Testing and device labs
Network analysis, device automation and reproducible security tests.
Burp Suite for mobile API security testing
Burp Suite helps assess mobile back ends and HTTP traffic. Manage test certificates and client settings within an authorized laboratory.
Read the guideZAP for mobile back-end security testing
ZAP can investigate web and API behavior. Report native application protection and server access control as distinct test results.
Read the guidemitmproxy and Python traffic automation
mitmproxy connects traffic inspection with Python automation. Decide in advance how scripts will handle secret headers, user data and repeated operations.
Read the guideExamining mobile network behavior with Wireshark
Wireshark collects evidence about network behavior. An encrypted payload does not establish correct endpoint authentication or application authorization.
Read the guideCharles Proxy for mobile traffic inspection
Charles Proxy supports mobile connection diagnostics. Use separate test accounts, test certificates and controlled builds without weakening production verification.
Read the guideProxyman for mobile HTTP debugging
Observing HTTP flows with Proxyman can clarify client-server behavior. Keep each captured error associated with the message shown for that same transaction.
Read the guideHTTP Toolkit for mobile network inspection
HTTP Toolkit can help explain how requests are created and responses handled. Exceptions introduced for laboratory convenience must not remain in a release build.
Read the guideCaido for mobile API testing workflows
Caido can support request and response inspection in mobile API tests. Testing object and function access with authorized accounts goes beyond displaying traffic.
Read the guidetcpdump for mobile test-network captures
tcpdump records connection timing and packet flows. Define retention and access limits because captures may include personal data and network context.
Read the guideADB: a foundation of Android testing
ADB manages devices and applications in an Android laboratory. Its convenience does not justify leaving the same debugging access enabled for production users.
Read the guideAndroid Emulator for application testing
Android Emulator offers fast, repeatable development environments. Do not assume that all hardware and platform security features behave like those on physical devices.
Read the guideAppium for mobile RASP regression testing
Appium helps check that protection has not broken normal user flows. Verify interface completion separately from the correct server-side transaction outcome.
Read the guideMaestro for mobile flow automation
Maestro makes user flows easier to express as readable automation.
Read the guideDetox for React Native security regression
Detox can support React Native application testing. Assess the native security bridge and the behavior of the final release package separately.
Read the guideEspresso for Android security interface tests
Espresso tests Android interfaces. When protection rules change, use controlled accounts and data to check that legitimate users can still complete their tasks.
Read the guideUI Automator for Android system flows
UI Automator helps test interactions beyond the application's own interface.
Read the guideXCTest and XCUITest for iOS verification
XCTest and XCUITest assess iOS code and user flows. Security features requiring physical hardware or a final signed package need additional tests in the appropriate…
Read the guideFirebase Test Lab and device coverage
Firebase Test Lab can broaden device coverage. Include the processing of uploaded packages and test data in organizational data-management decisions.
Read the guideAWS Device Farm for mobile application testing
AWS Device Farm supports flow testing across devices. Record how the protection SDK classifies the laboratory environment and how it differs from ordinary user…
Read the guideCorellium for virtual mobile research
Corellium can provide a virtual mobile research environment. State how far its evidence represents physical hardware and production distribution.
Read the guideManaging Android test devices with scrcpy
scrcpy simplifies Android screen viewing and interaction in a laboratory.
Read the guidelibimobiledevice for iOS device communication
libimobiledevice is an ecosystem of tools for iOS device communication and supporting workflows. Evaluate access alongside device trust and authorized pairing conditions.
Read the guideiproxy for iOS test connections
iproxy supports connection forwarding for device communication. Keep laboratory access narrowly scoped and avoid exposing it unnecessarily to the wider network.
Read the guidePerfetto for RASP performance analysis
Perfetto helps investigate Android runtime behavior and performance. Assess protection overhead through timing, thread activity and device context together.
Read the guideNetwork Link Conditioner and poor-network testing
Poor connections expose security-protocol failure paths. Measuring latency, loss and connection changes matters as much as testing successful requests.
Read the guide