Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Lets say I am performing penetration testing on mobile application, How significant is the version of operating system I am using while running the application?
I.e. if I test mobile application built for Android, is it important to check it both for Android 2.1 and for Android 4.2?
It largely depends, but there were some significant API changes between 2.1 and 4.2 which may change the way certain operations work on the device.
If you're looking at something like a music app, or a game, you're likely to find any vulnerabilities in operational code (credential handling, network stuff, buffers, etc.) rather than misuse of the API. However, if you're looking at a more in-depth app (e.g. an APK installer, a ROM manager, etc.) you're likely to find more unusual uses (or abuses) of the API, so that's a case where it's certainly worth checking on multiple versions and devices.
The exact same logic applies to iOS, though keep in mind a lot of apps will target a rather restricted set of iOS versions due to Apple's breaking changes between releases.
It depends on what you're testing. I've found that older devices are slightly easier to work with because you can mount them directly (they do not use MTP) and run your tools much quicker.
As Polynomial stated there were significant API changes in 2.1 through 4.2. In that time JavaScript support was greatly expanded, which may or may not be relevant to your tests.
If you look at the manifest.xml file you can determine what the targeted and supported SDK levels of the app which will give you a little more information. Most apps behave similar throughout version upgrade. However if you look at the application's code itself you will be able to view and sdk level specific code that you can use to determine extra tests that may be needed.
