<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-mobile-penetration-testing
description: >-
  End-to-end mobile application penetration testing methodology covering
  reconnaissance, static/dynamic analysis, network interception, server-side
  testing, and reporting aligned with OWASP MASTG and PTES frameworks for
  Android and iOS applications.
domain: cybersecurity
subdomain: mobile-security
tags:
  - mobile-pentesting
  - owasp-mastg
  - penetration-testing
  - android
  - ios
  - frida
  - burp-suite
  - methodology
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1407", "T1409", "T1417", "T1422"]
  owasp-mobile: ["M1", "M2", "M3", "M4", "M5", "M6", "M7", "M8", "M9", "M10"]
  tools: ["frida", "objection", "mobsf", "burp-suite", "apktool", "jadx", "nuclei"]
---

# Performing Mobile Penetration Testing

## Overview

Mobile penetration testing systematically evaluates Android and iOS application
security through structured phases: reconnaissance, static analysis, dynamic
analysis, network testing, server-side testing, and reporting. Follows OWASP
MASTG methodology with MASVS verification coverage.

## Prerequisites

```bash
pip install frida-tools objection androguard
# apktool, jadx, Burp Suite, MobSF
# Rooted Android device or emulator
# Jailbroken iOS device (for iOS testing)
```

## Workflow

### Phase 1: Reconnaissance and Scoping

```bash
# Identify app details
aapt dump badging target.apk | grep -E 'package|sdkVersion|targetSdk'

# Identify technology stack
apkid target.apk                          # Detect frameworks, packers
grep -rn 'flutter\|react_native\|cordova\|xamarin' jadx_out/

# Map app functionality
# Document: login flows, payment, data entry, file upload, messaging
# Identify: API endpoints, third-party SDKs, analytics

# Gather OSINT
# App store reviews mentioning security issues
# Developer's other apps (shared code/APIs)
# Job postings revealing tech stack
```

### Phase 2: Static Analysis

```bash
# Decompile
apktool d target.apk -o apktool_out/
jadx -d jadx_out/ --deobf target.apk

# Manifest review
grep -E 'exported="true"|debuggable|allowBackup|cleartext' apktool_out/AndroidManifest.xml

# Secrets scan
grep -rn 'api_key\|password\|secret\|token' jadx_out/
grep -rn 'AKIA\|AIza\|ghp_\|sk-\|pk_' jadx_out/

# Code vulnerability patterns
grep -rn 'rawQuery\|execSQL' jadx_out/            # SQLi
grep -rn 'addJavascriptInterface' jadx_out/        # WebView bridge
grep -rn 'setJavaScriptEnabled' jadx_out/          # JS in WebView
grep -rn 'MODE_WORLD_READABLE' jadx_out/           # Insecure perms
grep -rn 'DES\|RC4\|ECB\|MD5' jadx_out/           # Weak crypto

# MobSF automated scan
docker run -it -p 8000:8000 opensecurity/mobile-security-framework-mobsf
# Upload APK → Review findings
```

### Phase 3: Dynamic Analysis

```bash
# Launch with Frida
frida -U -f com.target.app --no-pause
objection -g com.target.app explore

# Data storage checks
objection -g com.target.app explore -s "env"
objection -g com.target.app explore -s "android hooking search classes SharedPreferences"

# SSL pinning bypass
objection -g com.target.app explore -s "android sslpinning disable"

# Root detection bypass
objection -g com.target.app explore -s "android root disable"

# Runtime method hooking
objection -g com.target.app explore -s "android hooking watch class com.target.AuthManager"
```

```javascript
// Comprehensive Frida monitoring script
Java.perform(function() {
    // Monitor crypto operations
    var cipher = Java.use('javax.crypto.Cipher');
    cipher.doFinal.overload('[B').implementation = function(data) {
        console.log('[CRYPTO] Algorithm: ' + this.getAlgorithm());
        var result = this.doFinal(data);
        return result;
    };

    // Monitor HTTP connections
    var URL = Java.use('java.net.URL');
    URL.openConnection.overload().implementation = function() {
        console.log('[NET] ' + this.toString());
        return this.openConnection();
    };

    // Monitor Intent creation
    var Intent = Java.use('android.content.Intent');
    Intent.$init.overload('java.lang.String').implementation = function(action) {
        console.log('[INTENT] ' + action);
        return this.$init(action);
    };
});
```

