Mobile Methodologies

Mobile Application Penetration Testing Methodology

Review Cobalt pentest methodologies for mobile applications.

:::info Mobile application penetration testing is a process in which a tester uses simulated attacks to identify potential security vulnerabilities in a mobile application.

:::

We follow an industry-standard methodology primarily based on the OWASP Mobile Application Security Verification Standard (MASVS) and Testing Guide (MASTG). Learn more about the OWASP Mobile Application Security (MAS).

Penetration testing of a mobile application includes the following stages:

• Target scope reconnaissance
• Automated and manual testing
• Exploit discovered vulnerabilities
• Reporting, triaging, and retesting

Cobalt pentesters do not need access to the source code of your application, unless you specify it as a requirement.

We look at application logic by working with your app. To support our pentesters, share the IPA (iOS) and/or the APK (Android) files when you Define Your Assets. You may also share this information in the private Slack channel for your pentest.

Target Scope Reconnaissance

Based on the pentest brief prepared by the client, Cobalt pentesters search for information about the targets and investigate the scope. This information includes:

• Understanding workflows
• Understanding business logic
• Mapping the attack surface of the application

Pentesters then confirm that they can:

• Reach and scan the targets
• Test the functionality of the application

Automated and Manual Testing

Our pentesters use a range of manual techniques and automated tools to ensure proper coverage. They analyze your mobile app dynamically. They also assess the archive as well as the local file.

Our pentesters focus on:

• Communication channels
• Traffic that the application exchanges with external endpoints
• Inter-Process Communication (IPC)

Our pentesters may also reverse engineer the application for insight and try to access sensitive data.

For backend tests, they use API Pentest Methodologies.

:::info

Tools

Cobalt pentesters may use tools such as:

• MobSF
• Frida
• Apktool
• Dex2Jar
• Objection

The tools that our pentesters use during each phase may vary from test to test.

:::

Exploit Discovered Vulnerabilities

When our pentesters discover a vulnerability, they use various techniques to measure the impact on the following aspects of your data:

• Confidentiality
• Integrity
• Availability

Our pentesters use various techniques to exploit data storage, platform permissions, and other relevant security controls.

Reporting, Triaging, and Retesting

Cobalt pentesters report and triage all vulnerabilities during the assessment. You can review details of all findings, in real time, through the Cobalt platform. In these findings, as well as in any report, Cobalt’s pentesters include detailed information, including:

• Step-by-step remediation guidance
• Recommendations on how to improve your overall security posture

You can remediate findings during and after the pentest. Then you can submit findings for retest. Our pentesters test the updated components and retest vulnerabilities to ensure that there are no security-related residual risks.