Skip to main content

Dynamic testing & backend bridge

A mobile app is mostly a client for a backend. MAST's static pass extracts the API endpoints baked into the artifact and turns them into a bridge for real dynamic testing.

URL scanning & SSRF guard​

The From URL flow downloads an artifact from a direct link before scanning it. Because the server fetches a URL you provide, it is guarded:

  • Only http / https, and the path must end in .apk, .aab or .ipa.
  • App-store pages (Google Play, App Store, iTunes) are rejected - the binary cannot be pulled from them.
  • The hostname is resolved and the download is refused if any resolved IP is private, loopback, link-local, reserved or multicast - so the fetch cannot be pointed at cloud metadata or internal services.
  • The download is size-capped (300 MB) and re-checked to be a real archive (PK magic).

Mobile → DAST bridge​

Backend URLs discovered in the app become DAST targets. From the Mobile page, Run dynamic test sends the extracted endpoints through the bridge, which registers them as targets and enqueues a graybox scan - so the app's actual server is tested by the full Autonomous Pentest engine, not just inspected statically.

Flutter TLS unpinning​

Flutter apps terminate TLS inside libflutter.so (a bundled BoringSSL), so a normal proxy cannot see their traffic without unpinning. MAST provides a Frida SSL-bypass script (arm64) you can download and attach for an instrumented run.

Pattern-fragile by nature

The bypass works by patching a byte pattern in the bundled BoringSSL. Flutter version bumps shift that pattern, so the script may need regenerating for a given app. This is inherent to Flutter TLS unpinning, not a limitation unique to apPosture.

Where results land​

Findings from the bridged DAST scan flow into the same Vulnerabilities queue and posture as the static mobile findings, correlated by the ASPM engine - one app, one posture, static and dynamic together.