Testing the software application developed for mobile devices for their
functionality, usability, security, performance, etc is known as Mobile
Application Testing.
Mobile Application Security Testing includes authentication,
authorization, data security, vulnerabilities for hacking, session
management, etc.
#1) Zed Attack Proxy (ZAP)
ZAP is designed in a simple and easy to use manner.
Earlier it was used only for web applications to find the
vulnerabilities but currently, it is widely used by all the testers for
mobile application security testing.
ZAP supports sending
malicious messages, hence it is easier for the testers to test the
security of the mobile apps. This type of testing is possible by sending
any request or file through malicious message and test that if a mobile
app is vulnerable to the malicious message or not.
Key Features:- World’s most popular open source security testing tool.
- ZAP is actively maintained by hundreds of international volunteers.
- It is very easy to install.
- ZAP is available in 20 different languages.
- It is an international community-based tool which provides support and includes active development by international volunteers.
- It is also a great tool for manual security testing.
#2) Micro Focus
Micro
Focus and HPE Software have joined together and they became the largest
software company in the world. Micro Focus is headquartered in Newbury,
the UK with around 6,000 employees. Its revenue was $1.3 billion as of
2016. Micro Focus primely focused on delivery of enterprise solutions to
their customers in the areas of Security & Risk Management, DevOps,
Hybrid IT etc.Key Features:
- Fortify performs comprehensive mobile security testing using a flexible delivery model.
- Security Testing includes static code analysis and scheduled scan for mobile apps and provides the accurate result.
- Identify security vulnerabilities across – client, server, and network.
- Fortify allows standard scan which helps to identify malware.
- Fortify supports multiple platforms such as Google Android, Apple iOS, Microsoft Windows and Blackberry.
#3) Kiuwan
Kiuwan
provides a 360º approach to mobile app security testing, with the
largest technology coverage. Kiuwan security testing includes static
code analysis and software composition analysis, with automation at any
stage of the SDLC. Coverage of the main languages and popular frameworks
for mobile development, with integration at IDE level.
#4) QARK
QARK stands
for “Quick Android Review Kit” and it was developed by LinkedIn. The
name itself suggests that it is useful for Android platform to identify
security loophole in the mobile app source code and APK files. QARK is a
static code analysis tool and provides information about android
application related security risk and provides a clear and concise
description of issues.
QARK generates ADB (Android Debug Bridge) commands which will help to validate the vulnerability that QARK detects.Key Features:
- QARK is an open source tool.
- It provides in-depth information about security vulnerabilities.
- QARK will generate a report about potential vulnerability and provide information about what to do in order to fix them.
- It highlights the issue related to the Android version.
- QARK scans all the components in the mobile app for misconfiguration and security threat.
- It creates a custom application for testing purposes in the form of APK and identifies the potential issues.
#5) Android Debug Bridge (ADB)
ADB is a command line tool which communicates with the
actual connected android device or emulator to assess the security of
mobile apps.
It is also used as a client-server tool which can be
connected to multiple android devices or emulators. It includes “Client”
(which sends commands), “daemon” (which runs comma.nds) and “Server”
(which manages communication between the Client and the daemon).
Key Features:- ADB can be integrated with Google’s Android Studio IDE.
- Real-time monitoring of system events.
- It allows operating at the system level using shell commands.
- ADB communicates with devices using USB, WI-FI, Bluetooth etc.
- ADB is included in Android SDK package itself.
#6) CodifiedSecurity
Codified
Security was launched in 2015 with its headquarters in London, United
Kingdom. Codified Security is a popular testing tool to perform mobile
application security testing. It identifies and fixes the security
vulnerabilities and ensures that the mobile app is secure to use.Key Features:
- It is an automated testing platform which detects security loopholes in the mobile app code.
- Codified Security provides real-time feedback.
- It is supported by machine learning and static code analysis.
- It supports both Static and Dynamic testing in the mobile app security testing.
- Code level reporting helps to get the issues in the mobile app’s client-side code.
- Codified Security supports iOS, Android platform etc.
- It tests mobile app without actually fetching the source code. The data and source code is hosted on the Google cloud.
- Files can be uploaded in multiple formats such as APK, IPA etc.
#7) Drozer
Drozer is a mobile app security testing framework developed
by MWR InfoSecurity. It identifies the security vulnerabilities in the
mobile apps and devices and ensures that the Android devices, mobile
apps etc., are secure to use.Key Features:
- Drozer is an open source tool.
- Drozer supports both actual android device and emulators for security testing.
- It only supports the Android platform.
- Executes Java enabled code on the device itself.
- It provides solutions in all areas of cybersecurity.
- Drozer support can be extended to find and exploit hidden weaknesses.
- It discovers and interacts with the threat area in an android app.
#8) WhiteHat Security
WhiteHat Sentinel Mobile Express is a security testing and
assessment platform provided by WhiteHat Security which provides mobile
app security solution. WhiteHat Sentinel provides a faster solution
using its static and dynamic technology.
Key Features:- It is a cloud-based security platform.
- It supports both Android and iOS platforms.
- Sentinel platform provides detailed information and reporting to get the status of the project.
- Automated static and dynamic mobile app testing, it is able to detect loophole faster than any other tool or platform.
- Testing is performed on the actual device by installing the mobile app, it does not use any emulators for testing.
- Gives a clear and concise description of security vulnerabilities and provides a solution.
- Sentinel can be integrated with CI servers, bug tracking tools, and ALM tools.
#9) Synopsys
Synopsys provides a
comprehensive solution for mobile app security testing. This solution
identifies the potential risk in mobile app and ensures that the mobile
app is secure to use. There are various issues related to mobile app
security, so using static and dynamic tools Synopsys has developed
customized mobile app security testing suite.
Key Features:
- Combine multiple tools to get a most comprehensive solution for mobile app security testing.
- Focuses on delivering the security defect-free software into the production environment.
- Synopsys helps to improve the quality and reduces cost.
- Eliminates security vulnerabilities from the server-side applications and from APIs.
- It tests vulnerabilities using an embedded software.
- Static and Dynamic analysis tools are used during mobile app security testing.
#10) Veracode
Veracode’s Mobile Application Security Testing (MAST) solution identifies the security loopholes in the mobile app and suggests immediate action to perform the resolution.
Key Features:
- It is easy to use and provides accurate security testing results.
- Security tests are performed based on the application. Finance and healthcare applications are tested in-depth while the simple web application is tested with a simple scan.
- In-depth testing is performed using complete coverage of mobile app use cases.
- Veracode Static Analysis provides fast and accurate code review result.
- Under a single platform, it provides multiple security analysis which includes static, dynamic and mobile app behavioral analysis.
#11) Mobile Security Framework (MobSF)
MobSF is an automated security testing framework
for Android, iOS and Windows platform. It performs static and dynamic
analysis for mobile app security testing.
Most of the mobile apps
are using web services which may have security loophole. MobSF addresses
the security-related issues with web services.
Key Features:- It is an open source tool for mobile app security testing.
- Mobile app testing environment can be easily set-up using MobSF.
- MobSF is hosted in a local environment, so sensitive data never interacts with the cloud.
- Faster security analysis for mobile apps on all three platforms (Android, iOS, Windows).
- MobSF supports both binary and Zipped source code.
- It supports Web API security testing using API Fuzzer.
- Developers can identify security vulnerabilities during the development phase.
Fuente: softwaretestinghelp.com
1 comentario:
Good description of very useful Mobile App Security testing tools.
Publicar un comentario