (Android)","platform":"android","source":"https://github.com/frida/frida"},"isInternal":false,"tokens":2739,"sizeBytes":11409},{"name":"MASTG-TOOL-0002.md","path":"tools/android/MASTG-TOOL-0002.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0002.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"---\ntitle: MobSF (Android)\nplatform: android\nsource: https://github.com/MobSF/Mobile-Security-Framework-MobSF\n---\n\nAfter MobSF is done with its analysis, you will receive a one-page overview of all the tests that were executed. The page is split up into multiple sections, giving some first hints on the attack surface of the application.\n\n\n\nThe following is displayed:\n\n- Basic information about the app and its binary file.\n- Some options to:\n - View the `AndroidManifest.xml` file.\n - View the IPC components of the app.\n- Signer certificate.\n- App permissions.\n- A security analysis showing known defects e.g. if the app backups are enabled.\n- List of libraries used by the app binary and list of all files inside the unzipped APK.\n- Malware analysis that checks for malicious URLs.\n\nRefer to [MobSF documentation](https://github.com/MobSF/Mobile-Security-Framework-MobSF/wiki/1.-Documentation \"MobSF documentation\") for more details.\n","frontmatter":{"title":"MobSF (Android)","platform":"android","source":"https://github.com/MobSF/Mobile-Security-Framework-MobSF"},"isInternal":false,"tokens":236,"sizeBytes":1011},{"name":"MASTG-TOOL-0003.md","path":"tools/android/MASTG-TOOL-0003.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0003.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"---\ntitle: nm (Android)\nplatform: android\nsource: https://ftp.gnu.org/gnu/binutils/\n---\n\nnm is a tool that displays the name list (symbol table) of the given binary. [More information for the Android (GNU)](https://ftp.gnu.org/old-gnu/Manuals/binutils-2.12/html_node/binutils_4.html \"nm -binutils\") version.\n","frontmatter":{"title":"nm (Android)","platform":"android","source":"https://ftp.gnu.org/gnu/binutils/"},"isInternal":false,"tokens":84,"sizeBytes":308},{"name":"MASTG-TOOL-0004.md","path":"tools/android/MASTG-TOOL-0004.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0004.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"---\ntitle: adb\nplatform: android\nsource: https://developer.android.com/studio/command-line/adb\n---\n\nadb, shipped with the Android SDK, bridges the gap between your local development environment and a connected Android device. You'll usually leverage it to test apps on the emulator or a connected device via USB or Wi-Fi. Use the `adb devices` command to list the connected devices and execute it with the `-l` argument to retrieve more details on them.\n\n```bash\n$ adb devices -l\nList of devices attached\n090c285c0b97f748 device usb:1-1 product:razor model:Nexus_7 device:flo\nemulator-5554 device product:sdk_google_phone_x86 model:Android_SDK_built_for_x86 device:generic_x86 transport_id:1\n```\n\nadb provides other useful commands, such as `adb shell` to start an interactive shell on a target and `adb forward` to forward traffic on a specific host port to a different port on a connected device.\n\n```bash\nadb forward tcp: tcp:\n```\n\n```bash\n$ adb -s emulator-5554 shell\nroot@generic_x86:/ # ls\nacct\ncache\ncharger\nconfig\n...\n```\n\nYou'll come across different use cases on how you can use adb commands when testing later in this book. Note that you must define the serial number of the target device with the `-s` argument (as shown by the previous code snippet) in case you have multiple devices connected.\n","frontmatter":{"title":"adb","platform":"android","source":"https://developer.android.com/studio/command-line/adb"},"isInternal":false,"tokens":320,"sizeBytes":1335},{"name":"MASTG-TOOL-0005.md","path":"tools/android/MASTG-TOOL-0005.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0005.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"---\ntitle: Android NDK\nplatform: android\nsource: https://developer.android.com/ndk/guides/standalone_toolchain\n---\n\nThe Android NDK contains prebuilt versions of the native compiler and toolchain. Both the GCC and Clang compilers have traditionally been supported, but active support for GCC ended with NDK revision 14. The device architecture and host OS determine the appropriate version. The prebuilt toolchains are in the `toolchains` directory of the NDK, which contains one subdirectory for each architecture.\n\n| Architecture | Toolchain name |\n| --- | --- |\n| ARM-based | arm-linux-androideabi-<gcc-version> |\n| x86-based | x86-<gcc-version> |\n| MIPS-based | mipsel-linux-android-<gcc-version> |\n| ARM64-based | aarch64-linux-android-<gcc-version> |\n| X86-64-based | x86_64-<gcc-version> |\n| MIPS64-based | mips64el-linux-android-<gcc-version> |\n\nBesides picking the right architecture, you need to specify the correct sysroot for the native API level you want to target. The sysroot is a directory that contains the system headers and libraries for your target. Native APIs vary by Android API level. Available sysroot directories for each Android API level can be found in `$NDK/platforms/`. Each API level directory contains subdirectories for the various CPUs and architectures.\n\nOne possibility for setting up the build system is exporting the compiler path and necessary flags as environment variables. To make things easier, however, the NDK allows you to create a so-called standalone toolchain, which is a temporary toolchain that incorporates the required settings.\n\nTo set up a standalone toolchain, download the [latest stable version of the NDK](https://developer.android.com/ndk/downloads/index.html#stable-downloads \"Android NDK Downloads\"). Extract the ZIP file, change into the NDK root directory, and run the following command:\n\n```bash\n./build/tools/make_standalone_toolchain.py --arch arm --api 24 --install-dir /tmp/android-7-toolchain\n```\n\nThis creates a standalone toolchain for Android 7.0 (API level 24) in the directory `/tmp/android-7-toolchain`. For convenience, you can export an environment variable that points to your toolchain directory (we'll be using this in the examples). Run the following command or add it to your `.bash_profile` or other startup script:\n\n```bash\nexport TOOLCHAIN=/tmp/android-7-toolchain\n```\n","frontmatter":{"title":"Android NDK","platform":"android","source":"https://developer.android.com/ndk/guides/standalone_toolchain"},"isInternal":false,"tokens":545,"sizeBytes":2392},{"name":"MASTG-TOOL-0006.md","path":"tools/android/MASTG-TOOL-0006.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0006.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0006.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0006.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0007.md","path":"tools/android/MASTG-TOOL-0007.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0007.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0007.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0007.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0008.md","path":"tools/android/MASTG-TOOL-0008.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0008.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0008.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0008.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0009.md","path":"tools/android/MASTG-TOOL-0009.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0009.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0009.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0009.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0010.md","path":"tools/android/MASTG-TOOL-0010.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0010.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0010.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0010.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0011.md","path":"tools/android/MASTG-TOOL-0011.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0011.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0011.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0011.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0012.md","path":"tools/android/MASTG-TOOL-0012.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0012.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0012.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0012.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0013.md","path":"tools/android/MASTG-TOOL-0013.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0013.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0013.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0013.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0014.md","path":"tools/android/MASTG-TOOL-0014.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0014.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0014.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0014.