1. Industry Standards & Frameworks

OWASP Mobile Security Testing Guide (MSTG)

The de facto standard for mobile app testing.

• Provides a testing methodology + checklist.
• Covers Android, iOS, and hybrid apps.
• Has mappings to the Mobile Application Security Verification Standard (MASVS).

Resource: https://mas.owasp.org

OWASP MASVS (Mobile App Security Verification Standard)

Defines levels of assurance:

• L1 — Standard security for all apps.
• L2 — Defense-in-depth (financial, healthcare, sensitive apps).
• R — Resilience against reverse engineering / tampering.

MSTG provides how to test MASVS requirements.

PTES (Penetration Testing Execution Standard)

Not mobile-specific, but the phases are universally applied:

• Pre-engagement → Intelligence Gathering → Threat Modeling → Exploitation → Reporting

NIST SP 800-163 (Guidelines for Vetting Mobile Apps)

Focuses on US federal compliance & risk assessment. Useful for regulated industries.

ISO/IEC 27034

Broader application security standard, sometimes referenced for mobile testing compliance.

2. Testing Methodology (Step-by-Step)

Think of it in phases — similar to network/web pentesting but adapted for mobile ecosystems:

Phase 1 – Pre-Engagement

• Define scope (Android, iOS, APIs, backend, devices).
• Define threat model: casual attacker, insider, advanced nation-state.
• Get required artifacts: APK, IPA, source code, test accounts.

Phase 2 – Recon & Static Analysis (SAST)

Decompile app and analyze offline. Look for:

• Hardcoded secrets (API keys, tokens, credentials).
• Debug code / developer logs.
• Insecure storage of sensitive data.

Tools: Android: JADX, apktool, MobSF. iOS: class-dump, Hopper, MobSF. Static analyzers: QARK, MobSF, SonarQube.

Phase 3 – Dynamic Analysis (DAST)

Run the app on real or emulated devices. Observe network traffic, API calls, storage behavior.

Tests include:

• Network Security: SSL pinning, MITM resistance, certificate validation.
• Runtime Protections: Root/jailbreak detection, code obfuscation bypass.
• Insecure IPC (Android intents, iOS URL schemes).

Tools: Burp Suite / OWASP ZAP (HTTP/S interception), Frida, Objection, Xposed modules.

Phase 4 – API & Backend Testing

Mobile apps are front-ends to APIs — test the APIs too:

• Broken authentication & session handling.
• Improper authorization (IDOR).
• Rate limiting.
• Input validation (SQLi, NoSQLi, XXE).

Tools: Burp Suite, Postman, mitmproxy.

Phase 5 – Reverse Engineering & Tampering

Assess resilience against reverse engineering. Attempt:

• Repackaging the app (modifying APK/IPA).
• Code injection, hooking sensitive methods.
• Debug bypass.

Tools: Frida, Objection, Ghidra, Hopper, Radare2, JADX.

Phase 6 – Local Storage & Device Interaction

• Check if sensitive data is stored insecurely:
  • Android: SharedPreferences, SQLite, External Storage.
  • iOS: NSUserDefaults, Keychain, plist files.
• Test inter-app communication (custom URL handlers, deep links, Android Intents).
• Verify clipboard usage (sensitive data leaks).

Phase 7 – Exploitation & Privilege Escalation

Attempt full exploitation paths and chaining of flaws:

• Weak SSL → MITM → Token Theft.
• Root/Jailbreak bypass → Extract storage.
• Reverse engineering → API key exposure.

Phase 8 – Reporting

• Map findings back to MASVS requirements.
• Provide risk ratings, PoCs, remediation steps.
• Include screenshots, code snippets, test logs.

3. Latest Techniques (2024–2025 Mobile Testing)

Current industry & attack trends:

• Bypassing SSL Pinning with Frida/Objection — still essential.
• AI/ML-based Mobile Apps — test prompt injection in embedded chatbots.
• Mobile Supply Chain Risks — malicious SDKs in ad/analytics libraries (XcodeGhost-style).
• Cryptographic Failures — insecure JWT handling in mobile APIs.
• Cloud Integration Issues — Firebase/Firestore misconfigs leaking user data.
• IoT/Device Integration — new attack surfaces from wearables, cars, smart home devices.
• Mobile Payment Testing — EMVCo, NFC-based app testing, and PCI DSS compliance.

Summary

Follow OWASP MSTG for detailed test cases; map findings to MASVS for assurance levels; use both static + dynamic analysis (MobSF, Frida, Burp); include API/backend testing — since most mobile vulnerabilities are server-side; test for reverse engineering resistance and tampering protections; align reports with compliance standards (NIST, PCI, ISO) if needed.