I am trying to analyze on "what could be done from testing point of view" for testing a mobile app for (ios & Android) on "Application Security level". Here are the points that I wish to consider in my testing.
Malicious Functionality (Activity monitoring and data retrieval)
Unauthorized dialing, SMS, and payments
Unauthorized network connectivity (exfiltration or command & control)
System modification (rootkit, APN proxy config)
Sensitive data leakage (inadvertent or side channel)
Personally I always get a bit concerned about "what should I test" questions around security testing, because if you need to ask, you really shouldn't be doing security testing.
That said you need to start with a threat model do determine the potential attack vectors and then proceed from there. Your application really needs to follow some form of Security Development Lifecycle to ensure that the application is designed and built with security in mind.
This starts as a discussion with your architect, and stakeholders.
A good reference, which is also free and community driven, is the Mobile Security Testing Guide. It is a sister project to the OWASP Mobile Security Project. As the title suggests, it goes beyond just providing a "top ten" list, and provides details on security testing for mobile apps.
This would be a good place to start for most cases.
Mobile Application Testing is known as the testing of software application for mobile devices to verify their functionality, usability, security and performance to prevent fraud attacks on the mobile app, virus or malware infection to the mobile app.
Mobile Application Security Testing includes the following:
Vulnerabilities for hacking
Below are the Mobile App Security Testing tools:
Zed Attack Proxy: Is open-source security testing tool which is actively maintained by hundreds of international volunteers. It is easy to install and available in 20 different languages and also used as manual security testing.
QARK: IS an open-source tool that provides in-depth information about security vulnerabilities and generate a report about potential vulnerability and provide information about what to do in order to fix them.It highlights the issue related to the Android version also QARK scans all the component for security threats.enter link description here