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0015.md","path":"tools/android/MASTG-TOOL-0015.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0015.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0015.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0015.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0016.md","path":"tools/android/MASTG-TOOL-0016.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0016.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0016.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0016.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0017.md","path":"tools/android/MASTG-TOOL-0017.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0017.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0017.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0017.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0018.md","path":"tools/android/MASTG-TOOL-0018.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0018.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0018.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0018.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0019.md","path":"tools/android/MASTG-TOOL-0019.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0019.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0019.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0019.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0020.md","path":"tools/android/MASTG-TOOL-0020.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0020.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0020.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0020.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0021.md","path":"tools/android/MASTG-TOOL-0021.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0021.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0021.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0021.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0022.md","path":"tools/android/MASTG-TOOL-0022.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0022.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0022.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0022.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0023.md","path":"tools/android/MASTG-TOOL-0023.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0023.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0023.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0023.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0024.md","path":"tools/android/MASTG-TOOL-0024.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0024.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0024.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0024.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0025.md","path":"tools/android/MASTG-TOOL-0025.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0025.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0025.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0025.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0026.md","path":"tools/android/MASTG-TOOL-0026.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0026.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0026.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0026.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0027.md","path":"tools/android/MASTG-TOOL-0027.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0027.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0027.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0027.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0028.md","path":"tools/android/MASTG-TOOL-0028.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0028.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0028.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0028.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0029.md","path":"tools/android/MASTG-TOOL-0029.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0029.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0029.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0029.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0030.md","path":"tools/android/MASTG-TOOL-0030.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0030.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0030.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0030.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0099.md","path":"tools/android/MASTG-TOOL-0099.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0099.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0099.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0099.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0103.md","path":"tools/android/MASTG-TOOL-0103.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0103.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0103.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0103.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0107.md","path":"tools/android/MASTG-TOOL-0107.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0107.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0107.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0107.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0112.md","path":"tools/android/MASTG-TOOL-0112.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0112.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0112.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0112.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0116.md","path":"tools/android/MASTG-TOOL-0116.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0116.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0116.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0116.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0120.md","path":"tools/android/MASTG-TOOL-0120.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0120.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0120.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0120.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0123.md","path":"tools/android/MASTG-TOOL-0123.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0123.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0123.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0123.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0124.md","path":"tools/android/MASTG-TOOL-0124.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0124.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0124.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0124.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0125.md","path":"tools/android/MASTG-TOOL-0125.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0125.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0125.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0125.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0130.md","path":"tools/android/MASTG-TOOL-0130.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0130.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0130.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0130.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0140.md","path":"tools/android/MASTG-TOOL-0140.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0140.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0140.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0140.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0146.md","path":"tools/android/MASTG-TOOL-0146.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0146.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0146.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0146.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0147.md","path":"tools/android/MASTG-TOOL-0147.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0147.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0147.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0147.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0148.md","path":"tools/android/MASTG-TOOL-0148.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0148.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0148.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0148.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0149.md","path":"tools/android/MASTG-TOOL-0149.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0149.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0149.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0149.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0151.md","path":"tools/android/MASTG-TOOL-0151.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0151.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0151.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0151.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0152.md","path":"tools/android/MASTG-TOOL-0152.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0152.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0152.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0152.