Setup
- Jailbroken / rooted test device or emulator
- Proxy and certificate pinning bypass
- Pull the app package for static review
Static analysis
- Reverse the binary; review strings, endpoints, secrets
- Check local storage, keychain / keystore usage
- Review the manifest / entitlements
Dynamic analysis
- Intercept and tamper with API traffic
- Hook methods with Frida / Objection
- Test deep links, IPC, and WebViews
Backend
- The mobile app is a client — test its API as a web target too