Security Testing Tips: Tips for Kick-Starting Mobile Security Testing

Security Testing Tips
Security Testing Tips

It may look like mountain (However, when you are climbing Himalayas it is not about *difficult*, it is about *challenges*. There is difference between difficult and challenge meaning in my opinion) when you start approaching mobile security testing, if you have been web security tester; this activity of starting-up mobile security testing may become easy compared to if you have not been web security tester. Either ways, you can look into these tips.

#1 Reverse engineering: Start using the tools and then you will understand what it can do and also you may understand the underlying architecture of the android / iOS device.

#2 There are lots of tools, do not get into automated ones till you get the mind-set of mobile security. I am telling this because, your learning may stop because you may feel that, “Wow, I am a mobile security tester now” and if you take it head; then THE END!

#3 Mobile security looks like infant area as of today, there is so much to do in it. You may want to become researcher if this area interests you. Be it mobile automation using JUnit or uiautomator for android or any other thing which can help you add value to your mobile app testing.

#4 I love using developer websites of Android and iOS, it helps me to learn “How to test better?” or “How to add value to my testing activity?” instead of just doing some functional testing. There is so much of information on the developer site, you will just love it if you are core technical person who crave for technical things which I think software tester need to be unless you are a scripted checker.
Reverse Engineering Way of Learning via Tools

Xcode – To view logs, debug application and get application data.
Burp suite – To monitor HTTP/HTTPS network traffic.
Snoop-it – For dynamic analysis of iOS Apps, to trace method calls analyze application flow.
iNalyzer – iOS Penetration testing framework (contains multiple utilities).
iFunBox – File system access of iOS device (jailbreak not required).
USBMux Proxy – Command line tool to connect local TCP ports to ports on an iPhone or iPod Touch device over USB.
Keychain dumper – To dump keychain entries on iOS devices.
Sqlite3 – To view contents of db files.
iRET – iOS Reverse Engineering Toolkit.
INTROSPY – Black box assessment of iOS apps.
Cycript – Runtime Analysis of iOS apps.
APK Extractor – The name says it all.dex2jar – It is a conversion utility to convert dex format to jar format.
MobiSec – Live Environment Mobile Testing Framework project is a live environment for testing mobile environments.

You may also want to look into https://www.isecpartners.com/tools/mobile-security.aspx, I must tell this; I am in so much love with these tools and then applying my test ideas to test mobile security. Happy Reverse Engineering Learning For Mobile Security Testing!

https://i0.wp.com/www.testingcircus.com/wp-content/uploads/security-testing-tips-7.png?fit=364%2C262&ssl=1https://i0.wp.com/www.testingcircus.com/wp-content/uploads/security-testing-tips-7.png?resize=150%2C131&ssl=1Santhosh TuppadSecurity Testing TipsSecurity Testing TipsSecurity Testing Tips: Tips for Kick-Starting Mobile Security Testing It may look like mountain (However, when you are climbing Himalayas it is not about *difficult*, it is about *challenges*. There is difference between difficult and challenge meaning in my opinion) when you start approaching mobile security testing, if you have been...