A phase-by-phase mobile application pentest methodology. Covers iOS and Android — static, dynamic, network, and storage.
Mobile testing is half tooling, half patience. This is the workflow I use to not miss the obvious stuff: hardcoded keys in a strings dump, exported activities in the manifest, or a JWT that never expires.
mobile-pentest-playbook/
├── 01-scoping.md # Mobile-specific scope: devices, rooted/jailbroken, app versions
├── 02-static-analysis.md # Decompilation, manifest review, binary protections, secrets
├── 03-dynamic-analysis.md # Runtime instrumentation, Frida, Objection, hooking
├── 04-network-analysis.md # Traffic interception, SSL pinning bypass, MitM
├── 05-storage-crypto.md # Local storage, keychain, SharedPreferences, crypto audit
├── 06-auth-session.md # Mobile auth flows, biometric bypass, JWT in mobile context
├── 07-client-side.md # WebViews, deep links, URL schemes, IPC
├── 08-server-side.md # API testing from the mobile angle
├── 09-reporting.md # Mobile-specific evidence and severity
└── tools.md # The mobile toolkit
Start with static analysis (02) on a fresh IPA/APK. It finds the easy wins before you set up a device. Then move to dynamic (03) and network (04) with a jailbroken/rooted device.
active. Drawn from Tamago Brain/30 - Resources & Tools/32 - Cheatsheets/Mobile Application Pentest Cheatsheet.md and iOS static/dynamic analysis notes.
CC BY 4.0 for the writeups. MIT for any code snippets.