Skip to main content

Mobile Security (MAST)

Path: /mobile

Mobile Application Security Testing analyses a built mobile app - an Android or iOS artifact - and folds the results into the same unified posture as everything else apPosture scans. It is static and offline: the artifact is unpacked with standard libraries (no install, no emulator, no app-store round-trip), inspected, and its findings land in the shared Vulnerabilities queue.

Licensing

Mobile is gated by the mast feature. If your license does not include it, the page shows a locked state. Scanning also requires the run_scans permission.

What you can scan​

  • Upload an .apk, .aab or .ipa (up to 300 MB). Every artifact must be a valid archive.
  • From URL - a direct link to an .apk / .aab / .ipa. App-store pages (Google Play, App Store, iTunes) are rejected because the binary cannot be pulled from them, and the download target is SSRF-guarded.

How a scan runs​

  1. Unpack & classify - archive members are read as text (.json .xml .plist .dart .js .strings and more) or run through a pure-python strings pass for binaries (.so .dylib .dex and any NUL-containing file).
  2. Inspect each member - secret scanning, Info.plist App Transport Security checks, AndroidManifest.xml decoding and permission extraction.
  3. Whole-artifact analysis - native-library SCA from embedded version strings, Android host-code risks from classes.dex, and Firebase config extraction (with an optional read-only open-rules probe when authorised).
  4. Privacy & trackers - the embedded SDK catalog is matched and mapped to the data it can reach.
  5. Endpoint extraction - backend URLs found in the app become a bridge into dynamic testing.
  6. Persist - findings are ingested into the ASPM Vulnerability spine (tool="mobile"), deduplicated and risk-scored like any other source.

If a source repository is available, native SAST (Kotlin / Java / Swift / Obj-C), native SCA (Gradle / CocoaPods / Swift PM) and repo endpoint mining are added on top.

What you get​

  • A MASVS posture - seven control groups (STORAGE, CRYPTO, AUTH, NETWORK, PLATFORM, CODE, RESILIENCE) rolled up to an A-D grade, plus L1 / L2 / R depth. See Privacy & standards.
  • Static findings - insecure TLS, weak crypto, WebView risks, hardcoded secrets, SQL injection, vulnerable native libraries and dependencies, and manifest / plist misconfigurations - each tagged with a CWE, an ATT&CK Mobile technique and an SSVC decision.
  • Privacy - which third-party trackers are embedded and what personal data they can reach.
  • A path into dynamic testing - the extracted backend endpoints become DAST targets, with a Flutter TLS-unpinning helper for instrumented runs.

Optional depth: MobSF​

If a MobSF instance is configured (mobsf_url + mobsf_api_key), its results fold in alongside the native analysis. Left blank, MobSF folding is simply skipped - the built-in engine runs on its own.

Static evidence, dynamic bridge

MAST is a static analyser: a finding's evidence is the matched artifact string, and the "proof" is a plain-language explanation. Runtime confirmation of the app's backend is done by bridging the discovered endpoints into a DAST scan.