https://cyberx.global/assets/MobilePentest-Dxfb1S7Q.js

1import{j as a}from"./vendor--ZNwyCDH.js";import{P as t,m as i}from"./pentestDomainFaqs-BJZUoBDa.js";import{M as n}from"./MobileTabContent-BgLlUQeu.js";import{a as s}from"./domainLinks-B1l6KZHW.js";import{u as r}from"./index-DdihQXb9.js";import{f as d}from"./icons-Ft16fm9Z.js";import"./ServiceTemplate-8XaoPik6.js";import"./RelatedLinks-BhLDfWTJ.js";import"./motion-DTOtJPkK.js";import"./ServiceFAQ-CStGrSmI.js";import"./accordion-BeO--hok.js";import"./supabase-C8H_rTra.js";const P=()=>{const{tt:e}=r(),o=s("/services/pentest/mobile");return a.jsx(t,{id:"pentest-mobile",icon:a.jsx(d,{size:36,className:"text-cyberx-blue"}),title:e("Mobile App Penetration Testing","Testes de Intrusão a Apps Móveis","اختبار اختراق تطبيقات الجوال"),description:e("Android and iOS application penetration testing against the OWASP MASVS and MASTG — storage, cryptography, authentication, network and platform hardening.","Testes de intrusão a aplicações Android e iOS segundo o OWASP MASVS e MASTG — armazenamento, criptografia, autenticação, rede e hardening da plataforma.","اختبار اختراق تطبيقات Android و iOS وفق OWASP MASVS و MASTG — التخزين والتشفير والمصادقة والشبكة وتحصين المنصة."),intro:[e("A mobile app runs on a device you do not control, in the hands of a user who may have rooted it. Anything shipped inside the binary — API keys, endpoints, business logic, feature flags — is readable by anyone willing to unpack it. CyberX tests Android and iOS applications the way a motivated attacker would: static analysis of the binary, dynamic instrumentation on a rooted or jailbroken device, and full inspection of the backend the app talks to.","Uma aplicação móvel corre num dispositivo que não controla, nas mãos de um utilizador que pode tê-lo feito root. Tudo o que é enviado dentro do binário — chaves de API, endpoints, lógica de negócio, feature flags — é legível por quem estiver disposto a desempacotá-lo. A CyberX testa aplicações Android e iOS como o faria um atacante motivado: análise estática do binário, instrumentação dinâmica num dispositivo com root ou jailbreak e inspeção completa do backend com que a app comunica.","يعمل تطبيق الجوال على جهاز لا تتحكم فيه، بين يدي مستخدم قد يكون قد فتح صلاحياته. كل ما يُشحن داخل الملف التنفيذي — مفاتيح API والنقاط النهائية ومنطق الأعمال — يمكن قراءته من قِبل أي شخص يفك حزمته. تختبر CyberX تطبيقات Android و iOS كما يفعل مهاجم مُصمم: تحليل ثابت للملف التنفيذي، وأدوات ديناميكية على جهاز مفتوح الصلاحيات، وفحص كامل للخلفية التي يتصل بها التطبيق."),e("Testing follows the OWASP Mobile Application Security Verification Standard (MASVS) and the Mobile Application Security Testing Guide (MASTG), so the report doubles as verification evidence at MASVS-L1 or L2 for app-store, banking and healthcare requirements.","Os testes seguem o OWASP Mobile Application Security Verification Standard (MASVS) e o Mobile Application Security Testing Guide (MASTG), pelo que o relatório serve também como evidência de verificação em MASVS-L1 ou L2 para requisitos de app stores, banca e saúde.","يتبع الاختبار معيار OWASP MASVS ودليل MASTG، ما يجعل التقرير دليل تحقق عند مستوى MASVS-L1 أو L2 لمتطلبات متاجر التطبيقات والبنوك والرعاية الصحية.")],scopeTitle:e("What We Test","O Que Testamos","ما الذي نختبره"),scope:[e("Local data storage, caches, logs and backups","Armazenamento local, caches, logs e backups","التخزين المحلي والذاكرة المؤقتة والسجلات والنسخ الاحتياطية"),e("Keychain / Keystore usage