Quality Assurance

Mobile Hybrid App Security

• Objectives of Mobile Hybrid App Security Testing

• Mobile security testing tools

AGENDA

Objectives of Mobile Hybrid App Security Testing

• Identify vulnerabilities

  • Detect weaknesses in code, configuration, and architecture.

• Protect user data

  • Ensure sensitive information (passwords, tokens, personal data) is not stored or transmitted in plain text.

• Test resilience against attacks

  • Validate the app’s resistance to common threats (OWASP Mobile Top 10: XSS, MITM, SQLi, insecure storage, etc.).

• Assess security configurations

  • Review permissions, WebView settings, API integrations, certificates, and authentication mechanisms.

MobSF (Mobile Security Framework):

• An open-source tool that performs static analysis, dynamic analysis, malware analysis, and web API testing.

Mitmproxy:

• An open-source interactive HTTPS proxy that allows inspecting, modifying, and replaying traffic. Useful for testing API calls, identifying insecure data transmission, and simulating Man-in-the-Middle (MITM) attacks in mobile applications.

OWASP ZAP (Zed Attack Proxy):

• An open-source web application security scanner designed for finding vulnerabilities in web and API traffic. Supports automated scanning, fuzzing, and interception of requests, making it effective for testing mobile apps with backend services.