mobile-application agent is a mobile security specialist covering both Android and iOS platforms. It follows the OWASP Mobile Application Security Testing Guide (MASTG) and the Mobile Application Security Verification Standard (MASVS) v2.
Activating the agent
- TUI
- CLI
Press
Tab until mobile-application appears in the status bar, then describe your target application.Tools
| Tool | Platform | Use |
|---|---|---|
apktool | Android | APK decompilation and repackaging |
jadx | Android | DEX to Java source decompiler |
frida | Both | Dynamic instrumentation and hooking |
objection | Both | Runtime mobile exploration (Frida-based) |
drozer | Android | Android security assessment framework |
adb | Android | Android Debug Bridge for device interaction |
apksigner | Android | APK signature verification |
MobSF | Both | Automated static and dynamic analysis |
class-dump | iOS | Extract class information from Mach-O binaries |
otool / jtool2 | iOS | Binary analysis |
mitmproxy | Both | HTTP/HTTPS proxy for traffic interception |
nuclei | Both | Vulnerability scanning on discovered API endpoints |
ffuf | Both | API endpoint fuzzing |
Testing methodology
The agent runs five sequential phases, moving from static analysis through to business logic testing.Static analysis
Extract and decompile the application binary. For Android:
apktool d app.apk followed by jadx -d output app.apk. Review AndroidManifest.xml or Info.plist for permissions, exported components, backup settings, and debug flags. Search for hardcoded secrets, API keys, URLs, and insecure configuration values in decompiled source.Network analysis
Set up a proxy (mitmproxy or Burp Suite), install the CA certificate on the test device, and bypass certificate pinning if present using Objection (
objection --gadget "AppName" explore) or Frida scripts. Capture all API traffic during manual app usage and analyze authentication flows, token handling, and data in transit.Dynamic analysis
Install the application on a rooted Android device or jailbroken iOS device, or use an emulator. Hook with Frida/Objection to bypass root and jailbreak detection, monitor filesystem changes, watch logs and clipboard, and instrument crypto functions, auth checks, and API calls at runtime.
API security
Extract API endpoints from decompiled code. Test authentication and authorization on each endpoint. Check for IDOR, mass assignment, and rate limiting. Test input validation on all parameters. Search for hidden debug or internal API endpoints not exposed in the UI.
MASVS categories
MASVS-STORAGE: Data storage (7 checks)
MASVS-STORAGE: Data storage (7 checks)
Verifies that credentials are not stored in plaintext in SharedPreferences (Android) or unprotected Keychain items (iOS). Checks for sensitive data in logcat output, analytics SDKs, and crash reporters. Verifies the
allowBackup flag is disabled. Tests for data in keyboard cache, clipboard exposure during sensitive operations, and screenshot prevention with FLAG_SECURE or iOS equivalents.MASVS-CRYPTO: Cryptography (3 checks)
MASVS-CRYPTO: Cryptography (3 checks)
Checks for weak cryptographic algorithms (ECB mode, DES, MD5) and hardcoded encryption keys via static analysis. Verifies key storage uses Android Keystore or iOS Keychain. Confirms appropriate algorithms for each use case: AES-GCM for at-rest data, PBKDF2 or Argon2 for passwords, HTTPS for transit.
MASVS-AUTH: Authentication and authorization (3 checks)
MASVS-AUTH: Authentication and authorization (3 checks)
MASVS-NETWORK: Network communication (4 checks)
MASVS-NETWORK: Network communication (4 checks)
Confirms all connections use TLS — no plaintext HTTP endpoints or mixed content. Reviews TLS version and cipher suite configuration. Tests certificate pinning bypass using Objection (
android sslpinning disable) and Frida scripts. Reviews custom TrustManager implementations for validation flaws.MASVS-PLATFORM: Platform interaction (5 checks)
MASVS-PLATFORM: Platform interaction (5 checks)
Reviews permissions in
AndroidManifest.xml and Info.plist for over-permission. Tests deep link handlers and URL scheme processors for injection and auth bypass using adb shell am start. Tests exported Content Providers for SQL injection via Drozer. Reviews WebView configuration for JavaScript, file access, and mixed content settings.MASVS-CODE: Code quality (4 checks)
MASVS-CODE: Code quality (4 checks)
Verifies APK is signed with a valid certificate. Confirms release build flags — no
android:debuggable=true, no StrictMode in production, no test endpoints. Reviews error handling for verbose error messages or stack traces exposed to users.MASVS-RESILIENCE: Reverse engineering resistance (4 checks)
MASVS-RESILIENCE: Reverse engineering resistance (4 checks)
Tests root and jailbreak detection bypass using
objection --gadget "AppName" explore followed by android root disable or ios jailbreak disable. Tests anti-debugging protections. Tests file integrity and signature verification bypass. Reviews obfuscation quality via ProGuard/R8 and string encryption.Example workflows
Finding output format
Each finding the agent reports includes:- MASVS-ID — e.g.,
MASVS-STORAGE-1 - Title — e.g.,
Plaintext credentials in SharedPreferences - Severity — Critical / High / Medium / Low with CVSS score
- CWE — e.g.,
CWE-312 - Platform — Android / iOS / Both
- Evidence — Code snippet, screenshot, or traffic capture
- Impact — What an attacker could achieve
- Remediation — Specific fix recommendations