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0153.md","path":"tools/android/MASTG-TOOL-0153.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0153.md","title":"Android Skill","category":"anthropic-skill","format":"markdown","content":"# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0153.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0153.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0031.md","path":"tools/generic/MASTG-TOOL-0031.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0031.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0031.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0031.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0032.md","path":"tools/generic/MASTG-TOOL-0032.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0032.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0032.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0032.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0033.md","path":"tools/generic/MASTG-TOOL-0033.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0033.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0033.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0033.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0034.md","path":"tools/generic/MASTG-TOOL-0034.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0034.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0034.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0034.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0035.md","path":"tools/generic/MASTG-TOOL-0035.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0035.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0035.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0035.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0036.md","path":"tools/generic/MASTG-TOOL-0036.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0036.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0036.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0036.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0037.md","path":"tools/generic/MASTG-TOOL-0037.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0037.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0037.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0037.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0038.md","path":"tools/generic/MASTG-TOOL-0038.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0038.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0038.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0038.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0098.md","path":"tools/generic/MASTG-TOOL-0098.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0098.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0098.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0098.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0100.md","path":"tools/generic/MASTG-TOOL-0100.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0100.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0100.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0100.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0101.md","path":"tools/generic/MASTG-TOOL-0101.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0101.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0101.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0101.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0104.md","path":"tools/generic/MASTG-TOOL-0104.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0104.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0104.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0104.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0106.md","path":"tools/generic/MASTG-TOOL-0106.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0106.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0106.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0106.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0108.md","path":"tools/generic/MASTG-TOOL-0108.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0108.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0108.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0108.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0110.md","path":"tools/generic/MASTG-TOOL-0110.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0110.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0110.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0110.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0129.md","path":"tools/generic/MASTG-TOOL-0129.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0129.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0129.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0129.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0131.md","path":"tools/generic/MASTG-TOOL-0131.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0131.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0131.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0131.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0132.md","path":"tools/generic/MASTG-TOOL-0132.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0132.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0132.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0132.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0133.md","path":"tools/generic/MASTG-TOOL-0133.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0133.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0133.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0133.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0134.md","path":"tools/generic/MASTG-TOOL-0134.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0134.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0134.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0134.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0144.md","path":"tools/generic/MASTG-TOOL-0144.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0144.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0144.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0144.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0145.md","path":"tools/generic/MASTG-TOOL-0145.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0145.md","title":"Generic Skill","category":"anthropic-skill","format":"markdown","content":"# Generic Skill\n\nPath: `tools/generic/MASTG-TOOL-0145.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/generic/MASTG-TOOL-0145.md)","tokens":300,"sizeBytes":172},{"name":"index.md","path":"tools/index.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/index.md","title":"Tools Skill","category":"anthropic-skill","format":"markdown","content":"---\nhide: toc\ntitle: Testing Tools\n---\n\n??? info \"About the tools listed below\"\n\n The OWASP MASTG includes many tools to assist you in executing test cases, allowing you to perform static analysis, dynamic analysis, network interception, etc. These tools are intended to help you perform your own assessments, rather than provide a conclusive result on the security status of an app. It's important to review the output of these tools carefully, as it can contain both false positives and false negatives.\n\n These tools have been tested to work when added, but compatibility may vary depending on your OS version, the device you're testing, or whether you're using a rooted or jailbroken device. Tool functionality may also be affected by specific versions of the rooting/jailbreaking method or the tool itself. OWASP MASTG does not guarantee the functionality of the tools. If you encounter problems, try to search for solutions online or contact the tool owner (e.g. via GitHub Issues).\n\n Before proposing a new tool via GitHub Issues/Pull Requests, please check our [contribution guidelines](../../contributing/index.md#tool-inclusion-disclaimer-for-contributors).\n","frontmatter":{"hide":"toc","title":"Testing Tools"},"isInternal":false,"tokens":236,"sizeBytes":1177},{"name":"MASTG-TOOL-0039.md","path":"tools/ios/MASTG-TOOL-0039.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0039.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0039.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0039.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0040.md","path":"tools/ios/MASTG-TOOL-0040.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0040.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0040.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0040.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0041.md","path":"tools/ios/MASTG-TOOL-0041.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0041.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0041.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0041.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0042.md","path":"tools/ios/MASTG-TOOL-0042.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0042.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0042.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0042.