mobile-audit

Name: mobile-audit
Author: briiirussell

320stars36forks

How to install mobile-audit?

briiirussell/cybersecurity-skills/mobile-audit

$npx -y skills add briiirussell/cybersecurity-skills --skill mobile-audit

Installs into the current project.

Summary

Audit iOS and Android mobile applications against OWASP MASVS / MASTG — insecure storage, weak crypto, certificate pinning, deeplinks, IPC, jailbreak/root detection, reverse-engineering resistance. Use when the user mentions 'mobile security,' 'iOS security,' 'Android security,'

Files · 1

View on GitHub

SKILL.md

1	# Mobile Audit — iOS & Android Application Security Review
2
3	Audit mobile apps against the OWASP Mobile Application Security Verification Standard (MASVS) and Mobile Application Security Testing Guide (MASTG). Covers source code review, static analysis of compiled binaries, and runtime testing.
4
5	Scope: this skill covers the app and its interaction with the device, the backend, and other apps. For backend API security, pair with `api-audit`. For dependency CVEs (CocoaPods, SPM, Gradle), pair with `dependency-audit`.
6
7	## Authorization Check
8
9	Before reverse-engineering or runtime-testing a binary, confirm:
10	1. The app is yours, or you have written authorization from the publisher
11	2. You're operating in an environment you control (test device, emulator, dedicated sandbox)
12	3. App store ToS — Apple and Google generally allow security research on apps you own; testing competitor apps without authorization is a fast path to legal exposure
13
14	If unclear, ask before proceeding.
15
16	## Audit Checklist — MASVS-STORAGE (Sensitive Data Storage)
17
18	- iOS: keychain items use the strongest available `kSecAttrAccessible` class — `kSecAttrAccessibleWhenUnlockedThisDeviceOnly` or `kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly`. Avoid `Always` and `ThisDeviceOnly`-less variants
19	- iOS: no secrets in `NSUserDefaults`, plist, or app bundle — `strings <app>.ipa` should not reveal API keys or secrets
20	- Android: secrets in EncryptedSharedPreferences / Keystore-backed encrypted storage, not raw SharedPreferences
21	- Android: `android:allowBackup="false"` in the manifest (or backup rules carefully scoped) — otherwise `adb backup` extracts everything
22	- Both: no PII / tokens written to logs that survive a crash (NSLog, Log.d, third-party crash reporters)
23	- Both: Pasteboard / Clipboard access — sensitive fields don't auto-share to system clipboard (iOS `pasteboard.expirationDate`, Android `ClipDescription.EXTRA_IS_SENSITIVE`)
24	- Both: the OS app-switcher screenshot doesn't capture sensitive screens — iOS `applicationDidEnterBackground` blur, Android `FLAG_SECURE` on the activity
25
26	## Audit Checklist — MASVS-CRYPTO (Cryptography)
27
28	- No hardcoded keys in the app bundle — `strings`, `class-dump`, `apktool` reveal embedded constants
29	- Modern algorithms only — AES-GCM, ChaCha20-Poly1305; reject AES-ECB, DES, RC4, MD5, SHA-1
30	- Random number generation uses `SecRandomCopyBytes` (iOS) / `SecureRandom` (Android) — not `arc4random()` for crypto, never `Math.random()`
31	- Key derivation from passwords uses PBKDF2 with ≥ 600,000 iterations (OWASP 2024) or Argon2id
32	- IVs / nonces are not reused — if you see `iv = "0000000000000000"`, that's worse than no encryption (reveals plaintext patterns)
33	- Don't roll your own crypto — flag any custom encryption scheme; bias toward libsodium / Tink
34
35	## Audit Checklist — MASVS-NETWORK (Network Communication)
36
37	- iOS: App Transport Security enabled — no global `NSAllowsArbitraryLoads = true`. If exceptions exist, they're specific domains, justified, and documented
38	- Android: `network_security_config.xml` exists and enforces cleartext-traffic refusal — `<base-config cleartextTrafficPermitted="false">`
39	- Both: Certificate pinning for high-trust backends — public-key pinning preferred over certificate pinning (survives cert rotation). For iOS: `URLSessionDelegate` + `URLAuthenticationChallenge`; Android: `NetworkSecurityConfig` `<pin-set>` or OkHttp `CertificatePinner`
40	- Both: Pinning has a backup pin — pinning to a single cert means the next rotation breaks the app for all users
41	- WebView usage — `WKWebView` only (iOS, not `UIWebView`); JavaScript bridge audited; `setJavaScriptEnabled(false)` if the WebView doesn't need JS
42	- WebView `loadUrl` with user-controlled URL — open redirect, intent-spoofing, phishing surface
43
44	## Audit Checklist — MASVS-AUTH (Authentication & Session)
45
46	- Biometric prompts use `LAContext.evaluatePolicy` (iOS) / `BiometricPrompt` (Android) — not the deprecated `FingerprintManager`
47	- Biometric auth is bound to keychain/keystore access, not just a UI check (`SecAccessControl.biometryAny`, Android `KeyGenParameterSpec.setUserAuthenticationRequired(true)`)
48	- Session tokens stored in keychain/keystore (not SharedPreferences/NSUserDefaults)
49	- Refresh-token flow — short-lived access token, refresh token revocable server-side
50	- OAuth flows use the pl

