wtf is mastg-hacking-playground?

The MASTG Hacking Playground is a collection of intentionally insecure iOS and Android mobile apps designed to help people learn about mobile security vulnerabilities. These are practice targets, deliberately flawed apps you can poke at to understand what makes real applications vulnerable. The apps contain known security weaknesses drawn from the OWASP Mobile Application Security Testing Guide, a broader set of standards for evaluating mobile app security. Each app maps specific vulnerabilities to corresponding test cases in that guide, so after you find a flaw in the playground app, you can read the guide to understand why it's dangerous and how to fix it. The project serves three main audiences. Developers can look at the vulnerable code and see the real consequences of common mistakes, then learn best practices to avoid them. Security researchers and penetration testers can use the apps to practice identifying dangerous code patterns they'd need to hunt for when auditing real apps. The apps are also used in training workshops and educational settings for hands-on learning. The repository includes an Android Java app, an Android Kotlin app, and an iOS Swift app. The Kotlin and iOS apps require a small backend server to run, which is included in the repo. The Java app runs on its own. Each app lists its available test cases in a wiki so you know what vulnerabilities are waiting to be found. The project is part of the broader OWASP Mobile Application Security ecosystem, which also includes separate "crackme" challenges focused on reverse engineering practice. The project is currently maintained by a single developer and welcomes contributions, whether that means adding more vulnerability scenarios, improving the apps, or fixing bugs.