3

Do we need to carry out separate pentest for apps that are written in language that supports multi platform compilation like fultter? How much value it will bring since backend and major chunk of code is same and some OS specific configuration are different.

Improve this question
2
  • 2
    Usually the platform specific code is the one that defines how securely data is saved on the mobile system (and there are other security relevant platform specific tests that should be performed). Also platform independent flutter code may be implemented differently on different platforms (which different security properties). Therefore I would strongly recommend to carry out platform specific tests.
    – Robert
    Commented May 16, 2022 at 15:54
  • Hi Robert, thanks for your comment but wouldn't that be covered in static analysis by tools like MobSF and alike? What value it will bring from a separate pentest? Because most of the inscope API calls will be same for both apps as backend is same?
    – Syed Anas
    Commented May 17, 2022 at 4:14

1 Answer 1

Reset to default
4

I'd suggest you do separate pen-tests because OS configurations could have some different exploits which you might've omitted.

Here are OWASP recommendations and Top 10 Mobile risks: https://owasp.org/www-project-mobile-top-10/

Here is a Mobile Security Testing Guide by OWASP as well: https://owasp.org/www-project-mobile-security-testing-guide/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .