Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Lets say I am performing penetration testing on mobile application, How significant is the version of operating system I am using while running the application?

I.e. if I test mobile application built for Android, is it important to check it both for Android 2.1 and for Android 4.2?

share|improve this question
up vote 5 down vote accepted

It largely depends, but there were some significant API changes between 2.1 and 4.2 which may change the way certain operations work on the device.

If you're looking at something like a music app, or a game, you're likely to find any vulnerabilities in operational code (credential handling, network stuff, buffers, etc.) rather than misuse of the API. However, if you're looking at a more in-depth app (e.g. an APK installer, a ROM manager, etc.) you're likely to find more unusual uses (or abuses) of the API, so that's a case where it's certainly worth checking on multiple versions and devices.

The exact same logic applies to iOS, though keep in mind a lot of apps will target a rather restricted set of iOS versions due to Apple's breaking changes between releases.

share|improve this answer

It depends on what you're testing. I've found that older devices are slightly easier to work with because you can mount them directly (they do not use MTP) and run your tools much quicker.

As Polynomial stated there were significant API changes in 2.1 through 4.2. In that time JavaScript support was greatly expanded, which may or may not be relevant to your tests.

If you look at the manifest.xml file you can determine what the targeted and supported SDK levels of the app which will give you a little more information. Most apps behave similar throughout version upgrade. However if you look at the application's code itself you will be able to view and sdk level specific code that you can use to determine extra tests that may be needed.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.