All guides · Page 4
Browse by topic, or search for a specific concept, tool or platform.
Burp Suite for mobile API security testing
Burp Suite helps assess mobile back ends and HTTP traffic. Manage test certificates and client settings within an authorized laboratory.
Read the guideZAP for mobile back-end security testing
ZAP can investigate web and API behavior. Report native application protection and server access control as distinct test results.
Read the guidemitmproxy and Python traffic automation
mitmproxy connects traffic inspection with Python automation. Decide in advance how scripts will handle secret headers, user data and repeated operations.
Read the guideExamining mobile network behavior with Wireshark
Wireshark collects evidence about network behavior. An encrypted payload does not establish correct endpoint authentication or application authorization.
Read the guideCharles Proxy for mobile traffic inspection
Charles Proxy supports mobile connection diagnostics. Use separate test accounts, test certificates and controlled builds without weakening production verification.
Read the guideProxyman for mobile HTTP debugging
Observing HTTP flows with Proxyman can clarify client-server behavior. Keep each captured error associated with the message shown for that same transaction.
Read the guideHTTP Toolkit for mobile network inspection
HTTP Toolkit can help explain how requests are created and responses handled. Exceptions introduced for laboratory convenience must not remain in a release build.
Read the guideCaido for mobile API testing workflows
Caido can support request and response inspection in mobile API tests. Testing object and function access with authorized accounts goes beyond displaying traffic.
Read the guidetcpdump for mobile test-network captures
tcpdump records connection timing and packet flows. Define retention and access limits because captures may include personal data and network context.
Read the guideADB: a foundation of Android testing
ADB manages devices and applications in an Android laboratory. Its convenience does not justify leaving the same debugging access enabled for production users.
Read the guideAndroid Emulator for application testing
Android Emulator offers fast, repeatable development environments. Do not assume that all hardware and platform security features behave like those on physical devices.
Read the guideAppium for mobile RASP regression testing
Appium helps check that protection has not broken normal user flows. Verify interface completion separately from the correct server-side transaction outcome.
Read the guideMaestro for mobile flow automation
Maestro makes user flows easier to express as readable automation.
Read the guideDetox for React Native security regression
Detox can support React Native application testing. Assess the native security bridge and the behavior of the final release package separately.
Read the guideEspresso for Android security interface tests
Espresso tests Android interfaces. When protection rules change, use controlled accounts and data to check that legitimate users can still complete their tasks.
Read the guideUI Automator for Android system flows
UI Automator helps test interactions beyond the application's own interface.
Read the guideXCTest and XCUITest for iOS verification
XCTest and XCUITest assess iOS code and user flows. Security features requiring physical hardware or a final signed package need additional tests in the appropriate…
Read the guideFirebase Test Lab and device coverage
Firebase Test Lab can broaden device coverage. Include the processing of uploaded packages and test data in organizational data-management decisions.
Read the guideAWS Device Farm for mobile application testing
AWS Device Farm supports flow testing across devices. Record how the protection SDK classifies the laboratory environment and how it differs from ordinary user…
Read the guideCorellium for virtual mobile research
Corellium can provide a virtual mobile research environment. State how far its evidence represents physical hardware and production distribution.
Read the guideManaging Android test devices with scrcpy
scrcpy simplifies Android screen viewing and interaction in a laboratory.
Read the guidelibimobiledevice for iOS device communication
libimobiledevice is an ecosystem of tools for iOS device communication and supporting workflows. Evaluate access alongside device trust and authorized pairing conditions.
Read the guideiproxy for iOS test connections
iproxy supports connection forwarding for device communication. Keep laboratory access narrowly scoped and avoid exposing it unnecessarily to the wider network.
Read the guidePerfetto for RASP performance analysis
Perfetto helps investigate Android runtime behavior and performance. Assess protection overhead through timing, thread activity and device context together.
Read the guideNetwork Link Conditioner and poor-network testing
Poor connections expose security-protocol failure paths. Measuring latency, loss and connection changes matters as much as testing successful requests.