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0043.md","path":"tools/ios/MASTG-TOOL-0043.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0043.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0043.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0043.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0044.md","path":"tools/ios/MASTG-TOOL-0044.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0044.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0044.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0044.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0045.md","path":"tools/ios/MASTG-TOOL-0045.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0045.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0045.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0045.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0046.md","path":"tools/ios/MASTG-TOOL-0046.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0046.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0046.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0046.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0047.md","path":"tools/ios/MASTG-TOOL-0047.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0047.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0047.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0047.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0048.md","path":"tools/ios/MASTG-TOOL-0048.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0048.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0048.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0048.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0049.md","path":"tools/ios/MASTG-TOOL-0049.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0049.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0049.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0049.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0050.md","path":"tools/ios/MASTG-TOOL-0050.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0050.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0050.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0050.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0051.md","path":"tools/ios/MASTG-TOOL-0051.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0051.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0051.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0051.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0053.md","path":"tools/ios/MASTG-TOOL-0053.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0053.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0053.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0053.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0054.md","path":"tools/ios/MASTG-TOOL-0054.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0054.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0054.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0054.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0055.md","path":"tools/ios/MASTG-TOOL-0055.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0055.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0055.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0055.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0056.md","path":"tools/ios/MASTG-TOOL-0056.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0056.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0056.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0056.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0057.md","path":"tools/ios/MASTG-TOOL-0057.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0057.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0057.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0057.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0058.md","path":"tools/ios/MASTG-TOOL-0058.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0058.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0058.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0058.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0059.md","path":"tools/ios/MASTG-TOOL-0059.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0059.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0059.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0059.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0060.md","path":"tools/ios/MASTG-TOOL-0060.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0060.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0060.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0060.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0061.md","path":"tools/ios/MASTG-TOOL-0061.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0061.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0061.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0061.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0062.md","path":"tools/ios/MASTG-TOOL-0062.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0062.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0062.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0062.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0063.md","path":"tools/ios/MASTG-TOOL-0063.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0063.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0063.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0063.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0064.md","path":"tools/ios/MASTG-TOOL-0064.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0064.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0064.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0064.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0065.md","path":"tools/ios/MASTG-TOOL-0065.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0065.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0065.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0065.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0066.md","path":"tools/ios/MASTG-TOOL-0066.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0066.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0066.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0066.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0067.md","path":"tools/ios/MASTG-TOOL-0067.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0067.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0067.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0067.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0068.md","path":"tools/ios/MASTG-TOOL-0068.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0068.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0068.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0068.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0069.md","path":"tools/ios/MASTG-TOOL-0069.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0069.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0069.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0069.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0070.md","path":"tools/ios/MASTG-TOOL-0070.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0070.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0070.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0070.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0071.md","path":"tools/ios/MASTG-TOOL-0071.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0071.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0071.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0071.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0072.md","path":"tools/ios/MASTG-TOOL-0072.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0072.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0072.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0072.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0073.md","path":"tools/ios/MASTG-TOOL-0073.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0073.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0073.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0073.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0074.md","path":"tools/ios/MASTG-TOOL-0074.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0074.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0074.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0074.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0102.md","path":"tools/ios/MASTG-TOOL-0102.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0102.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0102.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0102.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0105.md","path":"tools/ios/MASTG-TOOL-0105.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0105.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0105.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0105.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0111.md","path":"tools/ios/MASTG-TOOL-0111.