Mobile App Security Checklist

Download the app from official stores or receive builds from the client for both iOS and Android.

Configure test devices with Frida, Objection, and proxy certificates installed.

Set up Burp Suite with SSL pinning bypass using Frida scripts or Objection.

Decompile the app to extract hardcoded URLs, API endpoints, and service configurations.

Document permissions requested and compare against functionality requirements.

Search for API keys, passwords, encryption keys, and credentials in decompiled code.

Review local storage mechanisms for sensitive data stored in plaintext.

Check for weak algorithms (DES, MD5), hardcoded keys, and improper IV usage.

Check for exported components, backup flags, debuggable settings, and ATS exceptions.

Identify outdated dependencies with known CVEs using dependency analysis tools.

Assess the effectiveness of ProGuard, R8, or iOS obfuscation mechanisms.

Verify the app rejects invalid certificates and test certificate pinning bypass resistance.

Monitor API calls for credentials, tokens, and PII transmitted over the network.

Verify token expiration, session handling, biometric authentication, and logout functionality.

Hook security-critical functions to bypass authentication, root detection, and integrity checks.

Craft malicious deep links to test for unauthorized actions or data access.

Review logcat/Console output and clipboard access for leaked credentials or tokens.

Use Frida scripts to circumvent root and jailbreak detection and test app behavior.

Access SQLite databases, Keychain/Keystore entries, and encrypted files on the device.

Exploit exported components and unvalidated URL schemes for unauthorized access.

Replay, modify, and forge API requests to test authorization and input validation server-side.

Modify the app to remove security controls and test for integrity verification.

Reference specific MASVS controls (e.g., STORAGE-1, NETWORK-2) for each finding.

Include code-level fixes for each platform, referencing secure coding guidelines.

Provide hooks and step-by-step instructions for developers to reproduce issues.

Illustrate how sensitive data moves between the app, device storage, and backend services.

Clean up all modifications made to test devices during the assessment.