OWASP Mobile Security Testing Training in Thimphu, Bhutan

This course introduces participants to OWASP Mobile Security Testing Guide (MSTG) and OWASP Mobile Application Security Verification Standard (MASVS) frameworks. It provides hands-on training on identifying, testing, and mitigating security vulnerabilities in Android and iOS applications. Through real-world examples, labs, and case studies, participants will gain the skills to perform mobile penetration testing, secure coding reviews, and risk assessments aligned with OWASP standards.

Foundations of Mobile Security Testing

1. Introduction to Mobile Security

   • Mobile ecosystem, threat landscape

   • OWASP MASVS and MSTG overview

   • Mobile App attack surface

2. Mobile Security Testing Environment Setup

   • Android & iOS lab setup (emulators, devices, proxies)

   • Installing and configuring tools (MobSF, Burp Suite, Frida, Drozer)

3. Static Analysis (SAST)

   • Reverse engineering APK/IPA files

   • Decompiled code review (JADX, Ghidra, Hopper)

   • Identifying hardcoded secrets, API keys, insecure configurations

Dynamic & Runtime Testing

1. Dynamic Analysis (DAST)

   • Setting up proxy-based testing

   • Testing authentication & session management flaws

   • Testing API calls, encryption, SSL/TLS security

2. Runtime Analysis & Instrumentation

   • Debugging and hooking with Frida/objection

   • Bypassing root/jailbreak detection

   • Exploiting insecure data storage

3. OWASP Mobile Top 10 Vulnerabilities

   • Insecure data storage

   • Insufficient cryptography

   • Insecure communication

   • Code tampering & reverse engineering

Advanced Testing & Reporting

1. iOS Security Testing

   • IPA extraction, jailbreak techniques

   • iOS-specific attack vectors

2. Advanced Mobile Exploitation

   • Runtime manipulation

   • Business logic flaws

   • Exploiting hybrid mobile apps

3. Secure Development & Mitigation

   • MASVS controls for Android/iOS

   • Secure coding practices

4. Reporting & Remediation

   • Writing a professional penetration test report

   • Mapping findings to OWASP MASVS/MSTG

Hands-on Exercises

Summary and Conclusion