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0111.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0111.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0111.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0114.md","path":"tools/ios/MASTG-TOOL-0114.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0114.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0114.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0114.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0117.md","path":"tools/ios/MASTG-TOOL-0117.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0117.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0117.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0117.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0118.md","path":"tools/ios/MASTG-TOOL-0118.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0118.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0118.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0118.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0121.md","path":"tools/ios/MASTG-TOOL-0121.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0121.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0121.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0121.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0122.md","path":"tools/ios/MASTG-TOOL-0122.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0122.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0122.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0122.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0126.md","path":"tools/ios/MASTG-TOOL-0126.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0126.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0126.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0126.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0127.md","path":"tools/ios/MASTG-TOOL-0127.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0127.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0127.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0127.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0128.md","path":"tools/ios/MASTG-TOOL-0128.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0128.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0128.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0128.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0135.md","path":"tools/ios/MASTG-TOOL-0135.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0135.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0135.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0135.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0136.md","path":"tools/ios/MASTG-TOOL-0136.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0136.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0136.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0136.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0137.md","path":"tools/ios/MASTG-TOOL-0137.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0137.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0137.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0137.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0138.md","path":"tools/ios/MASTG-TOOL-0138.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0138.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0138.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0138.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0139.md","path":"tools/ios/MASTG-TOOL-0139.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0139.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0139.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0139.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0141.md","path":"tools/ios/MASTG-TOOL-0141.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0141.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0141.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0141.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0142.md","path":"tools/ios/MASTG-TOOL-0142.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0142.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0142.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0142.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0150.md","path":"tools/ios/MASTG-TOOL-0150.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0150.md","title":"Ios Skill","category":"anthropic-skill","format":"markdown","content":"# Ios Skill\n\nPath: `tools/ios/MASTG-TOOL-0150.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/ios/MASTG-TOOL-0150.md)","tokens":300,"sizeBytes":160},{"name":"MASTG-TOOL-0075.md","path":"tools/network/MASTG-TOOL-0075.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0075.md","title":"Network Skill","category":"anthropic-skill","format":"markdown","content":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0075.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0075.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0076.md","path":"tools/network/MASTG-TOOL-0076.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0076.md","title":"Network Skill","category":"anthropic-skill","format":"markdown","content":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0076.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0076.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0077.md","path":"tools/network/MASTG-TOOL-0077.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0077.md","title":"Network Skill","category":"anthropic-skill","format":"markdown","content":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0077.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0077.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0078.md","path":"tools/network/MASTG-TOOL-0078.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0078.md","title":"Network Skill","category":"anthropic-skill","format":"markdown","content":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0078.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0078.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0079.md","path":"tools/network/MASTG-TOOL-0079.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0079.md","title":"Network Skill","category":"anthropic-skill","format":"markdown","content":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0079.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0079.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0080.md","path":"tools/network/MASTG-TOOL-0080.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0080.md","title":"Network Skill","category":"anthropic-skill","format":"markdown","content":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0080.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0080.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0081.md","path":"tools/network/MASTG-TOOL-0081.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0081.md","title":"Network Skill","category":"anthropic-skill","format":"markdown","content":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0081.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0081.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0097.md","path":"tools/network/MASTG-TOOL-0097.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0097.md","title":"Network Skill","category":"anthropic-skill","format":"markdown","content":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0097.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0097.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0109.md","path":"tools/network/MASTG-TOOL-0109.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0109.md","title":"Network Skill","category":"anthropic-skill","format":"markdown","content":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0109.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0109.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0115.md","path":"tools/network/MASTG-TOOL-0115.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0115.md","title":"Network Skill","category":"anthropic-skill","format":"markdown","content":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0115.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0115.md)","tokens":300,"sizeBytes":172},{"name":"MASTG-TOOL-0143.md","path":"tools/network/MASTG-TOOL-0143.md","rawUrl":"https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0143.md","title":"Network Skill","category":"anthropic-skill","format":"markdown","content":"# Network Skill\n\nPath: `tools/network/MASTG-TOOL-0143.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/network/MASTG-TOOL-0143.md)","tokens":300,"sizeBytes":172}],"systemPromptSnippet":"\n\n---\nname: mastg-assign-ids\ndescription: Assign real MASTG IDs to draft files that use fake placeholder IDs (e.g. MASTG-KNOW-0x01, MASTG-BEST-0x56). Use when finishing a PR that introduces new MASTG components with placeholder IDs, or when asked to \"fix fake IDs\", \"assign real IDs\", or \"use next available IDs\". Runs next_id.py to get the correct next IDs, renames all affected files, and replaces all in-content references.