Read the guideSemgrep for mobile source-code security
Semgrep can identify selected security patterns in mobile source code.
Read the guideCodeQL for mobile code data-flow analysis
CodeQL contributes data-flow queries to code review. Make source and build coverage explicit; layers outside the analysis must not be assumed safe.
Read the guideSonarQube in mobile security development
SonarQube connects code-quality and security review to development workflows. Read reports in the context of the selected edition and supported analysis features.
Read the guideWhere Nuclei fits in mobile API testing
Nuclei automates template-based checks. In app protection work, it primarily assesses back ends and related services rather than on-device runtime defenses.
Read the guideGitleaks for secrets in mobile repositories
Gitleaks helps find secrets accidentally committed to source control. Removing a value may need to be followed by revocation and an investigation of its use.
Read the guideTruffleHog for secret discovery and verification
TruffleHog supports secret discovery and, where appropriate, validation.
Read the guideTrivy for mobile build-environment scanning
Trivy can assess dependencies and build environments used by mobile projects. Distinguish the selected scan mode from the components it actually examines.
Read the guideGrype for dependency vulnerability scanning
Grype links component inventories with known vulnerability information. A match still requires an assessment of whether the application is affected.
Read the guideSyft for software component inventories
Syft helps inventory software components. For mobile delivery, check native libraries and components introduced by protection as well as source dependencies.
Read the guideCycloneDX for mobile SBOM exchange
CycloneDX provides a standard ecosystem for sharing component and related security information.
Read the guideWhat OWASP Dependency-Check examines
Dependency-Check supports dependency risk assessment. Accurate package matching and the vulnerability's effect on real code paths are central to interpreting its reports.
Read the guideOSV-Scanner for dependency security
OSV-Scanner associates dependencies with vulnerability information. Verify that its input matches current lockfiles or the components actually distributed.
Read the guideAuditing Python tooling with pip-audit
pip-audit can assess dependencies used by Python mobile-analysis helpers. The environment that examines an application also needs security maintenance.
Read the guideBandit for Python security code review
Bandit finds selected security patterns in Python. It adds a review layer for file, network and secret handling in mobile-analysis scripts.
Read the guideRuff for dependable Python analysis scripts
Ruff improves Python code quality and consistency. Clean lint output does not prove that a cryptographic protocol or mobile security test is correctly designed.
Read the guidepytest for mobile security helper verification
pytest can verify security-helper behavior. Invalid packages, missing fields and verification failures deserve coverage alongside normal inputs.
Read the guideHypothesis for property-based Python testing
Hypothesis explores unexpected inputs through property-based tests. It produces useful evidence when mobile-verification helpers have clearly defined invariants.
Read the guidePython cryptography for verification tools
The cryptography library supports signing, verification and encryption helpers. Safe API selection must be paired with sound key management and protocol context.
Read the guideRequests for secure test clients
Requests is widely used in Python test clients. Configure certificate verification, timeouts, retries and secret-header logging deliberately.
Read the guideScapy for network protocol research
Scapy supports protocol research and controlled laboratory automation. Define authorization, collection limits and test scope before using it beyond the laboratory.
Read the guideYARA for mobile package pattern matching
YARA searches files for defined patterns. A match is an investigation input, not sufficient evidence of malicious behavior or failed protection.
Read the guidefastlane in a RASP delivery pipeline
fastlane automates mobile delivery steps. Design protection, signing and store-upload order together with trustworthy records and secret management.
Read the guideGradle for Android RASP integration
Gradle controls dependencies, variants and task order in Android protection integration. Acceptance must examine the final package as well as source configuration.
Read the guideXcode in the protected iOS build process
Xcode is central to iOS building, signing and diagnostics. Assess a security SDK against the final IPA, entitlement set and matching symbol archive.
Read the guideGitHub Actions for mobile security gates
GitHub Actions can connect security gates to delivery. Control untrusted contributions' access to release secrets and preserve the identity of approved artifacts.
Read the guide