conducting-mobile-app-penetration-test

name	conducting-mobile-app-penetration-test
description	Use when conducts penetration testing of iOS and Android mobile applications following the OWASP Mobile Application Security Testing Guide (MASTG) to identify vulnerabilities in data storage, network communication, authentication, cryptography, and platform-specific security controls. The tester performs static analysis of application binaries, dynamic analysis at runtime, and API security testing to evaluate the complete mobile attack surface.
domain	cybersecurity
tags	["mobile-pentest","OWASP-MASTG","Android-security","iOS-security","mobile-application-security"]
subdomain	penetration-testing
version	1.0.0
author	oyi77
license	Apache-2.0
nist_ai_rmf	["MEASURE-2.7","MAP-5.1","MANAGE-2.4"]
atlas_techniques	["AML.T0070","AML.T0066","AML.T0082"]
nist_csf	["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"]

Conducting Mobile App Penetration Test

Overview

Cybersecurity skill for conducting mobile app penetration test. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "conducting mobile app penetration test"

• "Conducts penetration testing of iOS and Android mobile applications following th"

• Testing mobile applications before release to identify security vulnerabilities and data protection issues

• Conducting compliance assessments against OWASP MASVS (Mobile Application Security Verification Standard) levels L1 and L2

• Evaluating the security of mobile banking, healthcare, or government applications handling sensitive data

• Testing mobile apps that interact with backend APIs to assess the end-to-end security of the mobile ecosystem

• Assessing mobile application resistance to reverse engineering, tampering, and runtime manipulation

Do not use against mobile applications without written authorization from the application owner, for distributing modified or repackaged applications, or for testing apps on the public app stores without a separate test build.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Target application IPA (iOS) and APK (Android) files or access to download from a private distribution channel
• Rooted Android device or emulator (Genymotion, Android Studio AVD) with Frida, Objection, and Magisk installed
• Jailbroken iOS device or Corellium virtual device with Frida, Objection, and SSL Kill Switch installed
• Static analysis tools: jadx (Android decompilation), Hopper/Ghidra (iOS binary analysis), MobSF (automated scanning)
• Burp Suite Professional configured as proxy for intercepting mobile app traffic with CA certificate installed on the test device

Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": ,
    : ,
    : ,
    : ,
}

 () -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}