Stack Exchange Network
Stack Exchange network consists of 181 Q&A communities including
Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
Visit Stack Exchange
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Anybody can ask a question
The best answers are voted up and rise to the top
2 years, 8 months ago
When arranging a pen test it's common practice to ask the client a set of questions, and use the answers either as the basis for further discussions, or to directly provide a test plan and quotation.
For a mobile app specifically, what questions are helpful to include? For example:
What platforms does the app support? e.g. iOS, Android
Was the app developed using a cross-platform framework? e.g. PhoneGap, Kivy
Does the app connect to it's own back-end service? e.g. bespoke REST, Firebase
Do these connections use SSL pinning?
Does the app provide additional UI secuity? e.g. PIN, FLAG_SECURE
Does the app provide IPC interfaces? e.g. URL handler, intent
Does the app interface with hardware? e.g. bluetooth card reader
Is the app obfuscated?
How is the app delivered? e.g. public store, private app in store, alternate store, sideloading
What authentication is used? e.g. pairing, user name & password, connect with Facebook
How many views/pages does the app have?
What permissions does the app request?
Does the app make arbitrary network connections or listen on ports?
If you have any other ideas, please let me know!
Jul 14, 2020 at 17:17
32.9k 8 8 gold badges 93 93 silver badges 130 130 bronze badges
I found it rather important to say that not all apps are purely created with Java and XML, there are people who like to convert their website into an android app, in fact that's just a copy of their website displayed on 5" screen., not only because it's cheaper but also because it saves them time.
Is it a converted app? (in case it is converted from a webpage)
Which technologies has been used during the development process or in the app, such as HTML
Jul 15, 2020 at 9:36
194 1 1 silver badge 13 13 bronze badges
By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our
Accept all cookies
Necessary cookies only