/mobile-pentest

name: mobile-pentest
description: >-
  Run a MASTG-based mobile penetration test (Android/iOS) combining static and
  dynamic analysis: storage inspection, traffic interception, platform-interaction
  abuse, and resilience checks. Use to actively test a mobile app you're authorized
  to assess.

Goal

Evidence-backed mobile findings from hands-on static + dynamic testing, mapped to MASVS controls and ranked.

Prerequisites

• Authorization to test; the app package; a test device/emulator; and a proxy for

traffic interception. Keep testing within scope and non-destructive.

Methodology (MASTG-aligned)

1. **Recon & static** — unpack the app; review manifest/Info.plist, permissions, exported components, secrets/keys in code or resources, and dependencies (cross-ref `sast-sca`). 2. **Storage** — inspect on-device data: shared prefs/UserDefaults, databases, files, keychain/keystore, caches, logs, backups, clipboard. 3. **Network** — intercept traffic; test TLS, certificate validation, and pinning (including pinning-bypass to assess robustness); look for cleartext/sensitive data. 4. **Platform interaction** — exercise exported activities/services, deep links, intent/IPC handling, WebView config (JS bridges, file access). 5. **Auth & session** — local auth/biometric bypass, token storage, session handling against the backend (`api-security`). 6. **Resilience** (if in scope) — root/jailbreak detection, anti-tamper, debugging.

Steps

Work the methodology; record per finding: control · technique · evidence · impact · remediation. Keep payloads benign and within scope.

Output

A findings table mapped to MASVS groups, ranked by severity. Confirmed issues → `security-reporting:finding`.

Notes

Mobile risk usually concentrates at the client↔backend boundary — pair this with `api-security` for the server side. Pinning-bypass and root-detection-bypass are to assess control robustness, not to attack out-of-scope systems.