Roadmaps Security roadmaps Offensive security and assessment
Assess and defend Android and iOS apps under authorisation: the mobile platform security models, the OWASP MASVS and MASTG, static and dynamic testing, and secure mobile development.
Estimated time: 12–24 months · At about 10 hours a week.
Offensive skills are for authorised testing only: your own lab, a practice platform, or a system whose owner has given you written permission. Testing anything else is a crime in most countries.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
App sandboxing, permissions, signing and secure storage on Android and iOS. The platforms do a lot of the defending; learn what they do and do not.
Insecure data storage, weak transport security, poor authentication and leaky logs. The MASVS and MASTG organise them clearly.
The APK format, components, the manifest, permissions and the runtime. Understanding the platform is most of Android testing.
App structure, entitlements, the keychain and code signing. iOS is more closed, which shapes how it is tested.
Emulators, a rooted or jailbroken test device you own, and deliberately vulnerable apps. Keep testing to apps and devices you control.
The MASTG gives a structured method with the MASVS as the requirements. Methodology keeps your testing complete and consistent.
Decompile and read an app for secrets, weak crypto, insecure storage and dangerous configuration. Much of the value is in careful reading.
Run the app and observe its behaviour, files and network calls on a device you control. Dynamic testing reveals what static analysis cannot.
Proxy the app's API calls to test the backend and transport security, handling certificate pinning on your own test device.
Tools such as Frida let you inspect and change app behaviour at runtime to understand and test it, on a device you own.
Check what the app stores and how: keychains, databases, preferences and caches, and whether sensitive data is protected.
A mobile app is a client to an API; most serious findings are in the backend. Apply API security testing to it.
Read decompiled code to understand logic, find hidden endpoints and spot flaws. Do this only on apps you are authorised to analyse.
Root and jailbreak detection, obfuscation and integrity checks raise the bar for attackers. Learn how they work and how they are assessed.
Biometrics, hardware-backed keystores, attestation and secure enclaves. Learn to use them in development and to assess their use.
Build apps to the MASVS: protect data, pin or validate transport, authenticate properly, and avoid leaking through logs and backups.
Apps collect location, contacts and identifiers, and store regulation now constrains this. Minimise collection and be transparent.
Write findings developers can fix, mapped to the MASVS, with clear reproduction and impact. The fixed app is the goal.
Set MASVS targets, embed testing in the mobile pipeline, and manage the risk across many apps and both platforms.
Test real apps legally within bug bounty scope, and contribute research and tooling. Stay strictly within each programme's rules.
Android and iOS change security models yearly. Follow the platform security releases and update your methodology.
Mobile apps hold personal and financial data, run on devices outside your control, and talk to backends over the network. Mobile security covers assessing apps for flaws, understanding the Android and iOS security models, and building apps that protect their data and their users.
This roadmap is a learning path for authorised testing and secure development, built around the OWASP Mobile Application Security project. Analyse only apps you own, apps built for practice, or apps within an engagement or bug bounty scope. The platform security models shape everything, so learn them first.
Billions of people run mobile apps, and many handle money and identity. Testers and developers who understand both platforms and can find or prevent the common flaws are in steady demand.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact