Mobile Application Security Testing: OWASP MASTG Guide for iOS and Android

Mobile Security Testing with OWASP MASTG

The OWASP Mobile Application Security Testing Guide (MASTG) provides a comprehensive framework for testing iOS and Android application security. Mobile apps face unique threats from reverse engineering, insecure local storage, and platform-specific vulnerabilities.

Testing Categories

Binary Analysis

Examine the compiled application:

• Decompile APK (jadx, apktool) or IPA
• Check for debugging enabled, backup allowed
• Identify hardcoded secrets and API keys
• Analyze anti-tampering and anti-debugging protections

Local Storage Inspection

Mobile apps often store sensitive data insecurely:

# Android shared preferences (often unencrypted)
/data/data/com.app/shared_prefs/user_data.xml

# iOS Keychain (check for accessible-always items)
# iOS plist files (often contain sensitive data)

Network Security

• Certificate pinning implementation and bypass testing
• TLS configuration validation
• API traffic interception and analysis
• Certificate transparency monitoring

Authentication and Session Management

• Biometric authentication implementation
• Token storage security (Keychain/Keystore)
• Session timeout and invalidation
• Jailbreak/root detection bypass

Reverse Engineering

• Code obfuscation effectiveness
• Dynamic instrumentation (Frida)
• Runtime manipulation
• API endpoint discovery

Platform-Specific Issues

Android

• Exported components (activities, services, receivers)
• Intent-based vulnerabilities
• WebView JavaScript bridge attacks
• Content provider data leakage

iOS

• URL scheme hijacking
• Pasteboard data leakage
• Snapshot caching of sensitive screens
• ATS (App Transport Security) configuration

Testing Tools

Where SuperClue Fits

SuperClue does not test mobile app binaries or local storage. Its DAST scanner tests the web APIs your app calls.