MobileApp Security
The OWASP Mobile Top 10, the mobile-specific counterpart to the main OWASP Top 10, and what's different about testing an app that ships its own compiled code onto a device the attacker fully controls.
Excessive Mobile Permissions & Insecure Platform Usage
An app requesting far more device permissions than its function requires, or exposing its own components to other apps by mistake, expands what a single compromise of that app can actually reach.
Ceiling: CriticalInsecure Mobile Authentication & Session Management
Authentication logic enforced only on the client, or a biometric prompt that can be bypassed, gives an attacker with device or binary access a way around checks that should have held server-side.
Ceiling: CriticalInsecure Mobile Communication
A mobile app that doesn't properly validate the server's TLS certificate, or falls back to unencrypted traffic, exposes everything it sends over the network to interception.
Ceiling: CriticalInsecure Mobile Data Storage
Sensitive data cached in plaintext directly on a mobile device is retrievable by anyone with physical or forensic access to it, regardless of how well the backend is secured.
Ceiling: CriticalInsecure WebView & Deep Link Handling
A mobile app's embedded browser component or deep link handler that trusts content or parameters without validation turns a convenience feature into a client-side injection and hijacking surface.
Ceiling: HighInsufficient Binary Protections
A compiled mobile app with no obfuscation or tamper detection can be decompiled and modified by anyone holding the installed package, exposing logic and secrets never meant to be read.