How to Test security of the android mobile application?

Question

I am new to testing the security of applications.

I know basic security like invalid credentials, but I don't know much about security testing for mobile app.

Please tell me what all can I try to do a security test of a mobile app.

Answer 1

There are some nice points that you can cover with a cheat-sheet from the guys over at OWASP.

My suggestion is that you should try to go point-by-point in the list here

Long story short for android applications is the following:

• Get the APK file.

• Decompile the APK file

• Install the APK.

• Intercept the requests.

• Check for local storage

There are already a lot of tools in this App-Use, namely apktool, smali, baksmali, manifest explorer, jdgui, dex2jar, Android SDK, adb, burp suite, etc

Answer 2

To get started, may be you should refer the OWASP Mobile Security Testing Guide repository on Github.

It has tons of information, including what you should test, and how you should test, including information of tools which are used to test that particular scenario. It is a very active repository, with lots of activity happening everyday (Please star so that you can receive notifications).

The best part is that they start with the very basics - the architecture of both IOS and Android operating system and then build it from there.

Combined with the cheat sheet given in the other answer, you have a goldmine of scenarios for mobile security testing.

Answer 3

You can run static code analysis on the app.

This will give a detailed report on the possible security issues with your app.

There are some tools available which will help you to do so.

Infact I have designed a web application which runs this analysis on .apk or .ipa file which a user uploads and displays the result of the scan in HTML format.

Feel free to explore https://thesecurityscan.com/