Mobile (Android + iOS) — Offensive Testing Methodology
Quick Workflow
- Static: pull the IPA/APK, decompile, dump resources/strings, identify endpoints
- Dynamic: install on rooted/jailbroken device, hook with Frida, intercept TLS
- Map exported attack surface: deep links, URL schemes, exported components
- Storage / Keystore audit: where do secrets live, what protects them
- API: every backend the app talks to is your scope — test like a web app