Mobile app security testing requires combining static and dynamic analysis mapped to OWASP MASVS and MASTG controls. Static analysis with MobSF catches hardcoded secrets, insecure storage, and manifest misconfigurations quickly but misses runtime behavior. Dynamic tools like Frida (runtime instrumentation, certificate pinning bypass) and Drozer (Android IPC surface exploitation) fill that gap. IAST sits between the two, correlating static findings with actual data flows. A practical checklist covers: running MobSF on release binaries, mapping findings to MASVS domains, cross-checking MASWE weakness entries, dynamic testing on physical devices, manual pen testing for business logic, and re-running static analysis on signed production binaries. CI/CD integration should gate on severity thresholds (critical/high only) rather than raw finding counts. Testing must be done on production-signed binaries on real hardware, not emulators, since root detection, TLS pinning, and anti-tampering checks behave differently in emulated environments.
