Mobile Pentest

---
name: mobile-pentest
description: "Use when testing an Android or iOS mobile application for security issues — insecure data storage, weak crypto, insecure communication, authentication, platform misuse, reverse engineering / tampering resistance, and hardcoded secrets. Follows OWASP MASTG/MASVS and covers static, dynamic, and network testing. Authorized engagements only."
---

# Mobile Application Penetration Testing

Assessment of Android/iOS apps following the **OWASP Mobile Application Security Testing Guide (MASTG)** and verified against the **MASVS** controls. Combines static (the package), dynamic (running app), and network testing.

## 0. Authorization gate
- [ ] Written authorization for the app + its backend/APIs.
- [ ] Test devices/accounts provided; jailbreak/root allowed?
- [ ] Backend testing scope (usually pair with `api-security-audit`).

## 1. Setup
- Obtain the build (APK/AAB, IPA). Prepare instrumented device/emulator.
- Intercept TLS via a proxy; handle certificate pinning (bypass only on your test build/device, in scope).

## 2. MASVS areas — test & fix

### Storage (MASVS-STORAGE)
- Inspect local storage: shared prefs, SQLite, keystore/keychain usage, cached files, logs, backups.
- **Look for:** PII/tokens/secrets stored in cleartext or world-readable locations.
- **Fix:** platform keystore/keychain, no sensitive data in logs/backups.

### Crypto (MASVS-CRYPTO)
- Hardcoded keys, weak algorithms, custom crypto, static IVs.
- **Fix:** platform crypto APIs, keys in hardware-backed keystore.

### Auth & session (MASVS-AUTH)
- Local auth bypass, insecure biometric gating, token handling, session invalidation.
- **Fix:** enforce auth server-side; biometrics gate local secrets, not trust.

### Network (MASVS-NETWORK)
- TLS validation, certificate pinning presence/quality, cleartext traffic.
- **Fix:** TLS everywhere, pin certs, disable cleartext.

### Platform interaction (MASVS-PLATFORM)
- Exported components (activities/services/receivers/providers), deep links, IPC, WebView misconfig (JS bridges, file access), clipboard/screenshot leakage.
- **Fix:** minimize exported surface, validate intents/deep links, harden WebViews.

### Code quality & resilience (MASVS-CODE / MASVS-RESILIENCE)
- Reverse engineering: decompile to review logic, find secrets/endpoints.
- Anti-tampering / root-jailbreak detection / obfuscation quality (resilience is defense-in-depth, not a primary control).
- **Fix:** never rely on client-side secrets or client-side security decisions.

## 3. Static + dynamic + backend
- **Static:** decompile, scan manifest/Info.plist, search for secrets/URLs, review permissions.
- **Dynamic:** runtime instrumentation to observe storage, crypto calls, and bypass client-side checks (in-scope build).
- **Backend:** the app's APIs almost always carry the real risk → run `api-security-audit`.

## 4. Tooling
apktool/jadx (Android), Hopper/Ghidra, Frida/Objection (dynamic instrumentation), MobSF (automated triage), proxy (Burp/ZAP), platform SDK tools.

## 5. Reporting
Per finding: MASVS control, platform, component, severity, reproduction, remediation. Emphasize that client-side controls are bypassable — real fixes live server-side. Checklist: `references/mobile-checklist.md`.

---
<sub>© 2026 noahfranklin · Part of the [Gideon](https://github.com/noahfranklin/gideon) security suite · MIT License · Original work.</sub>