Vulnerability Assessment

Vulnerability Assessment searches systems for known vulnerabilities. It is a list based approach where you test your application against all known vulnerabilities, and if detected, you should fix those immediately.

How It Works

It is performed on an occasional basis and can be completely automated by using platforms like Appknox SAST, DAST, and APIT. Some of our customers perform vulnerability assessments on their apps as occasional as on a weekly basis, depending on their release cycles.

Steps Post Binary Upload.

SAST

Static Analysis is done over the mobile app binary to gather different data. These include the resources and hardcoded strings that are packed into the application binary.

Know more about SAST

DAST

Dynamic Analysis is done by running the application over real-time
devices, set up in a real environment (device-farm) where the user can interact with the devices rendered though the browser and operating different kinds of data-flow analysis over memory dumps.

Know more about DAST

Dynamic Induced API Security Testing

API Analysis is performed on the HTTP requests that the app makes during the dynamic analysis. The API server is tested for common web server vulnerabilities.

Know more about APIT

Penetration Testing

Penetration Testing attempts to identify insecure business logic, security setting vulnerabilities, or other weaknesses that a threat actor could exploit — transmission of unencrypted passwords, password reuse, etc.

Appknox makes use of the hacker approach to uncover sophisticated security threats that cannot be detected in vulnerability assessment.

Comparison