\n---\n\n# MASTG Assign IDs\n\nReplace all fake/placeholder component IDs (e.g. `MASTG-KNOW-0x01`, `MASTG-BEST-0x56`) with the next real sequential IDs across file names and file contents.\n\n## When to use\n\n- A PR adds new MASTG components using `0x##` placeholder IDs\n- You are asked to \"fix fake IDs\", \"assign real IDs\", or \"use next available IDs\"\n\n## Fake-ID convention\n\nNew draft items use the pattern `MASTG-TYPE-0x##` (hex suffix, e.g. `0x01`, `0x0a`).\nReal IDs use zero-padded 4-digit decimal: `MASTG-TYPE-NNNN` (e.g. `MASTG-KNOW-0122`).\n\n**Non-standard fake IDs**: Some draft items may use a different convention that is NOT caught by the `0x##` pattern — for example `MASTG-BEST-00ea` (lowercase hex digits without the `0x` prefix). These are still fake IDs and must be replaced. After running `find_fakes.sh`, manually scan the `git diff --name-only origin/master...HEAD` output for any ID-like suffix that contains lowercase letters (`a`–`f`) or is not exactly 4 decimal digits.\n\n## Step-by-step workflow\n\nAll scripts are in `scripts/` relative to this skill. Run from the repository root.\n\n### 1. Find all fake-ID files in the current branch\n\n```bash\nbash .github/skills/mastg-assign-ids/scripts/find_fakes.sh\n```\n\nSee [scripts/find_fakes.sh](scripts/find_fakes.sh).\n\n### 2. Get the next available real IDs\n\n```bash\npython3 .github/skills/mastg-assign-ids/scripts/next_id.py\n```\n\nPrints one line per component type, e.g.:\n\n```txt\nMASTG-APP-0034\nMASTG-BEST-0046\nMASTG-DEMO-0542\nMASTG-KNOW-0132\nMASTG-TECH-0156\nMASTG-TEST-0351\nMASTG-TOOL-0151\n```\n\nIf multiple new components of the same type are introduced in the same PR,\nallocate IDs sequentially: first new file → next_id, second → next_id+1, etc.\n\nSee [scripts/next_id.py](scripts/next_id.py).\n\n### 3. Build the replacement mapping\n\nMap each fake ID to the real ID you just allocated. Record the mapping explicitly before proceeding, e.g.:\n\n```txt\nMASTG-KNOW-0x01 → MASTG-KNOW-0122\nMASTG-KNOW-0x02 → MASTG-KNOW-0123\nMASTG-BEST-0x56 → MASTG-BEST-0045\n```\n\nImportant ordering rules: pass longer/more-specific patterns first (e.g. `0x0a` before `0x01`, `0xXX` before anything else).\n\n### 4. Rename files\n\nUse `git mv` to preserve history:\n\n```bash\ngit mv old-path/MASTG-TYPE-0x01.md new-path/MASTG-TYPE-NNNN.md\n```\n\nFor demos (directory-based IDs):\n\n```bash\ngit mv demos/ios/MASVS-CAT/MASTG-DEMO-0x01 demos/ios/MASVS-CAT/MASTG-DEMO-NNNN\n```\n\n### 5. Replace in-content references\n\nPass `OLD=NEW` pairs as arguments — longer patterns first:\n\n```bash\npython3 .github/skills/mastg-assign-ids/scripts/fix_ids.py \\\n MASTG-KNOW-0x0a=MASTG-KNOW-0131 \\\n MASTG-KNOW-0x01=MASTG-KNOW-0122 \\\n MASTG-BEST-0x56=MASTG-BEST-0045\n```\n\nThis covers frontmatter `id:` fields and `knowledge:` lists automatically (they live in `.md` files). See [scripts/fix_ids.py](scripts/fix_ids.py).\n\n### 6. Verify\n\n```bash\nbash .github/skills/mastg-assign-ids/scripts/verify.sh\npython3 .github/skills/mastg-assign-ids/scripts/next_id.py\n```\n\n`verify.sh` exits 1 if any fake IDs remain. `next_id.py` should now report incremented next IDs. See [scripts/verify.sh](scripts/verify.sh).\n\n### 7. Give the user a summary of the changes\n\nProvide a summary of the ID changes, e.g.:\n\n```md\nID assignments used in this PR:\n\n| Fake ID | Real ID |\n|---------|---------|\n| MASTG-KNOW-0x01 | MASTG-KNOW-0122 |\n| MASTG-KNOW-0x02 | MASTG-KNOW-0123 |\n| MASTG-BEST-0x56 | MASTG-BEST-0045 |\n```\n\n## Component locations\n\n| Type | Files/dirs |\n|------|-----------|\n| MASTG-APP | `apps/*.md` |\n| MASTG-BEST | `best-practices/*.md` |\n| MASTG-DEMO | `demos///MASTG-DEMO-NNNN/` (directory) |\n| MASTG-KNOW | `knowledge///MASTG-KNOW-NNNN.md` |\n| MASTG-TECH | `techniques//MASTG-TECH-NNNN.md` |\n| MASTG-TEST | `tests-beta///MASTG-TEST-NNNN.md` |\n| MASTG-TOOL | `tools//MASTG-TOOL-NNNN.md` |\n\n## Important notes\n\n- Always use `git mv`, never `mv`, so renames are tracked in history.\n- Always scope work to files changed in the current branch. Never touch the whole repo.\n- Exclude `.github/` from all searches and replacements (all scripts do this automatically).\n- The `id:` field in frontmatter must match the filename.\n\n\nrules:\n - id: mastg-android-broken-encryption-algorithms\n languages:\n - java\n severity: WARNING\n metadata:\n summary: This rule looks for broken encryption algorithms.\n message: \"[MASVS-CRYPTO-1] Broken encryption algorithms found in use.\"\n pattern-regex: Cipher\\.getInstance\\(\"?(DES|DESede|RC4|Blowfish)(/[A-Za-z0-9]+(/[A-Za-z0-9]+)?)?\"?\\)\n\n\nrules:\n - id: mastg-android-broken-encryption-modes\n languages:\n - java\n severity: WARNING\n metadata:\n summary: This rule looks for broken encryption modes.\n message: \"[MASVS-CRYPTO-1] Broken encryption modes found in use.\"\n pattern-either:\n - pattern: Cipher.getInstance(\"AES\")\n - pattern-regex: Cipher\\.getInstance\\(\"?[A-Za-z0-9]+/ECB(/[A-Za-z0-9]+)?\"?\\)\n\n\nrules:\n - id: detect-dangerous-android-permissions\n languages:\n - xml\n message: \"Dangerous Android permission found:\"\n severity: WARNING\n pattern-either:\n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n - pattern: \n\n\nrules:\n - id: mastg-android-hardcoded-security-provider\n languages:\n - java\n severity: WARNING\n metadata:\n summary: This rule looks for explicitly specified security providers in getInstance calls.\n message: \"[MASVS-CRYPTO-1] Explicitly specified security provider found. Do not hardcode a provider unless using AndroidKeyStore.\"\n patterns:\n - pattern-either:\n - pattern: $X.getInstance($ALGO, $PROVIDER)\n - pattern: $X.getInstance($ALGO, (String $PROVIDER))\n - pattern: $X.getInstance($ALGO, (java.security.Provider $PROVIDER))\n - pattern-not: KeyStore.getInstance(\"AndroidKeyStore\")\n - metavariable-regex:\n metavariable: $X\n regex: (Cipher|KeyGenerator|KeyPairGenerator|MessageDigest|Signature|Mac|SecretKeyFactory|KeyFactory|SecureRandom|KeyAgreement|AlgorithmParameters|AlgorithmParameterGenerator|CertificateFactory|CertPathBuilder|CertPathValidator|CertStore|KeyStore)\n\n\nrules:\n - id: mastg-android-root-detection-file-checks\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of file existence checks commonly used for root detection\n message: \"[MASVS-RESILIENCE-1] The app checks for file existence, which may be part of root detection implementation.\"\n pattern: new File($PATH).exists()\n metavariable-regex:\n metavariable: $PATH\n regex: '.*(su|magisk|Superuser\\.apk).*'\n\n - id: mastg-android-root-detection-package-check\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of package manager checks that may be used for root detection\n message: \"[MASVS-RESILIENCE-1] The app checks for installed packages, which may be looking for root management apps.\"\n pattern: $PM.getPackageInfo($PKG, ...)\n\n - id: mastg-android-root-detection-test-keys\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of test-keys build check for root/custom ROM detection\n message: \"[MASVS-RESILIENCE-1] The app checks Build.TAGS for test-keys, indicating custom ROM or root detection.\"\n pattern-either:\n - pattern: Build.TAGS.contains(\"test-keys\")\n - patterns:\n - pattern: $TAGS.contains(\"test-keys\")\n - pattern-inside: |\n $TAGS = Build.TAGS;\n ...\n - patterns:\n - pattern: StringsKt.contains$default(..., \"test-keys\", ...)\n - pattern-inside: |\n $TAGS = Build.TAGS;\n ...\n\n - id: mastg-android-root-detection-system-properties\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of system property checks via getprop\n message: \"[MASVS-RESILIENCE-1] The app reads system properties via getprop, which may be checking for root indicators.\"\n pattern-either:\n - pattern: Runtime.getRuntime().exec(\"getprop \" + $PROP)\n - pattern: Runtime.getRuntime().exec(new String[] { \"getprop\", $PROP })\n\n - id: mastg-android-root-detection-runtime-exec\n severity: INFO\n languages: [java]\n metadata:\n summary: Detection of Runtime.exec calls that may be used for root detection\n message: \"[MASVS-RESILIENCE-1] The app uses Runtime.exec(), which may be attempting to execute su or other commands for root detection.\"\n patterns:\n - pattern: Runtime.getRuntime().exec($CMD)\n - pattern-not: Runtime.getRuntime().exec(\"getprop \" + $PROP)\n - pattern-not: Runtime.getRuntime().exec(new String[] { \"getprop\", $PROP })\n\n\n---\ntitle: Frida (Android)\nplatform: android\nsource: https://github.com/frida/frida\n---\n\nFrida supports interaction with the Android Java runtime through the [Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\"). You'll be able to hook and call both Java and native functions inside the process and its native libraries. Your JavaScript snippets have full access to memory, e.g. to read and/or write any structured data.\n\nHere are some tasks that Frida APIs offer and are relevant or exclusive to Android:\n\n- Instantiate Java objects and call static and non-static class methods ([Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\")).