mobile-pentest-plan

name	mobile-pentest-plan
description	Generate a mobile app penetration testing plan based on MASTG methodology and NowSecure practices. Use when planning a security assessment, defining test scope, creating a pentest checklist, or preparing for a mobile app security engagement.
disable-model-invocation	true
allowed-tools	["Read","Glob","Grep","Bash","Task","Write","WebSearch"]

Mobile Penetration Testing Plan Generator

You are a senior mobile penetration tester generating a comprehensive test plan based on OWASP MASTG methodology and NowSecure best practices.

Target

Analyze the codebase at: $ARGUMENTS

If no path is provided, analyze the current working directory.

Procedure

Phase 1: Reconnaissance & Scoping

Analyze the codebase to determine:

1. Application Type: Native Android, Native iOS, React Native, Flutter, Xamarin, Cordova, or other
2. Build Configuration: Debug/release variants, build flavors, signing configuration
3. API Endpoints: All backend URLs, API base URLs, WebSocket endpoints
4. Authentication Mechanism: OAuth, JWT, session-based, certificate-based
5. Third-Party Integrations: SDKs, payment processors, analytics, social logins
6. Sensitive Data Handled: PII, financial, health, credentials, encryption keys
7. Attack Surface: IPC entry points, deep links, WebViews, file providers

Phase 2: Static Analysis Test Plan

Define static analysis tests organized by MASVS category:

MASVS-STORAGE Tests

• Review local storage mechanisms (SharedPrefs, SQLite, Realm, Core Data, UserDefaults, Keychain)
• Check for sensitive data in application logs
• Analyze backup configuration and backup data contents
• Check clipboard handling for sensitive data
• Review keyboard cache and autocomplete behavior
• Inspect third-party keyboard compatibility
• Check for sensitive data in application snapshots/screenshots

MASVS-CRYPTO Tests

• Inventory all cryptographic operations and algorithms
• Verify key sizes and algorithm choices against NIST standards
• Search for hardcoded keys, IVs, and salts
• Verify secure random number generation
• Check key storage mechanism (KeyStore/Keychain usage)
• Verify no deprecated algorithms (MD5, SHA1, DES, RC4, ECB mode)

MASVS-AUTH Tests

• Analyze authentication flow for protocol weaknesses
• Check biometric authentication implementation (CryptoObject/Keychain integration)
• Verify session management (token expiration, refresh, revocation)
• Identify sensitive operations and verify step-up auth requirements
• Check for client-side authentication bypass opportunities

MASVS-NETWORK Tests

• Review Network Security Config (Android) / ATS settings (iOS)
• Search for cleartext traffic (HTTP URLs, unencrypted sockets)
• Check for custom TrustManager / certificate validation bypass
• Verify certificate pinning implementation and coverage
• Check WebView SSL error handling

MASVS-PLATFORM Tests

• Analyze exported components and their permissions (Android)
• Review Content Provider security (Android)
• Analyze deep link and URL scheme handlers
• Review WebView configurations (JavaScript, file access, JS bridge)
• Check for implicit Intent usage with sensitive data
• Verify PendingIntent security (FLAG_IMMUTABLE)

MASVS-CODE Tests

• Check minimum SDK / deployment target versions
• Inventory third-party dependencies and check for known CVEs
• Search for injection vulnerabilities (SQL, path traversal, JavaScript, command)
• Check for unsafe deserialization
• Review error handling for information disclosure

MASVS-RESILIENCE Tests

• Verify root/jailbreak detection implementation
• Check debug detection mechanisms
• Analyze code obfuscation (ProGuard/R8 config, symbol stripping)
• Check for Frida/Xposed/instrumentation detection
• Verify app integrity / signature checks

MASVS-PRIVACY Tests

• Inventory all permissions and assess necessity
• Check for device identifier usage (IMEI, ANDROID_ID, IDFA)
• Analyze analytics SDK configuration and data collection
• Verify consent mechanism implementation
• Check for PII in network traffic and logs

Phase 3: Dynamic Analysis Test Plan

Setup Requirements

• Test devices or emulators/simulators with the level of access needed for the planned dynamic analysis; rooted or jailbroken devices may be required for deeper inspection
• Proxy tool (Burp Suite, mitmproxy, Charles)
• Frida toolkit for runtime analysis, including frida-tools and r2frida where interactive instrumentation is useful
• Static and hybrid reverse-engineering tools appropriate to the platform, such as radare2, jadx, apktool, Hopper, or Ghidra
• Platform-specific tools: adb, objection, signing/build utilities, and device management tooling as needed

Dynamic Tests

• Network Traffic Analysis: Intercept and analyze all API calls
  • Verify TLS enforcement and pinning effectiveness
  • Check for sensitive data in request/response bodies and headers
  • Test API authentication and authorization enforcement
  • Check for PII in analytics traffic
• Runtime Analysis: Use Frida-based instrumentation for runtime inspection
  • Bypass root/jailbreak detection to test resilience
  • Hook biometric authentication to test bypass resistance
  • Inspect memory for sensitive data in plaintext
  • Test certificate pinning bypass
  • Use r2frida when interactive memory inspection, function tracing, or live patching will speed analysis
  • Use radare2 alongside runtime tooling when static triage is needed before or after instrumentation
• Local Storage Inspection: Examine data at rest on device
  • Dump and inspect SharedPrefs / UserDefaults
  • Extract and inspect SQLite databases
  • Check file permissions and data protection classes
  • Inspect Keychain/KeyStore entries
• IPC Testing: Test inter-process communication
  • Send crafted Intents to exported components
  • Test deep link handlers with malicious payloads
  • Query Content Providers for data leakage
• Authentication Testing: Test auth mechanism robustness
  • Token manipulation and replay attacks
  • Session fixation and hijacking
  • Biometric authentication bypass
  • Brute force / rate limiting verification

Phase 4: NowSecure Automated Testing Integration

Recommend NowSecure Platform integration points:

• Pre-commit: Automated static analysis on each code change
• CI/CD Pipeline: Full SAST + DAST on each build
• Release Gate: Compliance verification against MASVS checklist before deployment
• Post-Release: Continuous monitoring for new vulnerabilities
• Authenticated Testing: If supported by the tooling, use authenticated test flows to expand coverage beyond unauthenticated scans

Phase 5: Reporting Template

Define the report structure:

1. Executive Summary — Risk rating, critical findings count, compliance status
2. Scope & Methodology — What was tested, tools used, MASTG methodology reference
3. Findings — Each finding with:
   • Title, severity (CVSS 3.1), MASVS control, MASTG test ID
   • Description, reproduction steps, evidence (screenshots, code snippets)
   • Impact analysis
   • Remediation guidance with code examples
   • Verification steps
4. MASVS Compliance Matrix — Control-by-control pass/fail
5. Risk Summary — Findings by severity and category
6. Remediation Roadmap — Prioritized by risk and effort

Output

Write the test plan to PENTEST_PLAN.md in the project root with all phases, checklists, tool requirements, and timeline estimates organized by testing phase.