How do we perform Mobile App VAPT?


What we need from you is just the mobile app binaries. At Valency Networks, we believe in mimicking real life hackers. They have access only to your app's binaries and ideally that's all we expect from you. Once we are formally and professionally engaged with you to perform pentesting of your mobile app, we do ask few questions such as below

  • Is your mobile app developed using some framework, or uses native code?
  • Does your mobile app make calls you social media networks?
  • Does your mobile app support in-app purchases / bitcoins etc?
  • Does your mobile app embeds payment gateway within the app?
Mobile App Security Testing Company, How do we perform Mobile App VAPT?

There are few more questions besides above, which are relevant to your application's business functionality. We map all this to do threat modeling of your application and figure out how to perform the vulnerability assessment and penetration testing.

Once the app is mapped, we employ a very methodical, technical and systematic approach to perform penetration testing. While we use the detailed OWASP-Mobile-Top-10 model, the testing is broadly categorized into static analysis (data at rest) and dynamic analysis (data in transit). Please check this page to know how it is done.

What to expect from a Mobile App Pentest?

Mobile app penetration testing typically includes "data at rest" and "data in transit" security testing in context of the mobile application. This is true irrespective of whether it is Android app, or iOS app or Windows Phone app. Penetration testing tools are used as part of a penetration test to automate certain tasks, improve testing efficiency and discover issues that might be difficult to find using manual analysis techniques alone.

Two common penetration testing tool types are static analysis tools and dynamic analysis tools.Customers typically expect the app to be security tested end to end. This involves the mobile app binary as well as the backend web services. Manual penetration testing layers human expertise on top of professional penetration testing software and tools, such as automated binary static and automated dynamic analysis, when assessing high assurance applications.

A manual penetration test provides a wider and deeper approach to ensure great deal of accuracy, which is imperative for the hardening of mobile app from malicious attacks. While the vulnerability assessment does the task of finding security problems, the penetration testing proves that those findings actually do exist and shows ways to exploit those. Thus the penetration testing attempts to exploit security vulnerabilities and weaknesses of the app throughout the environment, attempting to penetrate both at the network level and key applications.

Mobile App Security Testing Company, Exploit Categories

Services for Mobile Application Penetration Testing

Vulnerabilities Detected, Mobile App Security Testing Company

  • Testing for popular Platforms and Devices
  • Testing for data at rest problems
  • Testing for data in transit problems
  • Testing for backend web services vulnerabilities
  • Testing for business logic specific problems
  • Testing for framework related inherent vulnerabilities
  • Testing for in-app purchases vulnerabilities
  • Testing for in-app social media usage vulnerabilities
  • Testing for in-app payment gateway calls vulnerabilities

The mobile application penetration testing methodology users OWASP Mobile Top 10 model to ensure that all angles of security threat vectors are tested. Valency Networks adopts an integrated approach that combines the strengths of manual penetration testing, jail breaking technology and mobile platform appropriate tools to identify security risks before they are exploited.

Mobile App Security Testing Features

Exploit Categories

  • On device code exploitation

  • Off device code injection

  • Called Web Service Exploits

  • Authentication problems

  • Configuration problems

  • SQLite Database related problems

Vulnerabilities Detected

  • Check for Weak Server Side Controls

  • Insecure Data Storage

  • Insufficient Transport Layer Protection

  • Unintended Data Leakage

  • Checks for Poor Authorization and Authentication

  • Client Side Injection

  • Security Decisions Via Untrusted Inputs

  • Improper Session Handling

  • Lack of Binary Protections

Standards Followed

  • OWASP Mobile Top 10 - 2014

Test Approaches

  • Rooting Android Device

  • Jailbreaking iOS Device

  • Without Rooting/Jailbreaking

Our Culture

Valency Networks is a very agile, friendly and fun loving atmosphere and yet we maintain a cutting edge technical vibrant work environment.