Mobile Application Security Testing

Review of all available information associated with the app. Typically including: reviewing design documentation & artifacts to confirm the primary & supplemental purposes, its design objectives, use, technology stack & intended user roles.

The application’s development and testing processes are examined for adherence to OWASP best practice. Additionally, hosting service level agreements are reviewed for any security shortcomings.

Risk Crew will provide a comprehensive report detailing vulnerabilities in design, development & deployment documentation with recommended remedial measures.

Security testers seek to identify security vulnerabilities. The app is evaluated for potential exploitable weaknesses in two states: both before & after its installation.

Typically, an evaluation would include assessing & conducting the following activities to identify associated security vulnerabilities:

Security testers seek to identify security vulnerabilities. The app is evaluated for potential exploitable weaknesses in two states: both before & after its installation.

Typically, an evaluation would include assessing & conducting the following activities to identify associated security vulnerabilities:

• File system analysis
• Package analysis
• Reverse engineering
• Static analysis
• Dynamic analysis
• Inter-Process Communication Endpoint Analysis
• Content providers
• Intents
• Broadcast receivers
• Activities
• Services

Risk Crew assess all mobile apps for vulnerabilities recognised in the OWASP Top 10 Mobile Risks list at a minimum.

All vulnerabilities identified, are then confirmed & documented for exploitation.

Each vulnerability is manually exploited by testers to provide documented evidence of “proof of exploit” to determine & confirm the remediate action required to mitigate the vulnerability.

All vulnerabilities identified, are then confirmed & documented for exploitation.

Each vulnerability is manually exploited by testers to provide documented evidence of “proof of exploit” to determine & confirm the remediate action required to mitigate the vulnerability.

This step is critical as it confirms the actual attack surface associated with the app.

Risk Crew documents a detailed report of findings & remedial recommendations.

Reports specify each vulnerability found, its level of severity, description, specific location where it exists, visual evidence of its exploitation and step-by-step instructions for its remediation.