OWASP Mobile Top 10 · 2024 edition

OWASP Mobile Top 10 Challenges

Cover the OWASP Mobile Top 10 (2024) with hands-on Android and iOS challenges. Developers fix real vulnerabilities in real mobile apps — and build the habits that keep your releases off the incident report.

Book a Demo Explore the Mapping

Capability, not checkbox compliance

Hands-On Challenges for Every Category

The OWASP Mobile Top 10 (2024) is the benchmark for mobile application security. Every challenge below is a real Android or iOS app with a real vulnerability: developers fix it without breaking functionality, and every verified fix becomes reportable evidence of mobile security capability.

M1:2024

Improper Credential Usage

Hardcoded API keys, tokens and credentials shipped inside the app binary.

trivial

StartHere.android

Hardcoding secrets such as API keys, encryption keys, or sensitive credentials in mobile apps is a critical security risk because attackers can…

trivial

StartHere.ios

Hardcoding secrets such as API keys, encryption keys, or sensitive credentials in mobile apps is a critical security risk because attackers can…

M3:2024

Insecure Authentication/Authorization

Weak biometric, session or role checks that let attackers act as other users.

easy

Biometric.android

Android’s biometric authentication provides a secure way for users to authenticate using their fingerprint, facial recognition, or iris scan. It…

easy

Biometric.ios

Biometric authentication in iOS apps, such as Face ID or Touch ID, allows users to securely access app features or data using their unique biological…

M4:2024

Insufficient Input/Output Validation

Untrusted data from intents, deep links and IPC processed without validation.

easy

Intent.android

Android Intent is a messaging object used to request an action from another app component, facilitating tasks such as launching activities, services,…

M5:2024

Insecure Communication

Weak TLS configuration and unencrypted transport of sensitive data.

easy

SSL.android

A strong SSL/TLS cipher in Android protects data during transmission by encrypting it in a way that is difficult for attackers to break. Weak or…

M6:2024

Inadequate Privacy Controls

PII leaking through caches, memory residue, logs and analytics.

easy

GarbageCollector.android

In Android, static references to Activity or View classes can lead to significant memory leaks because static objects persist for the lifetime of the…

easy

PII.android

Keyboard caching improves user convenience, but it poses a significant security risk when handling personally identifiable information (PII) such as…

M7:2024

Insufficient Binary Protections

Apps shipped without obfuscation or integrity protections, making reverse engineering trivial.

easy

ProGuard.android

ProGuard is a tool in Android development that optimises, shrinks, and obfuscates code in an app. It makes reverse engineering more difficult by…

M8:2024

Security Misconfiguration

Over-broad permissions, exported components and unsafe WebView settings.

easy

BroadcastReciever.android

An Android BroadcastReceiver is a component that allows apps to listen for and respond to broadcast messages from the system or other applications.…

easy

Permission.android

Android permissions are a security mechanism that controls an app’s access to sensitive data and system features, such as the camera, location, or…

easy

Webview.ios

WebViews in iOS are components that allow apps to display web content within the app using a browser-like interface. They are often used to integrate…

M9:2024

Insecure Data Storage

Sensitive data written to SharedPreferences, UserDefaults or misused keychains.

trivial

SharedPrefs.android

SharedPreferences in Android is a lightweight mechanism for storing key-value pairs of primitive data types such as booleans, floats, ints, longs,…

easy

UserDefaults.ios

UserDefaults is a lightweight storage mechanism in iOS for saving small amounts of data, such as user preferences, app settings, and basic…

easy

Keychain.ios

The Keychain in iOS is a secure storage system designed for storing sensitive information like passwords, cryptographic keys, and authentication…

M10:2024

Insufficient Cryptography

Weak random number generation and broken cryptographic primitives.

easy

Random.android

A random number generator (RNG) in Android is a system function that produces unpredictable numbers used in security-critical tasks like generating…

easy

Random.ios

A random number generator (RNG) is a system function that produces unpredictable numbers used in security-critical tasks like generating encryption…

Roll it out

Turn the Standard Into a Training Program

Assign these challenges to your team as learning pathways, track verified fixes, and report OWASP Mobile Top 10 coverage to auditors, customers and the board — with evidence, not attendance sheets.

Book a Demo Browse all mobile challenges