### Phase 4: Network and API Testing

```bash
# Configure proxy and intercept traffic
# Burp Suite: Proxy > Options > Bind to all interfaces on 8080
# Device WiFi proxy: HOST_IP:8080

# After SSL pinning bypass, intercept all traffic
# Test each API endpoint for:

# Authentication flaws
curl -s API/login -X POST -d '{"user":"admin","pass":"admin"}'

# IDOR/BOLA
curl -s API/users/1/profile -H "Auth: USER_2_TOKEN"

# Injection
sqlmap -u "API/search?q=test" -H "Auth: TOKEN" --batch

# Rate limiting
for i in $(seq 1 100); do
  curl -s -o /dev/null -w "%{http_code}\n" API/login \
    -X POST -d '{"user":"test","pass":"wrong"}'
done | sort | uniq -c

# nuclei scan on API
nuclei -u https://api.target.com -t api/ -H "Authorization: Bearer TOKEN"
```

### Phase 5: Platform-Specific Checks

```
ANDROID CHECKLIST:
├── [ ] Exported components accessible without auth
├── [ ] Content providers leaking data
├── [ ] Broadcast receivers exploitable
├── [ ] Deep links validate input
├── [ ] WebView JavaScript bridge secured
├── [ ] Clipboard monitored for sensitive data
├── [ ] Screenshot prevention on sensitive screens
└── [ ] Backup does not contain secrets

iOS CHECKLIST:
├── [ ] Keychain items use proper access control
├── [ ] ATS exceptions minimized
├── [ ] URL schemes validated
├── [ ] Pasteboard cleared for sensitive data
├── [ ] Background snapshot contains no sensitive data
├── [ ] Touch/Face ID fallback secured
├── [ ] Extension data sharing restricted
└── [ ] Third-party keyboard blocked for sensitive inputs
```

### Phase 6: Reporting

```
REPORT STRUCTURE:
1. Executive Summary
   - Scope, timeline, methodology
   - Critical findings summary
   - Risk rating (Critical/High/Medium/Low/Info counts)

2. Technical Findings (per finding)
   [FINDING-XXX]
   Severity: Critical | High | Medium | Low | Info
   OWASP MASVS: MASVS-STORAGE-1 / MASVS-NETWORK-2 / etc.
   CVSS: X.X (vector string)
   Description: What was found
   Steps to Reproduce: Detailed reproduction steps
   Evidence: Screenshots, request/response, code snippets
   Impact: Business and technical impact
   Remediation: Specific fix with code examples
   Verification: How to verify the fix

3. OWASP MASVS Coverage Matrix
   MASVS-STORAGE:    [PASS] [FAIL] [N/A]
   MASVS-CRYPTO:     [PASS] [FAIL] [N/A]
   MASVS-AUTH:       [PASS] [FAIL] [N/A]
   MASVS-NETWORK:    [PASS] [FAIL] [N/A]
   MASVS-PLATFORM:   [PASS] [FAIL] [N/A]
   MASVS-CODE:       [PASS] [FAIL] [N/A]
   MASVS-RESILIENCE: [PASS] [FAIL] [N/A]
   MASVS-PRIVACY:    [PASS] [FAIL] [N/A]

4. Appendices
   - Tool versions and configurations
   - Full request/response captures
   - Frida scripts used
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Testing traffic | Proxy logs | Unusual API patterns from tester |
| Frida injection | Process monitor | Frida-server or gadget loaded |
| Root bypass | Integrity check | Detection mechanisms bypassed |
| Rapid API calls | Rate limiter | Automated testing patterns |

```yaml
title: Mobile Penetration Testing Detection
id: 82f58d78-2298-46ea-b8a5-d6ea5951d21d
status: experimental
description: Detects suspicious activity related to performing mobile penetration testing techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1407
  - attack.t1409
  - attack.t1417
  - attack.t1422
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] All OWASP MASVS categories tested
- [ ] Static analysis completed (source, manifest, secrets)
- [ ] Dynamic analysis completed (storage, crypto, network)
- [ ] SSL pinning bypassed and traffic intercepted
- [ ] API endpoints tested for auth/authz flaws
- [ ] Platform-specific checks completed
- [ ] Findings documented with reproduction steps
- [ ] Report delivered with MASVS coverage matrix

## References

- [OWASP MASTG](https://mas.owasp.org/MASTG/)
- [OWASP MASVS](https://mas.owasp.org/MASVS/)
- [PTES Mobile](http://www.pentest-standard.org/)
- [MITRE Mobile ATT&CK](https://attack.mitre.org/matrices/mobile/)