and cryptographic implementation","Uso de Keychain / Keystore e implementação criptográfica","استخدام Keychain / Keystore وتطبيق التشفير"),e("Hardcoded secrets, API keys and endpoint disclosure","Segredos hardcoded, chaves de API e exposição de endpoints","الأسرار المضمّنة ومفاتيح API وكشف النقاط النهائية"),e("Authentication, session handling and biometric bypass","Autenticação, gestão de sessões e bypass biométrico","المصادقة وإدارة الجلسات وتجاوز القياسات الحيوية"),e("TLS configuration and certificate pinning bypass","Configuração TLS e bypass de certificate pinning","تكوين TLS وتجاوز تثبيت الشهادات"),e("Backend API authorisation from the mobile client","Autorização da API de backend a partir do cliente móvel","تفويض الـ API الخلفي من عميل الجوال"),e("Root/jailbreak detection, anti-tampering and obfuscation","Deteção de root/jailbreak, anti-tampering e ofuscação","كشف الروت/الجيلبريك ومقاومة العبث والتعتيم"),e("Inter-process communication, deep links and exported components","Comunicação entre processos, deep links e componentes exportados","الاتصال بين العمليات والروابط العميقة والمكونات المُصدَّرة")],methodology:a.jsx(n,{}

1),compliance:["OWASP MASVS & MASTG (MASVS-L1 / L2 verification)","OWASP Mobile Top 10",e("PCI MPoC / PCI DSS 4.0 for payment-enabled apps","PCI MPoC / PCI DSS 4.0 para apps com pagamentos","PCI MPoC / PCI DSS 4.0 للتطبيقات التي تدعم الدفع"),e("ISO 27001 Annex A 8.25 secure development lifecycle","ISO 27001 Anexo A 8.25 ciclo de desenvolvimento seguro","ISO 27001 الملحق A 8.25 دورة التطوير الآمن"),e("GDPR data-minimisation and storage requirements","Requisitos de minimização e armazenamento de dados do RGPD","متطلبات تقليل البيانات وتخزينها وفق GDPR"),e("NIS2 Article 21 for in-scope operators","Artigo 21.º da NIS2 para operadores abrangidos","المادة 21 من NIS2 للمشغّلين المشمولين"),e("App Store and Google Play security review readiness","Preparação para revisão de segurança da App Store e Google Play","الجاهزية لمراجعة الأمان في App Store و Google Play")],cadence:[e("Test each major release, and always before the first public launch of an app that handles payments, health data or identity. Apps shipping every sprint typically run an annual full MASVS assessment plus targeted testing whenever authentication, payments or data storage change.","Teste cada release importante e sempre antes do primeiro lançamento público de uma app que trate pagamentos, dados de saúde ou identidade. Apps com releases em cada sprint costumam fazer uma avaliação MASVS completa anual mais testes dirigidos sempre que a autenticação, os pagamentos ou o armazenamento de dados mudam.","اختبر كل إصدار رئيسي، ودائمًا قبل الإطلاق العام الأول لتطبيق يتعامل مع المدفوعات أو البيانات الصحية أو الهوية. أما التطبيقات التي تُصدر مع كل دورة تطوير فتُجري عادةً تقييم MASVS كاملًا سنويًا مع اختبارات مستهدفة عند تغيّر المصادقة أو المدفوعات أو تخزين البيانات."),e("Both the Android and iOS builds should be in scope: the same feature is frequently implemented differently on each platform, and a flaw fixed on one is often still live on the other.","As builds Android e iOS devem estar ambas no âmbito: a mesma funcionalidade é frequentemente implementada de forma diferente em cada plataforma e uma falha corrigida numa continua muitas vezes ativa na outra.","يجب أن تشمل النطاق نسختا Android و iOS معًا: فالميزة نفسها تُنفَّذ غالبًا بطريقة مختلفة على كل منصة، والخلل المُصلح في إحداهما يبقى كثيرًا قائمًا في الأخرى.")],faqs:i,related:o})};export{P as default};