LoopyLuci Mobile Application Penetration Testing
Testing mobile application security — from APK/IPA analysis and traffic interception through runtime manipulation (Frida), data storage, and OWASP MASVS.
When to Use
- Assessing Android/iOS application security
- Testing mobile API security
- Performing runtime analysis with Frida
- Auditing local data storage on mobile devices
- Testing biometric and auth implementations
Mobile Testing Techniques
MOBILE_TESTS = {
'static_analysis': 'Decompile APK (jadx, apktool), IPA (class-dump), search for secrets, hardcoded keys',
'traffic_interception': 'Burp Suite proxy with CA cert installed on device — intercept HTTP/HTTPS',
'runtime_analysis': 'Frida — bypass SSL pinning, root detection, debug runtime, call methods',
'data_storage': 'Check SharedPreferences, SQLite, Realm, Keychain/Keystore, internal/external files',
'authentication': 'Biometric bypass (fingerprint, FaceID), local auth bypass, session persistence',
'deep_link': 'Abuse deep links/intent schemes for unintended behavior or injection',
}
# Frida SSL pinning bypass
FRIDA_SSL_PINNING = """
// Universal Android SSL pinning bypass
Java.perform(function() {
var SSLContext = Java.use('javax.net.ssl.SSLContext');
SSLContext.init.implementation = function(km, tm, random) {
var TrustManager = Java.registerClass({
name: 'com.example.TrustAll',
implements: [Java.use('javax.net.ssl.X509TrustManager')],
methods: {
checkClientTrusted: function() {},
checkServerTrusted: function() {},
getAcceptedIssuers: function() { return []; }
}
});
this.init(km, [TrustManager.$new()], random);
};
});
"""
# Android APK analysis
APK_ANALYSIS = [
"jadx app.apk — decompile to readable Java",
"apktool d app.apk — decode resources and smali",
"strings classes.dex | grep -E 'https://|api_key|secret|password'",
"drozer console connect — Android security assessment framework",
]
Verification Checklist
- APK/IPA decompiled and analyzed (strings, hardcoded secrets, manifest)
- Burp Suite proxy configured with device CA cert
- SSL pinning bypassed (Frida or objection)
- Data storage audited (SharedPreferences, SQLite, Keychain, plist)
- Authentication/biometric bypass tested
- Deep link / intent scheme abuse tested
- OWASP MASVS controls verified
- Root/jailbreak detection bypass tested
- API endpoints tested identically to web API pentest
- Data at rest encryption verified