Mobile application security testing
Mobile apps carry data, credentials and business logic on a device the company does not control. The OWASP Mobile Application Security Verification Standard (MASVS) sets requirements in eight groups: storage, cryptography, authentication and authorization, network communication, platform interaction, code quality, resilience against reverse engineering and tampering, and privacy. The OWASP Mobile Application Security Testing Guide (MASTG) is the companion guide for testing Android and iOS apps against them.
What we do
- Mobile app assessments mapped to OWASP MASVS control groups
- Test plans built from the OWASP MASTG for Android and iOS
- Static and dynamic analysis with MobSF
- Runtime inspection with Frida and objection, without a jailbreak where possible
- Review of local storage, keys and cryptography use
- Network and certificate-validation checks
- Mobile backend and API authorization testing
- Findings with reproduction steps, fix guidance and retest
Tools we use inside a written scope: Mobile Security Framework (MobSF) for automated static and dynamic analysis of Android and iOS apps; Frida, a toolkit that injects JavaScript into running apps to inspect and change behavior at runtime; and objection, a runtime exploration toolkit built on Frida that works without a jailbreak. Automation finds the routine issues. Manual testing finds broken authorization, weak local storage and flawed business logic.
Experience with these tools and standards, not a partnership. Connects to our application security testing and secure software work.
Platforms and practices
- OWASP Mobile Application Security Verification Standard (MASVS)
- OWASP Mobile Application Security Testing Guide (MASTG)
- Mobile Security Framework (MobSF)
- Frida
- objection
- Android application security testing
- iOS application security testing
- Mobile API and backend testing
References
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.