Mobile Application Pentest
Android and iOS security testing — static analysis, dynamic instrumentation with Frida, SSL pinning bypass, and API backend testing.
Prerequisites
- APK file (Android) or IPA file (iOS) from client
- Physical device or emulator with USB debugging enabled (for dynamic analysis)
- Android: ADB installed, device in developer mode
- iOS: Jailbroken device or Corellium subscription for iOS dynamic testing
- Written authorization covering the mobile app and its backend APIs
-
1
Select Mobile Pentest from Home Screen
Click 📱 Mobile Pentest. Select platform: Android, iOS, or Both.
-
2
Upload APK / IPA
Drag and drop the APK or IPA file onto the upload zone. PhantomYerra validates the file, calculates SHA-256, and prepares it for analysis.
💡 For Android: obtain the APK withadb shell pm path com.target.appthenadb pull [path]. For iOS: export from Xcode Archive or request from client. -
3
Complete Mobile Wizard
Platform : Android / iOS / Both App Version : [auto-detected from manifest] Backend API : Include API testing? Yes/No → enter API URL Device : Connected device or emulator (for dynamic) Auth : App login credentials for authenticated dynamic testing Scope : App binary + backend API + local storage -
4
Claude Runs the Mobile Test Pipeline
Phase 1: Static analysis — MobSF decompile, apktool, jadx Phase 2: Secrets scan — API keys, hardcoded passwords, tokens in APK Phase 3: Permission audit — dangerous permissions, over-privileged access Phase 4: SSL pinning check — detect pinning implementation Phase 5: Dynamic analysis — Frida hooking, Objection bypass Phase 6: Traffic intercept — HTTP/S traffic via proxy with cert installed Phase 7: Backend API test — all endpoints discovered from traffic Phase 8: Storage analysis — SQLite DBs, SharedPrefs, files on device -
5
Review Findings and Generate Mobile Security Report
Report includes: app info, permission analysis, static findings, dynamic findings, API security findings, OWASP Mobile Top 10 coverage, and remediation guidance.
Common Issues
Ensure the frida-server binary matches the device architecture (arm64 for modern devices, x86 for emulator). Download from github.com/frida/frida/releases — match the version exactly to your installed frida-tools. Run with adb shell su -c "/data/local/tmp/frida-server &" for root.
The app may use certificate transparency or custom pinning not covered by the standard bypass. Try: android sslpinning disable --quiet. If that fails, use the TrustMeAlready Xposed module or write a custom Frida script targeting the specific pinning class found via jadx analysis. Check the decompiled code for custom TrustManager implementations.
The APK may be split (Android App Bundle). Request a universal APK from the client or use bundletool build-apks --bundle=app.aab --output=app.apks --mode=universal to generate a universal APK. MobSF requires a standard APK, not an AAB.