MobileApp-Pentest-Cheatsheet

Mobile Application Penetration Testing Cheat Sheet

The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration testing topics and checklist, which is mapped OWASP Mobile Risk Top 10 for conducting pentest.

• Mobile Application Security Testing Distributions
• All-in-one Mobile Security Frameworks
• Android Application Penetration Testing
  • Reverse Engineering and Static Analysis
  • Dynamic and Runtime Analysis
  • Network Analysis and Server Side Testing
  • Bypassing Root Detection and SSL Pinning
  • Security Libraries
• iOS Application Penetration Testing
  • Access Filesystem on iDevice
  • Reverse Engineering and Static Analysis
  • Dynamic and Runtime Analysis
  • Network Analysis and Server Side Testing
  • Bypassing Root Detection and SSL Pinning
  • Security Libraries
• Mobile Penetration Testing Lab
• Contribution
• License

Mobile Application Security Testing Distributions

• Appie - A portable software package for Android Pentesting and an awesome alternative to existing Virtual machines.
• Android Tamer - Android Tamer is a Virtual / Live Platform for Android Security professionals.
• Androl4b - A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis
• Vezir Project - Mobile Application Pentesting and Malware Analysis Environment.
• Mobexler - Mobexler is a customised virtual machine, designed to help in penetration testing of Android & iOS applications.

All-in-One Mobile Security Frameworks

• Mobile Security Framework - MobSF - Mobile Security Framework is an intelligent, all-in-one open source mobile application (Android/iOS) automated pen-testing framework capable of performing static and dynamic analysis.
  • python manage.py runserver 127.0.0.1:1337
• Needle - Needle is an open source, modular framework to streamline the process of conducting security assessments of iOS apps including Binary Analysis, Static Code Analysis, Runtime Manipulation using Cycript and Frida hooking, and so on.
• Objection - Objection is a runtime mobile exploration toolkit, powered by Frida. It was built with the aim of helping assess mobile applications and their security posture without the need for a jailbroken or rooted mobile device.
• RMS-Runtime-Mobile-Security - Runtime Mobile Security (RMS), powered by FRIDA, is a powerful web interface that helps you to manipulate Android and iOS Apps at Runtime.