Mobile Security
Analyze Android and iOS apps for insecure storage, weak transport security, exposed components and backend flaws. Available on Hacker and above.
Analyze Android and iOS apps for insecure storage, weak transport security, exposed components and backend flaws. Available on Hacker and above.
How to scan
- Choose Android APK or iOS IPA as the target type.
- Upload the app file.
- Pick a scan mode and launch.
Results appear on the Mobile dashboard and under Vulnerabilities → Mobile, where every analyzed app is listed with its findings.
Android
APK analysis combines static and dynamic techniques.
- Static analysis — apps are decompiled and inspected for hardcoded secrets, insecure configuration, risky permissions, exported components and weak cryptography.
- Dynamic analysis — instrumentation with Frida and Objection observes runtime behavior, such as insecure data handling and certificate validation.
- Network behavior — traffic and the backend APIs the app talks to are tested for server-side weaknesses.
iOS
IPA analysis inspects the app bundle and its configuration.
- Static analysis — binary and bundle inspection for hardcoded secrets, insecure storage, weak transport settings and unsafe use of platform APIs.
- Backend testing — the APIs the app calls are exercised like any web target.
What gets reported
| Category | Examples |
|---|---|
| Data storage | Secrets in local storage, unencrypted databases, sensitive data in logs. |
| Transport security | Cleartext traffic, missing certificate pinning, weak TLS configuration. |
| Platform misuse | Exported components, insecure deep links, excessive permissions. |
| Code protection | Hardcoded keys, debuggable builds, weak obfuscation. |
| Backend | Authorization and injection flaws in the APIs the app depends on. |
Tips
- Upload a release build for realistic results.
- Add the app's backend as an additional web application target in the same scan.
- Provide test account credentials so agents can reach authenticated screens and APIs.