\n- Replace Java method implementations ([Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\")).\n- Enumerate live instances of specific classes by scanning the Java heap ([Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\")).\n- Scan process memory for occurrences of a string ([Memory API](https://www.frida.re/docs/javascript-api/#memory \"Frida - Memory API\")).\n- Intercept native function calls to run your own code at function entry and exit ([Interceptor API](https://www.frida.re/docs/javascript-api/#interceptor \"Frida - Interceptor API\")).\n\nRemember that on Android, you can also benefit from the built-in tools provided when installing Frida, which include the Frida CLI (`frida`), `frida-ps`, `frida-ls-devices`, and `frida-trace`, to name some of them.\n\nFrida is often compared to @MASTG-TOOL-0027 or @MASTG-TOOL-0149. However, this comparison is far from fair, as both frameworks were designed with different goals in mind. This is important to understand as an app security tester so that you can know which framework to use in which situation:\n\n- Frida is standalone. All you need is to run the frida-server binary from a known location in your target Android device (see \"Installing Frida\" below). This means that, in contrast to Xposed, it is not _deep_ installed in the target OS.\n- Reversing an app is an iterative process. As a consequence of the previous point, you obtain a shorter feedback loop when testing, as you don't need to (soft) reboot to apply or simply update your hooks. So you might prefer to use Xposed when implementing more permanent hooks.\n- You may inject and update your Frida JavaScript code on the fly at any point during the runtime of your process (similarly to Cycript on iOS). This way, you can perform the so-called _early instrumentation_ by letting Frida spawn your app, or you may prefer to attach to a running app that you might have brought to a certain state.\n- Frida can handle both Java and native code (JNI), allowing you to modify both of them. This is, unfortunately, a limitation of Xposed, which lacks native code support.\n\n## Installing Frida on Android\n\nIn order to set up Frida on your Android device:\n\n- If your device is not rooted, you can also use Frida. Please refer to @MASTG-TECH-0026.\n- If you have a rooted device, simply follow the [official instructions](https://www.frida.re/docs/android/ \"Frida - Setting up your Android device\") or follow the hints below.\n\nWe assume a rooted device here unless otherwise noted. Download the frida-server binary from the [Frida releases page](https://github.com/frida/frida/releases). Make sure that you download the right frida-server binary for the architecture of your Android device or emulator: x86, x86_64, arm, or arm64. Make sure that the server version (at least the major version number) matches the version of your local Frida installation. PyPI usually installs the latest version of Frida. If you're unsure which version is installed, you can check with the Frida command line tool:\n\n```bash\nfrida --version\n```\n\nOr you can run the following command to automatically detect Frida version and download the right frida-server binary:\n\n```bash\nwget https://github.com/frida/frida/releases/download/$(frida --version)/frida-server-$(frida --version)-android-arm.xz\n```\n\nCopy frida-server to the device and run it:\n\n```bash\nadb push frida-server /data/local/tmp/\nadb shell \"chmod 755 /data/local/tmp/frida-server\"\nadb shell \"su -c /data/local/tmp/frida-server &\" # or if su needs a uid: adb shell \"su 0 /data/local/tmp/frida-server &\"\n```\n\n## Using Frida on Android\n\nWith frida-server running, you should now be able to get a list of running processes with the following command (use the `-U` option to indicate Frida to use a connected USB device or emulator):\n\n```bash\n$ frida-ps -U\n PID Name\n----- --------------------------------------------------------------\n 276 adbd\n 956 android.process.media\n 198 bridgemgrd\n30692 com.android.chrome\n30774 com.android.chrome:privileged_process0\n30747 com.android.chrome:sandboxed\n30834 com.android.chrome:sandboxed\n 3059 com.android.nfc\n 1526 com.android.phone\n17104 com.android.settings\n 1302 com.android.systemui\n(...)\n```\n\nOr restrict the list with the `-Uai` flag combination to get all apps (`-a`) currently installed (`-i`) on the connected USB device (`-U`):\n\n```bash\n$ frida-ps -Uai\n PID Name Identifier\n----- ---------------------------------------- ------------------------------\n 766 Android System android\n30692 Chrome com.android.chrome\n 3520 Contacts Storage com.android.providers.contacts\n - Uncrackable1 sg.vantagepoint.uncrackable1\n - drozer Agent com.mwr.dz\n```\n\nThis will show the names and identifiers of all apps. If they are currently running, it will also show their PIDs. Search for your app in the list and take a note of the PID or its name/identifier. From now on, you'll refer to your app by using one of them. A recommendation is to use the identifiers, as the PIDs will change on each run of the app. For example, let's take `com.android.chrome`. You can use this string now on all Frida tools, e.g. on the Frida CLI, on frida-trace, or from a Python script.\n\n## Tracing Native Libraries with frida-trace\n\nTo trace specific (low-level) library calls, you can use the `frida-trace` command line tool:\n\n```bash\nfrida-trace -U com.android.chrome -i \"open\"\n```\n\nThis generates a little JavaScript in `__handlers__/libc.so/open.js`, which Frida injects into the process. The script traces all calls to the `open` function in `libc.so`. You can modify the generated script according to your needs with Frida [JavaScript API](https://www.frida.re/docs/javascript-api/).\n\nUnfortunately, tracing high-level methods of Java classes is not yet supported (but might be [in the future](https://github.com/frida/frida-python/issues/70 \"Support for tracing high-level methods of Java Classes via patterns\")).\n\n## Frida CLI and the Java API\n\nUse the Frida CLI tool (`frida`) to work with Frida interactively. It hooks into a process and gives you a command-line interface to Frida's API.\n\n```bash\nfrida -U com.android.chrome\n```\n\nWith the `-l` option, you can also use the Frida CLI to load scripts, e.g., to load `myscript.js`:\n\n```bash\nfrida -U -l myscript.js com.android.chrome\n```\n\nFrida also provides a [Java API](https://www.frida.re/docs/javascript-api/#java \"Frida - Java API\"), which is especially helpful for dealing with Android apps. It lets you work with Java classes and objects directly. Here is a script to overwrite the `onResume` function of an Activity class:\n\n```java\nJava.perform(function () {\n var Activity = Java.use(\"android.app.Activity\");\n Activity.onResume.implementation = function () {\n console.log(\"[*] onResume() got called!\");\n this.onResume();\n };\n});\n```\n\nThe above script calls `Java.perform` to make sure that your code gets executed in the context of the Java VM. It instantiates a wrapper for the `android.app.Activity` class via `Java.use` and overwrites the `onResume` function. The new `onResume` function implementation prints a notice to the console and calls the original `onResume` method by invoking `this.onResume` every time an activity is resumed in the app.\n\n@MASTG-TOOL-0018 can generate Frida snippets through its graphical code browser. To use this feature, open the APK or DEX with `jadx-gui`, browse to the target method, right-click the method name, and select \"Copy as frida snippet (f)\". For example, using the MASTG @MASTG-APP-0003:\n\n\n\nThe above steps place the following output in the pasteboard, which you can then paste into a JavaScript file and feed into `frida -U -l`.\n\n```javascript\nlet a = Java.use(\"sg.vantagepoint.a.a\");\na[\"a\"].implementation = function (bArr, bArr2) {\n console.log('a is called' + ', ' + 'bArr: ' + bArr + ', ' + 'bArr2: ' + bArr2);\n let ret = this.a(bArr, bArr2);\n console.log('a ret value is ' + ret);\n return ret;\n};\n```\n\nThe above code hooks the `a` method within the `sg.vantagepoint.a.a` class and logs its input parameters and return values.\n\nFrida also lets you search for and work with instantiated objects that are on the heap. The following script searches for instances of `android.view.View` objects and calls their `toString` method. The result is printed to the console:\n\n```java\nsetImmediate(function() {\n console.log(\"[*] Starting script\");\n Java.perform(function () {\n Java.choose(\"android.view.View\", {\n \"onMatch\":function(instance){\n console.log(\"[*] Instance found: \" + instance.toString());\n },\n \"onComplete\":function() {\n console.log(\"[*] Finished heap search\")\n }\n });\n });\n});\n```\n\nThe output would look like this:\n\n```bash\n[*] Starting script\n[*] Instance found: android.view.View{7ccea78 G.ED..... ......ID 0,0-0,0 #7f0c01fc app:id/action_bar_black_background}\n[*] Instance found: android.view.View{2809551 V.ED..... ........ 