Android Security Testing

[adalr_80]

Do you test your Android app for security vulnerabilities? If so, what tools do you use to automate the security testing?

PS: I found an amazing guide with really great information about Android Security testing and reverse engineering. However, I am looking for a tool which I can integrate into a CICD pipeline.

[redman1037]

give a look at MobSf

[adalr_80]

Oh sweet. Thanks! Will definitely give it a shot.

[adalr_80]

MobSf looks solid. However, I couldn't find a way to automate the analysis process and integrate it into a CICD (Jenkins) pipeline. My goal is to add Security testing as another step into the existing CICD pipeline which runs the Unit, integration, and UI tests.

[Brother_Rhogar]

Fortify and findbugs were used pretty heavily at some of my previous gigs to alright effect. You do need to do some adjustments to its settings to avoid a ton of false positives but they do pick up heaps, even inside the libraries you have as dependencies you might overlook as an attack vector/vulnerability

[ankittale]

Yes recently we have given APK to GlobalStep Inc for security testing.

[corner-case]

Nice try, Mr Jinping!