Mobile DAST Workflow for Full-Screen and Endpoint Vulnerability Coverage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile application security testing tools fail to ensure comprehensive scanning of all application screens and endpoints, do not extract sensitive information, and lack automated verification of SSL certificate pinning and root detection, requiring manual testing and user preference selection.
Innovation Solution
A system and method for dynamic mobile application security assessment that includes a DAST engine to validate application binaries, execute user-selected assessment scripts in a virtual environment, record activities, and generate vulnerability reports, supporting formats like ELF, APK, and IPA, with features like RASP, TLS, and endpoint verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If existing tools use automatic methods to visit a few pages and generate vulnerability reports, then the testing process is fast and automated, but the scanning coverage is incomplete and does not ensure all screens and endpoints are scanned
Solution Approach 1:
The system performs preliminary actions by collecting authentication details and user session information before the actual security scanning begins. This allows the automated tools to access protected areas of the application and perform comprehensive scanning of all screens and endpoints, not just a few sample pages.
Solution Approach 2:
The system introduces an intermediary component that manages user sessions and authentication credentials. This intermediary enables the automated scanning tools to act as if they are legitimate users, allowing them to traverse all accessible screens and endpoints throughout the application without being blocked by authentication mechanisms.
2Measurement precision
If existing tools manually set up testing environments and verify vulnerabilities, then the verification is thorough and accurate, but the testing process is time-consuming and requires significant manual intervention
Solution Approach 1:
The system implements self-service by automatically collecting authentication details from users and using these credentials to perform the entire vulnerability scanning process without manual intervention. The tools autonomously navigate through all application screens, invoke all endpoints, and generate comprehensive vulnerability reports, eliminating the need for manual test setup and execution while maintaining thorough verification.
Solution Approach 2:
The system replaces manual mechanical testing processes with automated computational methods. Instead of security testers manually navigating through application screens and verifying vulnerabilities, automated tools use scripts and algorithms to systematically test all accessible areas, replacing human manual labor with machine-based automation that is both faster and equally thorough.
3Ease of operation
If existing tools collect authentication details from users to access application pages, then the tools can perform some security testing, but they cannot ensure all screens are opened or verify all integrated endpoints are accessed
Solution Approach 1:
The system achieves universality by creating a comprehensive testing framework that can access and verify all types of application screens and endpoints through a single authentication mechanism. The collected credentials are used across multiple testing functions including screen rendering verification, endpoint invocation, data extraction, and vulnerability detection, ensuring complete coverage without requiring separate authentication processes for each test type.
Solution Approach 2:
The system maintains continuity of useful action by using the collected authentication details throughout the entire testing process without interruption. The session credentials enable continuous navigation through all application screens and persistent access to all endpoints, ensuring that the verification process is unbroken and comprehensive rather than fragmented or incomplete.
4Measurement precision
If existing static app analysis is used to ensure security of application code and permissions, then the code-level security is verified, but data vulnerabilities introduced during application usage cannot be detected
Solution Approach 1:
The system transitions from static to dynamic analysis by launching and executing the mobile application in a real or simulated runtime environment. This dynamic approach allows the system to observe actual application behavior, data flows, and security controls in operation, enabling detection of runtime vulnerabilities such as insecure data storage, improper authentication logic, and dynamic code execution issues that cannot be detected through static code analysis alone.
Solution Approach 2:
The system performs preliminary actions by collecting authentication credentials and user session information before the dynamic execution begins. This preliminary preparation enables the dynamic analysis to proceed with full access to protected areas of the application, allowing comprehensive runtime vulnerability detection including data vulnerabilities that occur during actual application usage and data processing operations.
Data Source
AI summary
A system and method for dynamic application security testing (DAST) of mobile applications is disclosed. The method includes receiving an application binary file associated with a mobile application, validating the application binary by examining its format, and supporting formats such as ELF, APK, AAB, and IPA. Upon validation, the method involves receiving user-selected vulnerability assessment preferences specific to the binary file type. Based on these preferences, the method determines relevant assessment scripts and launches the application binary in a virtual test environment. The DAST scan engine executes the scripts, recording various activities including user login, logout, registration, and searches. A data processing engine then analyzes these activities to identify vulnerabilities. Finally, the method generates and displays a detailed report of the detected vulnerabilities on the user device.