testing-mobile-api-authentication

name	testing-mobile-api-authentication
description	Tests authentication and authorization mechanisms in mobile application APIs to identify broken authentication, insecure token management, session fixation, privilege escalation, and IDOR vulnerabilities. Use when performing API security assessments against mobile app backends, testing JWT implementations, evaluating OAuth flows, or assessing session management.
domain	cybersecurity
tags	["mobile-security","android","ios","api-security","authentication","penetration-testing"]
subdomain	mobile-security
author	oyi77
version	1.0.0
license	Apache-2.0
nist_csf	["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"]

Testing Mobile Api Authentication

Overview

Cybersecurity skill for testing mobile api authentication. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "testing mobile api authentication"
• "Assessing mobile app backend API authentication during penetration tests"
• "Testing JWT token implementation for common vulnerabilities (none algorithm, wea"
• "Evaluating OAuth 2"

Use this skill when:

• Assessing mobile app backend API authentication during penetration tests
• Testing JWT token implementation for common vulnerabilities (none algorithm, weak signing)
• Evaluating OAuth 2.0 / OIDC flows in mobile applications for redirect, PKCE, and scope issues
• Testing for broken object-level authorization (BOLA/IDOR) in API endpoints

Do not use this skill against production APIs without explicit authorization and rate-limiting awareness.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Burp Suite or mitmproxy configured as mobile device proxy
• SSL pinning bypassed on target application (if implemented)
• Valid test account credentials for the target application
• Postman or curl for API request crafting
• jwt.io or PyJWT for JWT analysis and manipulation

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}