Security Tip 101: Assessing the attack surface of mobile applications

Security engineers often neglect mobile applications when assessing the attack surface of an enterprise. This is somewhat surprising since most traffic are from mobile devices through designated apps. It even gets more difficult in that many of the security solutions we have today, have not been customized for mobile-based attacks.

Today, I will highlight the best open source security tools for mobile apps.

Ps: the ones I use

  • Apktool (great for reverse engineering)
  • MobSF (complete framework)
  • Qark (complete framework)
  • MSTG (from OWASP)
  • Keytool (great for certificate-based attacks)
  • Dex2Jar (reverse engineering)