The newest Mobile Security resources are on the Mobile Security page. For a reading order instead of a date order, see the Mobile Security learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-10 2026 | Frida - OWASP Mobile Application Security Tool intermediate 6 min read | Library for dynamic instrumentation, Frida enables JavaScript execution within native Android and iOS applications. It utilizes QuickJS for code injection via modes like Injected, Embedded, and Preloaded. Key APIs include Interceptor for inline hooking and Stalker for transparent, high-granularity tracing using JIT recompilation. Frida also offers specific APIs for Java and Objective-C interaction, alongside terminal tools such as `frida-ps` for process listing and `frida-trace` for function call tracing. Frida 17 introduces breaking changes, including the removal of bundled runtime bridges, necessitating separate installation via `frida-pm`, and API modifications for enhanced readability and performance. → mas.owasp.org |
| 2026-04-10 2026 | OWASP MASTG Testing Guide beginner | OWASP MASTG Testing Guide → mas.owasp.org |
| 2026-04-10 2026 | OWASP MASVS & MASTG: Mobile Security Guide (2026) beginner 8 min read | Library of OWASP MASVS & MASTG mobile application security requirements and testing guides, detailing structured verification for categories including storage, cryptography, authentication, network communication, platform interaction, code quality, and resilience. MASVS offers baseline (L1) and defense-in-depth (L2) security levels, alongside a resilience (R) category for protection against reverse engineering, with MASTG providing companion test cases for each requirement. Tools like MobSF, NowSecure, and AppKnox can map to specific MASVS categories for automated and manual assessments. → appsecsanta.com |
| 2026-04-10 2026 | Mobile App Tampering and Reverse Engineering - OWASP MASTG intermediate 4 min read | Library detailing mobile application tampering and reverse engineering techniques. It addresses the increasing need for security testers to understand compiled apps, including methods for bypassing defenses like SSL pinning and root detection. The resource covers static and dynamic binary analysis, deobfuscation, and the use of tools and scripting for complex tasks, emphasizing practical experience for mastering these skills. → mas.owasp.org |
| 2026-04-10 2026 | A Comprehensive Guide to iOS Penetration Testing intermediate | A Comprehensive Guide to iOS Penetration Testing |
| 2026-04-10 2026 | iOS Penetration Testing: Definition, Process and Tools beginner 18 min read | Library detailing iOS penetration testing, a method to uncover and exploit security vulnerabilities in iOS applications. It covers a structured process including preparation, static and dynamic analysis, reverse engineering, and reporting, utilizing tools like MobSF, Frida, and Burp Suite. Specific techniques addressed include SSL pinning bypass, insecure data caching, and hardcoded keys, with a focus on Apple's architecture and its unique technologies such as Swift and the Secure Enclave, referencing the OWASP Mobile Security Testing Guide. |
| 2026-04-10 2026 | iOS App Reverse Engineering: Tools & Tactics beginner 5 min read | Library for performing dynamic and static analysis of iOS applications, enabling security researchers and pentesters to uncover vulnerabilities. It supports tools like Hopper, Ghidra, and R2Frida for examining hardcoded secrets, bypassing jailbreak detection, tracing functions, and interacting with private APIs. This library facilitates live device analysis and integrates with virtualized iOS environments, streamlining vulnerability discovery and patch validation within CI/CD workflows. |
| 2026-04-10 2026 | iOS Pentesting Checklist: Complete Guide for 2026 beginner 8 min read | Checklist for comprehensive iOS application security assessments. This guide details crucial testing areas, including static and dynamic analysis, authentication, data storage, input validation, cryptographic implementations, and platform-specific checks, aiming to identify and mitigate vulnerabilities such as insecure Keychain usage, weak password handling, and potential injection attacks. It also covers meeting compliance needs like GDPR and HIPAA, building user trust, preventing data breaches, and improving app performance to attract more users. |
| 2026-04-10 2026 | Understanding Mobile App Reverse Engineering: How Attackers Break Apps beginner 18 min read | Library for understanding mobile app reverse engineering techniques from an attacker's perspective. It details how attackers use tools like JADX and methods such as static analysis to unpack APK/IPA files, decompile bytecode, and uncover vulnerabilities like hardcoded API keys, unencrypted tokens, and insecure backend URLs. The library highlights how AI-enhanced analysis, cross-platform framework weaknesses, and democratized attack tools increase these risks, with examples of exploits found in dating apps and fintech applications. |
| 2026-04-10 2026 | 2025 Phone Security Guide: Android vs iOS beginner 9 min read | Guide comparing Android and iOS phone security in 2025, detailing sandboxing, secure boot, and update strategies. It scrutinizes app ecosystem differences, including Apple's "walled garden" vetting versus Android's "sideloading risks," and highlights the importance of granular app permissions. The guide also covers hardware-backed encryption, secure protocols for data in transit, the dangers of public Wi-Fi, the rise of AI-driven phishing and mobile malware, IoT interconnectivity risks, and emphasizes user best practices like Multi-Factor Authentication (MFA). |
| 2026-04-10 2026 | Android vs iOS Security Comparison beginner 10 min read | Analysis comparing Android and iOS mobile operating system security, detailing vulnerabilities like SQL injection, CSRF, and cross-site scripting. It highlights iOS's closed-source nature and stringent App Store policies as advantages, while noting Android's open-source flexibility leads to fragmentation and a loosely regulated marketplace. The comparison covers consistent updates, user feedback, third-party support, and specific threats such as mobile remote access Trojans (mRATs). |
| 2026-04-10 2026 | iOS vs Android Security: Which Is More Secure? beginner 17 min read | Library detailing platform-level and application-layer security for iOS and Android. It highlights Apple's integrated hardware and software approach, Secure Enclave, and secure boot chain as strengths, while noting iOS's susceptibility to zero-day exploits and reduced runtime analysis visibility. For Android, it discusses fragmentation issues and malware growth, as well as the significant prevalence of hardcoded secrets (API keys, credentials) found in 71% of mobile apps across both platforms, a vulnerability missed by both App Store and Google Play Protect reviews. |
| 2026-04-10 2026 | iOS vs Android Security Comparison 2025 beginner 11 min read | Survey of iOS and Android security features, detailing hardware encryption, Secure Enclave, sandboxing, and biometric authentication on iOS, contrasted with Android's Google Play Protect, permission controls, Verified Boot, and file-based encryption. It also touches upon vulnerabilities like the Pegasus spyware and the importance of regular security updates for both platforms. |
| 2026-04-10 2026 | Common Mobile Application Security Vulnerabilities 2025 beginner | Common Mobile Application Security Vulnerabilities 2025 |
| 2026-04-10 2026 | 2025 Global Mobile Threat Report news | 2025 Global Mobile Threat Report |
| 2026-04-10 2026 | App Threat Report 2025 Q1: Android and iOS news 16 min read | Report summarizing 2025 Q1 Android and iOS application security, detailing platform mitigations like app stores, sandboxing, kernel protections, and device integrity. It contrasts iOS's strict app signing with Android's more permissive approach, explores encrypted code challenges on both platforms, and touches on memory protection limitations. The analysis highlights the ongoing threat landscape and practical concerns for securing mobile applications against evolving attacks. |
| 2026-04-10 2026 | Mobile App Security Testing in 2026: Statistics and OWASP Threats news 18 min read | Survey of mobile app security threats in 2026, detailing the rising costs of breaches ($6.99 million average) and the shift to mobile as the primary enterprise attack surface. The entry highlights the updated OWASP Mobile Top 10, emphasizing new priorities like Improper Credential Usage (M1) and Inadequate Supply Chain Security (M2), and discusses platform-specific risks for iOS and Android. It also notes the widespread overconfidence in existing mobile app protections despite significant vulnerabilities. |
| 2026-04-08 2026 | Mobile App Security Trends: Safeguarding User Data in a Digital World beginner 6 min read | Library for mobile app security, this resource explores key trends and techniques to safeguard user data. It details the importance of end-to-end encryption using standards like AES, multi-factor authentication including biometrics, and app sandboxing. Secure API practices with OAuth 2.0 and token-based authentication, alongside code obfuscation with tools like ProGuard, are highlighted. The entry also covers integrated security testing, compliance with regulations such as GDPR and CCPA, and the adoption of Zero Trust architecture for robust protection. |
| 2026-04-06 2026 | Hacking Android and IOT Apps by Example - DEF CON Training LV 2026 beginner 9 min read Talks | Workshop slides from DEF CON 32 present a 100% hands-on deep dive into the OWASP Mobile Security Testing Guide (MSTG) and MASVS, covering and exceeding the OWASP Mobile Top Ten. The training focuses on Android and IoT app security, utilizing tools like Frida, Objection, radare2, and RMS for static and dynamic analysis, instrumentation, and vulnerability exploitation, with practical CTF-style challenges. Participants learn to intercept network communications, bypass certificate pinning and root detection, and reverse engineer mobile applications. |
| 2026-04-06 2026 | Mobile Application Penetration Testing: iOS and Android beginner 6 min read | Tooling for mobile application penetration testing, encompassing iOS and Android platforms. This resource details techniques for static and dynamic analysis, including binary reverse engineering with tools like jadx, apktool, class-dump, and Hopper Disassembler, as well as runtime instrumentation using Frida and Objection. It addresses common vulnerabilities such as improper credential usage, insecure communication via certificate pinning bypass (e.g., SSL Kill Switch, Objection), insecure data storage in Keychain/Keystore, and covers OWASP Mobile Top 10 risks. The methodology includes reconnaissance, static/dynamic analysis, network/API testing, exploitation, and reporting. |
| 2026-04-06 2026 | 10 Mobile App Security Best Practices for 2026 beginner 9 min read | Library for mobile application security best practices, offering guidance for React Native, Expo, and Supabase. It details techniques such as code obfuscation using R8, certificate pinning via Network Security Configuration, and secure local storage with react-native-keychain. The resource also covers implementing multi-factor authentication, securing API communication with interceptors and request signing, managing sessions with JWTs and secure storage, and employing runtime protection (RASP) with tools like react-native-jail-monkey, all aimed at addressing OWASP Mobile Top 10 threats and mitigating data breach risks. |
| 2026-04-06 2026 | Grapefruit: Open-source mobile security testing suite intermediate 3 min read | Library for runtime mobile application security testing, powered by Frida and offering a web-based interface for inspecting, hooking, and modifying iOS and Android applications. Key features include runtime method hooking, cryptographic API interception, filesystem and SQLite inspection, syslog streaming, and privacy monitoring. It supports Flutter and React Native, with capabilities for memory scanning, thread inspection, and analysis of DEX, Hermes, and native code. Grapefruit also facilitates Keychain manipulation, traffic capture (NSURL, HTTP), WebView inspection, UI hierarchy dumping, and bypasses for biometric authentication and geolocation spoofing, while explicitly omitting built-in RASP bypasses to focus on composable instrumentation. |
| 2026-04-06 2026 | Objection 2026: Runtime Mobile Exploration via Frida intermediate 6 min read | Library for runtime mobile security exploration built on Frida. Objection provides a Python CLI that wraps Frida with pre-built commands for iOS and Android pentesting, allowing users to hook live applications from an interactive command line without writing custom JavaScript. Key features include SSL pinning bypass, file system and container exploration, and memory/heap analysis. It supports testing on jailbroken/rooted devices via `frida-server` or non-jailbroken/non-rooted devices by patching apps with `objection patchipa`/`patchapk`. → appsecsanta.com |
| 2026-04-03 2026 | OWASP Mobile Top 10 2024: A Security Guide beginner | OWASP Mobile Top 10 2024: A Security Guide |
| 2026-04-03 2026 | OWASP Mobile Top 10 and MobSF intermediate 8 min read | Library for addressing the OWASP Mobile Top 10 risks, including M1 (Improper Credential Usage) with examples like hardcoded credentials and insecure transmission, M2 (Inadequate Supply Chain Security) concerning malware injection, M3 (Insecure Authentication/Authorization) detailing hidden service requests, M4 (Insufficient Input/Output Validation) leading to remote code execution, M5 (Insecure Communication) through lack of certificate inspection, M6 (Inadequate Privacy Controls) via improper log sanitization, M7 (Insufficient Binary Protections) exposing API keys, and M8 (Security Misconfiguration) from insecure default settings. |
| 2026-04-03 2026 | Bypassing Certificate Pinning Using Frida: A Step-by-Step Guide intermediate 11 min read | Walkthrough of bypassing certificate pinning on Android apps using Frida to enable Man-in-the-Middle (MitM) attacks. This guide details the setup of Frida, Android Studio, Mitmproxy, and an Android emulator, then demonstrates hooking into the ShipFast app's runtime to intercept HTTPS traffic, even when certificate pinning is implemented via the network security config file. |
| 2026-04-03 2026 | Hail Frida!! The Universal SSL Pinning Bypass for Android intermediate | Hail Frida!! The Universal SSL Pinning Bypass for Android → infosecwriteups.com |
| 2026-04-03 2026 | OWASP Mobile Top 10 (2024) — Bug Bounty Hunter's Guide beginner | OWASP Mobile Top 10 (2024) — Bug Bounty Hunter's Guide |
| 2026-04-03 2026 | Four Ways to Bypass Android SSL Verification and Certificate Pinning | NetSPI intermediate 9 min read | Library detailing four methods to bypass Android SSL verification and certificate pinning for man-in-the-middle attacks. Techniques include adding a custom CA to the trusted certificate store, overwriting packaged CA certificates, utilizing Frida to hook and bypass checks, and reversing custom certificate code, with tools like BurpSuite, ZAP, Frida, and Objection mentioned. |
| 2026-04-03 2026 | Bypassing Certificate Pinning | OWASP MASTG intermediate 4 min read | Technique for bypassing SSL pinning on Android applications, applicable when apps use standard API functions. Methods include dynamic bypassing using Frida or Objection's `android sslpinning disable` command, and static bypass by patching certificate hashes, replacing certificate files, or modifying truststore files within the decompiled application. The MASTG also details finding and patching custom certificate pinning logic within native libraries and obfuscated frameworks like OkHTTP3. → mas.owasp.org |
| 2026-04-03 2026 | Defeating Android Certificate Pinning with Frida intermediate 12 min read | Library for bypassing Android certificate pinning using Frida. This technique enables security researchers, developers, and privacy advocates to intercept and inspect HTTPS traffic from hyper-vigilant applications that employ custom certificate validation beyond the default system trust store. The library details how to leverage Frida scripts to modify application behavior dynamically, remove SSL pinning logic, and expose the actual network communication for analysis, particularly useful for apps like Twitter, N26, or BBVA. |
| 2026-04-03 2026 | OWASP Mobile Top 10 beginner 5 min read | Reference detailing the OWASP Mobile Top 10 for 2024, including risks like Improper Credential Usage, Inadequate Supply Chain Security, and Insecure Communication. This resource also outlines the data-driven methodology used for identifying and prioritizing these vulnerabilities, comparing the 2024 list to previous iterations from 2016 and 2014. → owasp.org |
| 2026-04-03 2026 | OWASP Mobile Application Security (MAS) beginner | Library defining the industry standard for mobile application security. It provides the OWASP MASVS (mobile application security verification standard), OWASP MASWE (mobile application security and privacy weaknesses), and OWASP MASTG (mobile application security testing guide). The MASTG includes comprehensive processes, techniques, tools, and test cases for consistent and complete mobile app security testing. → mas.owasp.org |
| 2026-04-03 2026 | Think Your Phone Camera Is Hacked? Heres How You Find Out beginner 9 min read | Reference detailing how to detect phone camera hacking, typically occurring via spyware or Remote Access Trojans (RATs) installed through malicious apps or phishing links. Signs include unexpected camera indicator lights, "camera already in use" errors, unknown photos/videos, overheating, battery drain, and increased data usage. Attackers gain access through granted permissions, disguised apps, social engineering, physical access, or advanced zero-click exploits like Pegasus, enabling silent photo/video capture and live viewing. → kaspersky.com |
| 2026-04-02 2026 | Hundreds of Millions of iPhones Can Be Hacked With a New Tool Found in the Wild news 6 min read | Library for detecting DarkSword, a stealthy iPhone hacking technique that exploits vulnerabilities in iOS 18. This "smash-and-grab" tool, found embedded in websites, targets hundreds of millions of iOS devices by hijacking legitimate system processes to steal data like passwords, messages, browser history, and cryptocurrency credentials. DarkSword's fileless nature leaves minimal traces, and its code has been publicly exposed, inviting wider adoption by various hacking groups. → wired.com |
| 2026-04-02 2026 | Apple: iPhone users should update software amid hacking campaigns news 3 min read | Writeup of DarkSword and Coruna exploit kits used in iPhone hacking campaigns. These tools allow attackers deep remote access, enabling data theft including passwords, messages, and browser history. Russian intelligence and Chinese cybercriminals are reportedly using these kits, targeting specific groups such as Ukrainians and cryptocurrency users. Apple urges users to update their software, emphasizing that older iOS versions are vulnerable to these sophisticated attacks, which are delivered via watering hole attacks and involve complex exploit chains. |
| 2026-04-02 2026 | NowSecure Launches AI Data Partner Program to Expand Mobile Application Risk Intelligence for Security Platforms news 3 min read | Program enabling security vendors and AI platforms to access risk intelligence from over four million mobile application security assessments. This data provides insights into application behavior, infrastructure relationships, and risks like vulnerable SDKs, sensitive data exchange, and AI service usage without governance. Available datasets include risk scores, behavioral data (permissions, endpoints, SBOMs), and detailed vulnerability and privacy findings, enriching existing security platforms and agentic AI workflows with mobile application layer visibility. |
| 2026-04-02 2026 | Onespan prepares for RSAC2026 pushing passkey and mobile app security solutions news | Library of digital security solutions from Onespan, accelerating preparations for RSAC2026. The company is promoting passkeys, OTPs, FIDO security keys, mobile app protection, and fraud defense technologies. Attendees can discuss transaction security needs and protection strategies against evolving cyber threats, referencing Onespan's efforts in response to heightened regulatory scrutiny like PSD3 and FINTRAC oversight. |
| 2026-02-14 2026 | HackingDave/btrpa-scan: Bluetooth Low Energy (BLE) scanner with Resolvable Private Address (RPA) resolution using Identity Resolving Keys (IRKs) intermediate 10 min read | Library for discovering Bluetooth Low Energy (BLE) devices, capable of resolving privacy-randomized addresses using Identity Resolving Keys (IRKs). It offers features like targeted scanning by MAC address, RSSI filtering and averaging, name filtering, active scanning for richer data, and environment presets for distance estimation. Output options include real-time CSV logging, batch export to CSV, JSON, or JSONL, and a web-based radar interface. |
| 2026-01-18 2026 | Account Takeover in Facebook mobile app due to usage of cryptographically unsecure random number generator and XSS in Facebook JS SDK intermediate 11 min read XSS | Writeup detailing account takeover vulnerabilities in Facebook's mobile app and JS SDK. The analysis uncovers an XSS flaw in the Customer Chat plugin due to unescaped `iconSVG` injection. More critically, it reveals that Facebook's reliance on `Math.random()` for generating crucial callback identifiers, combined with the SDK's reuse of this generator for iframe names and a mechanism to force reinitialization, allows attackers to predict and forge these identifiers, bypassing security checks and enabling unauthorized account access. |
