Tutorial: Learn Mobile Security Testing from Scratch (2026)
Mobile security testing is essential in an era where apps handle sensitive user data, financial transactions, and personal communications. I started security testing after a penetration test revealed critical vulnerabilities in my own app, including insecure data storage and weak API authentication. The OWASP Mobile Top 10 provides a framework for identifying the most common mobile security risks, including insecure data storage, insecure communication, and insecure authentication. This tutorial covers practical security testing for both iOS and Android apps, including static analysis, dynamic analysis, network interception, and reverse engineering.
Mobile security testing involves testing the client-side app, the server-side API, and the communication between them. Tools like Burp Suite, Frida, objection, and MobSF (Mobile Security Framework) automate much of the analysis. For iOS, you need a jailbroken device or developer disk image for runtime analysis. For Android, rooted devices or emulators with Magisk give access to the filesystem. Understanding common vulnerabilities like insecure data storage, certificate pinning bypass, and deep link hijacking is critical for producing a thorough assessment report.
Setting Up Your Testing Environment
For Android testing, use a rooted device or Android emulator with Google APIs (non-production images). Install Frida server on the device for dynamic instrumentation. Set up Burp Suite as a proxy, configure the device's Wi-Fi proxy, and install Burp's CA certificate on the device. For iOS testing, use a jailbroken device or a checkm8-vulnerable device with palera1n. Install frida-ios-dump and objection. Set up a testing laptop with MobSF for automated static analysis, mitmproxy or Burp Suite for traffic interception, and jadx (Android) or Hopper/Ghidra (iOS) for decompilation. Use a separate testing network to avoid interfering with other devices.
# Install Frida tools
pip install frida-tools
# Push Frida server to Android
adb push frida-server /data/local/tmp/ && adb shell chmod 755 /data/local/tmp/frida-serverStatic Analysis with MobSF and Semgrep
Static analysis inspects the app binary and source code without executing it. MobSF (Mobile Security Framework) automates this: upload an APK or IPA, and get a report on permissions, hardcoded secrets, insecure API usage, and third-party library vulnerabilities. Semgrep with custom rules catches security anti-patterns like hardcoded API keys, improper certificate validation, and WebView JavaScript interface exposure. For Android, decompile with jadx to read Java/Kotlin source code. For iOS, use class-dump and Hopper to inspect Objective-C/Swift binaries. Check for insecure storage such as SharedPreferences, NSUserDefaults, SQLite databases without encryption, and local file permissions.
# Run MobSF on APK
python manage.py runserver 0.0.0.0:8000
# Upload APK via web interface, then review reportDynamic Analysis with Frida and Objection
Dynamic analysis runs the app and observes its behavior. objection is a runtime mobile explorer built on Frida. Launch it with objection -g com.example.app explore. Common tasks: disable certificate pinning (android sslpinning disable), dump keychain (ios keychain dump), hook crypto functions to capture keys, and list activities/view controllers. Frida scripts in JavaScript or Python let you intercept specific methods, modify return values, and trace function calls. For Android, hook the onCreate method of Activities to intercept intent data. For iOS, hook NSURLSession to inspect network requests. Use Frida's stalker for code tracing.
// Frida script to intercept Android crypto
Java.perform(function() {
var Cipher = Java.use('javax.crypto.Cipher');
Cipher.doFinal.overload('[B').implementation = function(input) {
console.log('Cipher.doFinal called'); return this.doFinal(input);
};
});Network Traffic Interception and Analysis
Intercept network traffic between the app and its backend servers. Configure Burp Suite as a proxy and install its CA certificate on the device. For apps with certificate pinning, use Frida's sslpinning disable script or objection's android sslpinning disable. For non-HTTP protocols, use mitmproxy with custom scripts. Analyze requests for authentication tokens in URLs, insecure data transmission, missing encryption, and verbose error messages. Check for privacy issues like transmitting device identifiers (IMEI, MAC address) without consent. For WebSocket testing, use Burp's WebSocket support or custom mitmproxy addons.
// mitmproxy script to log all requests
def request(flow):
print(f"{flow.request.method} {flow.request.pretty_url}")
if flow.request.content:
print(f"Body: {flow.request.content.decode(errors='ignore')}")Reverse Engineering and Binary Protection
Reverse Engineering the app binary reveals hardcoded secrets, proprietary algorithms, and API endpoints. For Android, use jadx to decompile DEX to Java, or JEB for more advanced analysis. For iOS, use Ghidra or Hopper Disassembler on the Mach-O binary. Common protections include ProGuard/R8 (Android), LLVM obfuscation, string encryption, and anti-debugging checks. Test whether obfuscation can be bypassed with Frida scripts that hook anti-tamper checks. Check for root/jailbreak detection and verify it can be bypassed. Assess whether the app detects debugging (android:debuggable flag, ptrace). Report on the effectiveness of protections without bypassing them unethically.
# Decompile APK with jadx
jadx -d output_dir app.apk
# Check for hardcoded URLs and API keys
rg -i "api_key|secret|password|https://api\." output_dir/Reporting and Remediation Best Practices
A security testing report should include an executive summary, methodology, severity ratings (using CVSS), and detailed findings with proof of concepts. Each finding should include the affected component, impact, likelihood, and remediation steps. Common findings: insecure data storage (fix: use EncryptedSharedPreferences or iOS Keychain), insecure communication (fix: enforce TLS with certificate pinning), weak authentication (fix: implement OAuth 2.0 with PKCE), and insecure WebView (fix: disable JavaScript if not needed, validate URLs). Provide developers with clear code examples for fixing each issue. Schedule regular retests after remediation.
// Secure storage example (Android)
val masterKey = MasterKey.Builder(context).setKeyScheme(MasterKey.KeyScheme.AES256_GCM).build()
val prefs = EncryptedSharedPreferences.create(context, "secure_prefs", masterKey, EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV, EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM)Frequently Asked Questions
Do I need a rooted/jailbroken device for all tests?
Not all tests require root. Static analysis and network interception work on unmodified devices with Burp Suite's CA installed. Root/jailbreak is needed for runtime hooking and filesystem access below the app sandbox.
What is the OWASP Mobile Top 10?
It is a standard awareness document listing the top 10 mobile security risks: M1 (Improper Platform Usage), M2 (Insecure Data Storage), M3 (Insecure Communication), M4 (Insecure Authentication), M5 (Insufficient Cryptography), M6 (Insecure Authorization), M7 (Client Code Quality), M8 (Code Tampering), M9 (Reverse Engineering), M10 (Extraneous Functionality).
How do I test certificate pinning validation?
Install Burp's CA certificate and set up proxying. If the app refuses to connect, certificate pinning is active. Use Frida to hook the certificate validation method (NSURLSession delegate or OkHttp HostnameVerifier) to bypass it and capture traffic.
What is the difference between SAST and DAST for mobile?
SAST (Static Application Security Testing) analyzes source code or binary without execution. DAST (Dynamic Application Security Testing) tests the running app. Both are necessary for comprehensive coverage. SAST catches coding issues, DAST catches runtime behavior.
Originally published on Ayodhyyya. Last updated June 1, 2026.