Mobile App Penetration Testing India | Android & iOS VAPT

Static Analysis (SAST) — Decompiling and Code Review

We begin by decompiling the application binary without running it. For Android, we use JADX and APKTool to recover the Java/Kotlin source code from the APK. For iOS, we analyse the IPA binary using Ghidra and class-dump. This phase uncovers:

• Hardcoded credentials and API keys — database passwords, API tokens, secret keys embedded in the source code
• Hardcoded endpoints — backend URLs, internal IP addresses, staging server references left in production builds
• Weak cryptographic implementations — use of MD5, SHA1, ECB mode, hardcoded IVs, or static encryption keys
• Insecure data storage patterns — storage of sensitive data in plaintext SharedPreferences, NSUserDefaults, or unprotected files
• Exported components (Android) — Activities, Services, BroadcastReceivers, and ContentProviders exported without proper permission checks
• Obfuscation assessment — evaluating whether ProGuard/R8 or equivalent is applied and whether it provides meaningful protection

Dynamic Analysis (DAST) — Runtime Testing

With the application running on a test device (rooted Android or jailbroken iOS), we perform real-time analysis of its behaviour. This covers:

• Network traffic interception — configuring Burp Suite as a proxy to intercept all HTTP/HTTPS traffic between the app and its backend, including traffic on non-standard ports
• SSL certificate pinning bypass — using Objection and Frida scripts to bypass certificate pinning mechanisms and intercept otherwise-encrypted traffic
• Runtime memory analysis — searching for sensitive data (PINs, passwords, session tokens) held in application memory using Fridump and Frida
• Log analysis — reviewing logcat (Android) and Console (iOS) for sensitive data leakage into application logs
• Clipboard and screenshot analysis — testing whether the application allows sensitive data to be copied to clipboard or captured in screenshots
• Emulator/root detection bypass — testing whether security controls can be bypassed on rooted or emulated environments

API Security Testing — Backend Vulnerabilities

Most mobile application vulnerabilities exist in the backend API, not the client application itself. This phase tests the API endpoints that the mobile app communicates with:

• Authentication testing — JWT weakness (algorithm confusion, weak signatures, none algorithm), OAuth misconfigurations, session token predictability
• Authorisation testing — IDOR (Insecure Direct Object Reference) allowing one user to access another’s data, privilege escalation via API parameter manipulation
• Injection attacks — SQL injection, NoSQL injection, command injection in API parameters
• Rate limiting — absence of rate limiting on authentication endpoints enabling brute-force attacks on PINs and OTPs
• Sensitive data exposure — API responses returning more data than the application displays (hidden fields exposing PAN, Aadhaar, account numbers)
• Mass assignment — API accepting user-controlled parameters that modify server-side security controls or user privileges

Business Logic Testing — Authentication Bypass and Privilege Escalation

Business logic vulnerabilities cannot be detected by scanners — they require a tester who understands how the application is supposed to work and tests what happens when the workflow is violated. Common findings in Indian banking and fintech applications include:

• OTP bypass by replaying a valid OTP from a different session or account
• Transaction limit bypass by manipulating the amount parameter in the API request
• Account takeover by exploiting password reset flows that verify identity with insufficient entropy
• Privilege escalation from regular user to admin by modifying a role parameter in a cookie or JWT claim
• Payment flow manipulation — initiating a high-value transaction and modifying the amount between the initiation and confirmation API calls

Reverse Engineering — Obfuscation and Tamper Protection Testing

We assess how effectively the application resists reverse engineering and tampering by an adversary who has obtained the binary. This includes testing whether obfuscation meaningfully obscures the application logic, whether anti-tamper controls detect and respond to modified binaries, whether root/jailbreak detection can be trivially bypassed, and whether the application can be repackaged with malicious code and distributed as a fake version without detection.