People who liked this also viewed

6 picks

Type

mobile-audit

320stars36forks

View on GitHub

How to install mobile-audit?

briiirussell/cybersecurity-skills/mobile-audit

$npx -y skills add briiirussell/cybersecurity-skills --skill mobile-audit

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Mobile Audit — iOS & Android Application Security Review
2
3	Audit mobile apps against the OWASP Mobile Application Security Verification Standard (MASVS) and Mobile Application Security Testing Guide (MASTG). Covers source code review, static analysis of compiled binaries, and runtime testing.
4
5	Scope: this skill covers the app and its interaction with the device, the backend, and other apps. For backend API security, pair with `api-audit`. For dependency CVEs (CocoaPods, SPM, Gradle), pair with `dependency-audit`.
6
7	## Authorization Check
8
9	Before reverse-engineering or runtime-testing a binary, confirm:
10	1. The app is yours, or you have written authorization from the publisher
11	2. You're operating in an environment you control (test device, emulator, dedicated sandbox)
12	3. App store ToS — Apple and Google generally allow security research on apps you own; testing competitor apps without authorization is a fast path to legal exposure
13
14	If unclear, ask before proceeding.
15
16	## Audit Checklist — MASVS-STORAGE (Sensitive Data Storage)
17
18	- iOS: keychain items use the strongest available `kSecAttrAccessible` class — `kSecAttrAccessibleWhenUnlockedThisDeviceOnly` or `kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly`. Avoid `Always` and `ThisDeviceOnly`-less variants
19	- iOS: no secrets in `NSUserDefaults`, plist, or app bundle — `strings <app>.ipa` should not reveal API keys or secrets
20	- Android: secrets in EncryptedSharedPreferences / Keystore-backed encrypted storage, not raw SharedPreferences
21	- Android: `android:allowBackup="false"` in the manifest (or backup rules carefully scoped) — otherwise `adb backup` extracts everything
22	- Both: no PII / tokens written to logs that survive a crash (NSLog, Log.d, third-party crash reporters)
23	- Both: Pasteboard / Clipboard access — sensitive fields don't auto-share to system clipboard (iOS `pasteboard.expirationDate`, Android `ClipDescription.EXTRA_IS_SENSITIVE`)
24	- Both: the OS app-switcher screenshot doesn't capture sensitive screens — iOS `applicationDidEnterBackground` blur, Android `FLAG_SECURE` on the activity
25
26	## Audit Checklist — MASVS-CRYPTO (Cryptography)
27
28	- No hardcoded keys in the app bundle — `strings`, `class-dump`, `apktool` reveal embedded constants
29	- Modern algorithms only — AES-GCM, ChaCha20-Poly1305; reject AES-ECB, DES, RC4, MD5, SHA-1
30	- Random number generation uses `SecRandomCopyBytes` (iOS) / `SecureRandom` (Android) — not `arc4random()` for crypto, never `Math.random()`
31	- Key derivation from passwords uses PBKDF2 with ≥ 600,000 iterations (OWASP 2024) or Argon2id
32	- IVs / nonces are not reused — if you see `iv = "0000000000000000"`, that's worse than no encryption (reveals plaintext patterns)
33	- Don't roll your own crypto — flag any custom encryption scheme; bias toward libsodium / Tink
34
35	## Audit Checklist — MASVS-NETWORK (Network Communication)
36
37	- iOS: App Transport Security enabled — no global `NSAllowsArbitraryLoads = true`. If exceptions exist, they're specific domains, justified, and documented
38	- Android: `network_security_config.xml` exists and enforces cleartext-traffic refusal — `<base-config cleartextTrafficPermitted="false">`
39	- Both: Certificate pinning for high-trust backends — public-key pinning preferred over certificate pinning (survives cert rotation). For iOS: `URLSessionDelegate` + `URLAuthenticationChallenge`; Android: `NetworkSecurityConfig` `<pin-set>` or OkHttp `CertificatePinner`
40	- Both: Pinning has a backup pin — pinning to a single cert means the next rotation breaks the app for all users
41	- WebView usage — `WKWebView` only (iOS, not `UIWebView`); JavaScript bridge audited; `setJavaScriptEnabled(false)` if the WebView doesn't need JS
42	- WebView `loadUrl` with user-controlled URL — open redirect, intent-spoofing, phishing surface
43
44	## Audit Checklist — MASVS-AUTH (Authentication & Session)
45
46	- Biometric prompts use `LAContext.evaluatePolicy` (iOS) / `BiometricPrompt` (Android) — not the deprecated `FingerprintManager`
47	- Biometric auth is bound to keychain/keystore access, not just a UI check (`SecAccessControl.biometryAny`, Android `KeyGenParameterSpec.setUserAuthenticationRequired(true)`)
48	- Session tokens stored in keychain/keystore (not SharedPreferences/NSUserDefaults)
49	- Refresh-token flow — short-lived access token, refresh token revocable server-side
50	- OAuth flows use the pl

People who liked this also viewed

6 picks

Type