Mobile app assessment with MASVS: method, evidence and report
You learn to run a mobile app assessment end to end: scope and authorisation, the MASVS control groups, the test plan, collecting evidence, rating severity, writing the report and retesting fixes.
Level 301 · 22 lessons · 18 practice labs
Lessons
Scope and plan
- Kinds of assessment: design review, static review, full assessment
- The authorisation letter and rules of engagement
- The MASVS control groups and the testing guide (MASTG)
- Testing profiles: which depth for which app
- Writing the test plan
- Short task: prepare the scope and authorisation document for a health app
Testing the controls
- Storage and crypto controls: how evidence is collected
- Authentication and network controls
- Platform interaction and code quality controls
- Resilience and privacy controls
- Short task: mark ten controls pass, fail or not applicable using a prepared evidence set
Evidence and rating
- Good evidence: reproducible, dated, in context
- Rating severity on mobile: preconditions such as physical access and root
- Repeated findings and root causes
- Two platforms, one finding: writing the differences correctly
- Short task: rate eight findings, writing down their preconditions
Report and retest
- Structure of the report: executive summary, findings, control table
- Writing fix advice for developers
- Retesting and closing a finding
- Presenting results: two tellings, for developers and for managers
- Short task: retest three findings said to be fixed in the new build
Capstone
- Capstone: carry out the full assessment of a library membership app and deliver the report
Practice labs
- Choose the assessment type to fit the need: Choose design review, static review or full assessment for three requests and justify it.
- Prepare the scope and authorisation document for a health app: Write in-scope and out-of-scope assets, dates and contacts for the Lavinya Klinikleri app.
- Write a test plan to match the testing profile: Select MASVS control groups for the app's risk tier and plan the method and evidence type for each.
- Mark three storage controls using the evidence set: Tie each pass, fail or not-applicable decision to an evidence file.
- Assess ten controls with a prepared evidence set: Mark storage, crypto, authentication and network controls and write the evidence path.
- Identify missing evidence and write the collection step: Find the controls that cannot be decided and plan which evidence is needed and how to collect it.
- Fix a weak evidence record: Complete an undated, context-free output with the command, date and file hash.
- Write a finding with reproducible steps: Write steps another person can follow for the plaintext token finding.
- Reduce repeated findings to a root cause: Examine twelve findings, merge those from the same root cause and write four root-cause findings.
- Write the preconditions of a finding: State the physical access and lock state conditions for a local storage finding.
- Rate eight findings with their preconditions: Give each finding a severity and write the reason in one sentence.
- Rate the same finding separately on two platforms: Rate data that leaves via backup on Android but not on iOS, explaining the platform difference.
- Write the executive summary in five sentences: Draw a non-technical summary from the finding table.
- Write fix advice for a developer: Write concrete code-level advice and a verification method for three findings.
- Assemble the full report with the control table: Join the summary, findings, control table and scope limits in one document.
- Check a finding said to be fixed in the new build: Confirm in the new APK that the debug flag is off.
- Retest three findings and write their status: Give a closed, partly closed or open decision documented with new evidence.
- Deliver the full assessment of a library membership app: Assess the controls with the evidence set of Selvikent Belediyesi's library app, write the report and add the retest table.
About this course
You learn to run a mobile app assessment end to end: scope and authorisation, the MASVS control groups, the test plan, collecting evidence, rating severity, writing the report and retesting fixes.
What you will learn
- Scope and plan
- Testing the controls
- Evidence and rating
- Report and retest
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.