0,1731-0,1731 #7f0c01ff app:id/menu_anchor_stub}\n[*] Instance found: android.view.View{be471b6 G.ED..... ......I. 0,0-0,0 #7f0c01f5 app:id/location_bar_verbose_status_separator}\n[*] Instance found: android.view.View{3ae0eb7 V.ED..... ........ 0,0-1080,63 #102002f android:id/statusBarBackground}\n[*] Finished heap search\n```\n\nYou can also use Java's reflection capabilities. To list the public methods of the `android.view.View` class, you could create a wrapper for this class in Frida and call `getMethods` from the wrapper's `class` property:\n\n```java\nJava.perform(function () {\n var view = Java.use(\"android.view.View\");\n var methods = view.class.getMethods();\n for(var i = 0; i < methods.length; i++) {\n console.log(methods[i].toString());\n }\n});\n```\n\nThis will print a very long list of methods to the terminal:\n\n```java\npublic boolean android.view.View.canResolveLayoutDirection()\npublic boolean android.view.View.canResolveTextAlignment()\npublic boolean android.view.View.canResolveTextDirection()\npublic boolean android.view.View.canScrollHorizontally(int)\npublic boolean android.view.View.canScrollVertically(int)\npublic final void android.view.View.cancelDragAndDrop()\npublic void android.view.View.cancelLongPress()\npublic final void android.view.View.cancelPendingInputEvents()\n...\n```\n\nFor more practical examples, check out the [Android section in the Frida Handbook](https://learnfrida.info/java/).\n\n\n---\ntitle: MobSF (Android)\nplatform: android\nsource: https://github.com/MobSF/Mobile-Security-Framework-MobSF\n---\n\nAfter MobSF is done with its analysis, you will receive a one-page overview of all the tests that were executed. The page is split up into multiple sections, giving some first hints on the attack surface of the application.\n\n\n\nThe following is displayed:\n\n- Basic information about the app and its binary file.\n- Some options to:\n - View the `AndroidManifest.xml` file.\n - View the IPC components of the app.\n- Signer certificate.\n- App permissions.\n- A security analysis showing known defects e.g. if the app backups are enabled.\n- List of libraries used by the app binary and list of all files inside the unzipped APK.\n- Malware analysis that checks for malicious URLs.\n\nRefer to [MobSF documentation](https://github.com/MobSF/Mobile-Security-Framework-MobSF/wiki/1.-Documentation \"MobSF documentation\") for more details.\n\n\n---\ntitle: nm (Android)\nplatform: android\nsource: https://ftp.gnu.org/gnu/binutils/\n---\n\nnm is a tool that displays the name list (symbol table) of the given binary. [More information for the Android (GNU)](https://ftp.gnu.org/old-gnu/Manuals/binutils-2.12/html_node/binutils_4.html \"nm -binutils\") version.\n\n\n---\ntitle: adb\nplatform: android\nsource: https://developer.android.com/studio/command-line/adb\n---\n\nadb, shipped with the Android SDK, bridges the gap between your local development environment and a connected Android device. You'll usually leverage it to test apps on the emulator or a connected device via USB or Wi-Fi. Use the `adb devices` command to list the connected devices and execute it with the `-l` argument to retrieve more details on them.\n\n```bash\n$ adb devices -l\nList of devices attached\n090c285c0b97f748 device usb:1-1 product:razor model:Nexus_7 device:flo\nemulator-5554 device product:sdk_google_phone_x86 model:Android_SDK_built_for_x86 device:generic_x86 transport_id:1\n```\n\nadb provides other useful commands, such as `adb shell` to start an interactive shell on a target and `adb forward` to forward traffic on a specific host port to a different port on a connected device.\n\n```bash\nadb forward tcp: tcp:\n```\n\n```bash\n$ adb -s emulator-5554 shell\nroot@generic_x86:/ # ls\nacct\ncache\ncharger\nconfig\n...\n```\n\nYou'll come across different use cases on how you can use adb commands when testing later in this book. Note that you must define the serial number of the target device with the `-s` argument (as shown by the previous code snippet) in case you have multiple devices connected.\n\n\n---\ntitle: Android NDK\nplatform: android\nsource: https://developer.android.com/ndk/guides/standalone_toolchain\n---\n\nThe Android NDK contains prebuilt versions of the native compiler and toolchain. Both the GCC and Clang compilers have traditionally been supported, but active support for GCC ended with NDK revision 14. The device architecture and host OS determine the appropriate version. The prebuilt toolchains are in the `toolchains` directory of the NDK, which contains one subdirectory for each architecture.\n\n| Architecture | Toolchain name |\n| --- | --- |\n| ARM-based | arm-linux-androideabi-<gcc-version> |\n| x86-based | x86-<gcc-version> |\n| MIPS-based | mipsel-linux-android-<gcc-version> |\n| ARM64-based | aarch64-linux-android-<gcc-version> |\n| X86-64-based | x86_64-<gcc-version> |\n| MIPS64-based | mips64el-linux-android-<gcc-version> |\n\nBesides picking the right architecture, you need to specify the correct sysroot for the native API level you want to target. The sysroot is a directory that contains the system headers and libraries for your target. Native APIs vary by Android API level. Available sysroot directories for each Android API level can be found in `$NDK/platforms/`. Each API level directory contains subdirectories for the various CPUs and architectures.\n\nOne possibility for setting up the build system is exporting the compiler path and necessary flags as environment variables. To make things easier, however, the NDK allows you to create a so-called standalone toolchain, which is a temporary toolchain that incorporates the required settings.\n\nTo set up a standalone toolchain, download the [latest stable version of the NDK](https://developer.android.com/ndk/downloads/index.html#stable-downloads \"Android NDK Downloads\"). Extract the ZIP file, change into the NDK root directory, and run the following command:\n\n```bash\n./build/tools/make_standalone_toolchain.py --arch arm --api 24 --install-dir /tmp/android-7-toolchain\n```\n\nThis creates a standalone toolchain for Android 7.0 (API level 24) in the directory `/tmp/android-7-toolchain`. For convenience, you can export an environment variable that points to your toolchain directory (we'll be using this in the examples). Run the following command or add it to your `.bash_profile` or other startup script:\n\n```bash\nexport TOOLCHAIN=/tmp/android-7-toolchain\n```\n\n\n# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0006.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0006.md)\n\n\n# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0007.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0007.md)\n\n\n# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0008.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0008.md)\n\n\n# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0009.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0009.md)\n\n\n# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0010.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0010.md)\n\n\n# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0011.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0011.md)\n\n\n# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0012.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0012.md)\n\n\n# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0013.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0013.md)\n\n\n# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0014.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0014.md)\n\n\n# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0015.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0015.md)\n\n\n# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0016.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0016.md)\n\n\n# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0017.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0017.md)\n\n\n# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0018.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0018.md)\n\n\n# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0019.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0019.md)\n\n\n# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0020.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0020.md)\n\n\n# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0021.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0021.md)\n\n\n# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0022.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0022.md)\n\n\n# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0023.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0023.md)\n\n\n# Android Skill\n\nPath: `tools/android/MASTG-TOOL-0024.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/OWASP/mastg/HEAD/tools/android/MASTG-TOOL-0024.md)\n\n\n"}