Dynamic testing & backend bridge
A mobile app is mostly a client for a backend. MAST's static pass extracts the API endpoints baked into the artifact and turns them into a bridge for real dynamic testing.
URL scanning & SSRF guard
The From URL flow downloads an artifact from a direct link before scanning it. Because the server fetches a URL you provide, it is guarded:
- Only
http/https, and the path must end in.apk,.aabor.ipa. - App-store pages (Google Play, App Store, iTunes) are rejected - the binary cannot be pulled from them.
- The hostname is resolved and the download is refused if any resolved IP is private, loopback, link-local, reserved or multicast - so the fetch cannot be pointed at cloud metadata or internal services.
- The download is size-capped (300 MB) and re-checked to be a real archive (
PKmagic).
Mobile → DAST bridge
Backend URLs discovered in the app become DAST targets. From the Mobile page, Run dynamic test sends the extracted endpoints through the bridge, which registers them as targets and enqueues a graybox scan - so the app's actual server is tested by the full Autonomous Pentest engine, not just inspected statically.
Flutter TLS unpinning
Flutter apps terminate TLS inside libflutter.so (a bundled BoringSSL), so a normal proxy
cannot see their traffic without unpinning. MAST provides a Frida SSL-bypass script
(arm64) you can download and attach for an instrumented run.
The bypass works by patching a byte pattern in the bundled BoringSSL. Flutter version bumps shift that pattern, so the script may need regenerating for a given app. This is inherent to Flutter TLS unpinning, not a limitation unique to apPosture.
Where results land
Findings from the bridged DAST scan flow into the same Vulnerabilities queue and posture as the static mobile findings, correlated by the ASPM engine - one app, one posture, static and dynamic together.