5

When arranging a pen test it's common practice to ask the client a set of questions, and use the answers either as the basis for further discussions, or to directly provide a test plan and quotation.

For a mobile app specifically, what questions are helpful to include? For example:

  • What platforms does the app support? e.g. iOS, Android
  • Was the app developed using a cross-platform framework? e.g. PhoneGap, Kivy
  • Does the app connect to it's own back-end service? e.g. bespoke REST, Firebase
    • Do these connections use SSL pinning?
  • Does the app provide additional UI secuity? e.g. PIN, FLAG_SECURE
  • Does the app provide IPC interfaces? e.g. URL handler, intent
  • Does the app interface with hardware? e.g. bluetooth card reader
  • Is the app obfuscated?
  • How is the app delivered? e.g. public store, private app in store, alternate store, sideloading
  • What authentication is used? e.g. pairing, user name & password, connect with Facebook
  • How many views/pages does the app have?
  • What permissions does the app request?
  • Does the app make arbitrary network connections or listen on ports?

If you have any other ideas, please let me know!

Improve this question
2
  • 1
    Is the app tamper proof,obfuscated and have root detection?
    – Arpit Rohela
    Jul 15, 2020 at 9:02
  • @ArpitRohela - Good idea about root detection. Obfuscation already included. What is tamper proof? (in the context of a mobile app)
    – paj28
    Jul 15, 2020 at 15:38

1 Answer 1

Reset to default
1

I found it rather important to say that not all apps are purely created with Java and XML, there are people who like to convert their website into an android app, in fact that's just a copy of their website displayed on 5" screen., not only because it's cheaper but also because it saves them time.

Some suggestions,

  • Is it a converted app? (in case it is converted from a webpage)
  • Which technologies has been used during the development process or in the app, such as HTML5 or javascript?
Improve this answer
1
  • 1
    Thanks, so change the PhoneGap/Kivy question to something more generic. Good idea
    – paj28
    Jul 15, 2020 at 15:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .