Project 66: Mobile App Security Testing

Module: Module 7: Wireless, Systems & Mobile Security  |  Level: Intermediate  | 
Primary tool: MobSF (Mobile Security Framework, free, open-source)  |  Estimated time: 75–120 minutes

Objective: Run a static/dynamic mobile app scan against a deliberately vulnerable app.

Free lab environment

DIVA Android (Damn Insecure and Vulnerable App) — https://github.com/payatu/diva-android

DIVA is a free, open-source Android app deliberately built with common mobile vulnerabilities so you can practice mobile app security testing on an emulator (e.g. free Android Studio AVD) without touching a real app or real user data.

Lab workflow

1. Install DIVA Android (free) on a free Android Studio emulator on a free emulator (e.g. an Android Studio AVD) — never a real personal device with your own accounts.
2. Run MobSF (Mobile Security Framework, free, open-source) against the app with the specific goal of learning to run a static/dynamic mobile app scan against a deliberately vulnerable app.
3. Map each finding to its OWASP Mobile Application Security (MASVS/MASTG) category rather than just listing raw tool output.
4. Pick the single highest-severity finding and write out exactly how it could be exploited in a real-world scenario.
5. Write the specific remediation for that finding (e.g. certificate pinning, secure storage API, root/jailbreak detection) rather than a generic recommendation.
6. Capture the report screenshots specified below.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• MobSF’s static-analysis report summary for the app
• your written note identifying the single highest-severity finding and its OWASP MASVS category

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.