Scribd
Upload
313 views

Scoping Sheet For Mobile App Security Audit

Mobile (Android/iOS) Application Security Audit or Vulnerability Assessment and Penetration Testing (VAPT) scope questionnaire

Uploaded by

Maximus
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as XLSX, PDF, TXT or read online on Scribd
313 views

Scoping Sheet For Mobile App Security Audit

Mobile (Android/iOS) Application Security Audit or Vulnerability Assessment and Penetration Testing (VAPT) scope questionnaire

Uploaded by

Maximus
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as XLSX, PDF, TXT or read online on Scribd
You are on page 1/ 4

Android / iOS Application Security Testing Que

# Particulars Clients Response - Application 1

1 Name & version of the application to be tested


2 Brief description of application

Supported Android OS version & architecture (Android)


3
Supported iOS version & architecture ex. Minimum iOS
Version 8+ 64 bit or 32 bit Devices (iOS)
On which device Application will run ex. iPhone, iPad, iPod
4
(iOS)
Application / Servers hosted on AWS/Azure/Google
5 Cloud/Other Data Center Service Provider (CtrlS, Netmagic,
Tata Communications) / In-house

Application users - End users for the


6 application? (In-house teams/customers/partners/citizens /
general users etc.)

How many roles defined in the application?


No. of roles and type of privileges for the different roles (e.g.;
7 admin user, normal user, Supervisor role, user with only view
access etc.)

Does application deal with the server for any kind of


8 information/request. Does application store any user
information or user input on server side in the database.

9 Does application store information/data on local device of


the end user ?

10 Does application use any URL Schema ex.


whatsapp://message/contactnumber
11 Does application stores any Data in Key Chain (iOS)
12 Application uses any web service ?
13 Does application use HTTPS or SSL Pinning ?
No. of activities (dynamic pages / screens) in the application
14 (Android)

15 No. of screens in the application (iOS)

16 Does application deal with or store any virtual currency ?

Application supports access over 2G, 3G, 4G, Wi-Fi, NFC or


17 others

Application is used to perform e-commerce or m-commerce


18 transactions ?

19 Application has File Upload facility ?


Application can interact with any device hardware like
a. NFC
b. Bluetooth
c. GPS
20 d. Camera
e. Microphone
f. Sensors
g. TouchID Sensor
H. Siri(Virtual Assistant) (iOS)

21 Development environment (Rails, Java, Django, ASP.NET,


etc.)
Use of any kind of framework (Appcelerator, jQuery Mobile,
22
CoronaSDK, TheAppBuilder, PhoneGap)

Application interacts with any other application like


a. Telephony (SMS, phone)
b. Contacts
c. Receiving data from apps and other on-device services
23 d. Google Wallet
e. Social networks (i.e. Facebook, Twitter, LinkedIn, Google+)
f. Dropbox
g. Evernote
h. Email

Hosting provider (AWS, App Engine, Heroku, Rackspace,


24 Azure, etc.)

25 Is application is built in Hybrid Environment ?


Does the application leverage Single Sign On, SAML or
26 Authentication APIs (Google Apps, Facebook, iTunes, OAuth,
etc.)

Any other APIs in use


i. Payment gateways
ii. SMS messaging
27 iii. Social networks
iv. Cloud file storage
v. Ad networks

Any additional point that needs to be considered while


28 security testing of the application?

Contact person to report operational issues as well as high


29 level vulnerabilities
Application Security Testing Questionnaire

Clients Response - Application 2 Clients Response - Application 3 Clients Response - Application 4

You might also like