mobile-pentest

What problem does it solve?

Identifies security weaknesses in Android and iOS applications by combining static analysis, dynamic instrumentation, network interception, and storage inspection to find insecure storage, certificate pinning and root/jailbreak bypasses, and exposed secrets mapped to OWASP MASVS.

Core Features & Use Cases

• Static analysis: Decompile and inspect APKs/IPAs for hardcoded secrets, exported components, and insecure configuration using tools like JADX, apktool, class-dump, and otool.
• Dynamic instrumentation: Use Frida and objection to bypass SSL pinning, observe runtime behavior, and extract sensitive runtime artifacts.
• Network and storage inspection: Intercept traffic with a proxy, inspect SharedPreferences/NSUserDefaults, SQLite/Keychain, and validate TLS and certificate pinning controls.
• MASVS-aligned reporting: Map findings to OWASP MASVS categories and generate a structured findings report for remediation and compliance.
• Use Cases: Pre-release security assessments, bug bounty triage for mobile targets, and MASVS/MASTG compliance audits.

Quick Start

Request a full assessment of /tmp/target.apk to detect SSL pinning, exposed secrets, insecure storage, and produce a MASVS-mapped findings report.