| 2026-01-15 2026 | A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby - Project Zero advanced 46 min read | Library detailing a 0-click exploit chain targeting the Pixel 9, focusing on vulnerabilities within the Dolby Unified Decoder. This analysis delves into CVE-2025-54957, an integer overflow in the EMDF payload processing, and CVE-2025-36934, a driver vulnerability, explaining how these lead to arbitrary code execution in the mediacodec context and privilege escalation to the kernel. The research highlights the increased attack surface introduced by AI-driven audio transcription features in mobile devices. → projectzero.google |
| 2026-01-04 2026 | Android Reverse Engineering Notes intermediate | https://t.co/PISBfNlzPa |
| 2025-11-03 2025 | Advanced Android Hacking Course advanced Bug Bounty | Workshop materials from Ken Gannon, a Pwn2Own and Pwnie award winner, detail advanced Android hacking techniques used in competitive scenarios like Pwn2Own. Gannon, who has won Pwn2Own consecutively by compromising flagship devices, shares insights into the strategic approaches employed by security researchers to discover and exploit vulnerabilities in mobile platforms. |
| 2025-02-08 2025 | The Mac Malware of 2024 👾 advanced 68 min read | Library cataloging new macOS malware for 2024, detailing specimens like the CloudChat stealer. It covers infection vectors, persistence mechanisms, and features, providing technical analysis and sample download links. The library references tools such as ProcessMonitor, FileMonitor, and Hopper Disassembler, and highlights the rise of info-stealers and AI's role in malware development. |
| 2025-02-08 2025 | Enable End-to-End Encryption for Your iCloud Backups beginner 3 min read | Guide to enabling Advanced Data Protection for iCloud, which extends end-to-end encryption to 23 sensitive data categories including iCloud Backup, Photos, and Notes. This opt-in feature ensures only your trusted Apple devices can decrypt data, with recovery options via device passcode, password, recovery contact, or recovery key. The guide covers necessary software updates, account recovery setup, and the process of activating Advanced Data Protection across iPhone, iPad, and Mac. |
| 2025-02-01 2025 | The Protesters' Guide to Smartphone Security beginner 19 min read | Guide to smartphone security for protesters detailing risks like confiscation, surveillance, and service disruption. It advises using a separate "burner phone" purchased with cash and activated discreetly, or securing a primary device with a strong alphanumeric passphrase, disabling biometric authentication, and knowing local rights regarding unlocking devices for law enforcement. |
| 2025-01-30 2025 | Privacy Respecting Web Browsers for Android and iOS - Privacy Guides beginner 8 min read | Library configurations for mobile web browsers, specifically Brave and Cromite on Android and Safari on iOS, detail settings to enhance privacy against trackers and fingerprinting. Recommended Brave settings include "Aggressive" ad blocking, requiring HTTPS, and blocking third-party cookies. Cromite configurations focus on closing tabs on exit, secure connections, and using default Adblock Plus filter lists. Safari on iOS leverages Intelligent Tracking Prevention and fingerprint randomization, with recommendations to disable Siri suggestions and utilize separate browser profiles for distinct activities. |
| 2024-12-20 2024 | Apple platform security guide beginner | Apple platform security guide |
| 2024-11-25 2024 | Vxcon2024 workshop beginner Talks | Vxcon2024 workshop |
| 2024-10-02 2024 | iOS 18 Quick Tips; Security Edition beginner 4 min read | Tips for iOS 18 security highlight new features like requiring Face ID to launch any app and hiding applications to prevent unauthorized access on unlocked devices. It also revisits Guided Access, a feature that locks the phone to a specific app and can disable certain screen areas, requiring Face ID for exit. These functionalities offer enhanced protection against unauthorized app access and snooping, particularly relevant given rising mobile phone theft. |