mobile-pentest

What this skill does

Performs end-to-end penetration testing of Android and iOS mobile applications covering static analysis, dynamic instrumentation, network traffic interception, and data storage inspection. Maps findings to OWASP MASVS categories and produces a structured report.

When to use

• Security assessment of a mobile app before production release
• Bug bounty testing against Android APKs or iOS IPAs
• Verifying that cert pinning, root/jailbreak detection, and secure storage controls are implemented correctly
• Compliance validation against OWASP MASTG / MASVS

Prerequisites

Common tools

• frida / frida-tools — dynamic instrumentation framework
• objection — runtime mobile exploration toolkit (wraps Frida)
• Burp Suite — HTTP/S proxy for traffic interception
• MobSF (Mobile Security Framework) — automated static/dynamic analysis