[Attacks and Exploits] A penetration tester is working on a security assessment of a mobile application that was developed in-house for local use by…

The most logical and methodologically sound first step in a mobile application security assessment is to perform static analysis. Running the application through a mobile application security framework, such as the Mobile Security Framework (MobSF), automates this initial phase. This process involves decompiling the application and analyzing its source code, configuration files, and binaries without executing it. It provides a comprehensive baseline of the application's security posture, identifying potential information disclosure risks like hardcoded credentials, insecure data storage practices, and excessive permissions early in the assessment. This foundational analysis guides subsequent, more intensive dynamic testing.

A. Set up Drozer in order to manipulate and scan the application.

Drozer is a tool for dynamic analysis. This type of testing is typically performed after an initial static analysis has been completed to understand the application's attack surface.

C. Connect Frida to analyze the application at runtime to look for data leaks.

Frida is a dynamic instrumentation toolkit used for advanced runtime analysis. This is a subsequent step that builds upon findings from initial static and basic dynamic analysis.

D. Load the application on client-owned devices for testing.

Using client-owned devices is against standard penetration testing procedures. Testers must use dedicated, controlled lab devices to ensure a clean environment and avoid impacting client assets.

1. OWASP Mobile Security Testing Guide (MSTG). The guide outlines a standard methodology for mobile application security testing

which begins with information gathering and static analysis before proceeding to dynamic analysis. This establishes the priority of static analysis as a first step.

Reference: OWASP

"Mobile Security Testing Guide

" v1.5

Chapter 2

Section 2.2 "The Mobile Security Testing Process." The guide states

"The testing process is usually split into the two main phases of static and dynamic analysis... Static analysis is performed without executing the mobile app."

2. University Courseware on Security Testing. Academic curricula on application security consistently teach a phased approach where static analysis precedes dynamic analysis to establish a foundational understanding of the target.

Reference: He

K.

& He

J. (2018). A Mobile Application Penetration Testing and Security Analysis Framework. In Proceedings of the 2018 International Conference on Big Data and Education (ICBDE '18). Association for Computing Machinery

New York

NY

USA

10–14. This paper describes a framework where static analysis is the initial phase to "analyze the source code and resource files of the application." DOI: https://doi.org/10.1145/3206157.3206160

3. NIST Special Publication 800-115. This document provides a technical guide to information security testing and assessment

emphasizing a structured methodology that often begins with passive reconnaissance and analysis before active testing.

Reference: National Institute of Standards and Technology (NIST)

"Special Publication 800-115

Technical Guide to Information Security Testing and Assessment

" Section 3.2 "Assessment Phases." The methodology describes a discovery/analysis phase preceding active exploitation

which aligns with performing static analysis first.