PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Pentesting for Android Mobile Applications

hackerone.com | blog | #pentesting | #android | #mobile-security | #owasp | #hackerone | #ptasa | #masvs
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne outlines an Android pentesting methodology based on OWASP MASVS/MASTG, delivered through community-driven PTaaS to uncover vulnerabilities in mobile apps before attackers exploit them.
Published
Collected

Related coverage

blog · bishopfox.com
Unified Code, Unified Risks: Uncovering Vulnerabilities in .NET MAUI Applications
Bishop Fox shows how to bypass .NET MAUI's platform packaging to extract readable C# assemblies from Android and iOS apps, then use that shared-assembly insight to uncover critical vulnerability patterns in common business logic.
blog · projectzero.google
Hack The Galaxy: Hunting Bugs in the Samsung Galaxy S6 Edge
Project Zero researched the Samsung Galaxy S6 Edge and reported 11 high-impact security issues, discussing motivations, methodology and lessons learned from the device research.
blog · netspi.com
Fuzzing Parameters in CSRF Resistant Applications with Burp Proxy
A NetSPI walkthrough of CSRF basics and using Burp Proxy to fuzz parameters in CSRF-resistant apps, covering attack vectors from image tags to XSS-chained requests and why token fixes are imperfect.
blog · netspi.com
Presenting at OWASP AppSec Conference
A NetSPI preview of their OWASP AppSec talk on escalating privileges through database trusts, promising three root causes, three attack scenarios, and five fixes for weak app-DB configurations.
research · eshard.com
Can AI bring Mobile Application Security Analysis in-house?
Can AI bring mobile app security analysis in-house? See how Epoch's time travel traces and an AI agent test an Android app against OWASP MASVS.
research · eshard.com
Recording Android App Execution Traces with Time Travel Analysis
How to record Android app execution traces for time travel debugging. Covers emulator setup, snapshots, and trace generation for mobile security testing.
Back