I am new in mobile application penetration testing. Just curious to know, whether we need to perform the penetration testing on rooted devices or non rooted devices.

Why and why not? I have searched lots of articles on this, but at last I thought to raise a question regarding this.

Lots of online tutorials perform the penetration testing on emulators (rooted), as root is a high privilege user, and root user has all the permissions to access anything of an particular application. So, is this accurate to perform the testing on rooted devices?

Request you to please clear my doubt regarding this.

  • 1
    it depends on the results you want to achieve - do you want to test the worst-case scenario or the common-case scenario? – schroeder Mar 22 '16 at 20:25
  • Treat it as complete penetration testing.. or for both worst case or common case scenario. Suppose, I have an application , I got some of the activity on androidmanifes.xml and those activities are exported=false, but I am able to invoke that activity using root user, can it will be treat as finding... as per my opinion...it will not treat as finding...as root user have all privileges to invoke any activity whether it is exported or not. – Acid Mar 22 '16 at 20:26
  • 1
    then it looks like you answered your own question: you have "rooted" and "non-rooted" findings – schroeder Mar 22 '16 at 21:29

I think, you have to see all possibilities, with a "rooted" device and with a "non-rooted" device. Firstly, the most important on android devices are the activities and their permissions, because an android application could have permissions which aren't necessary to execute certain activities, this could be a security issue.

I have tested some android applications, so in my opinion, they are interfaces like a web browser, the most of security issues could be on the server side, then maybe you could need only an "non-rooted" android device.

I recommend you to read "The mobile applications hacker's handbook" book, also the link: "The OWASP Top Ten Mobile Risks". You will see that the most of risks are on the server side.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.