Does OWASP ZAP Support Mobile Hybird / Native application security testing. ?

[sathish dachepally]

Hi ,

I have gone through the OWASP site and came to know that , its the best Open source tool for Mobile Web Application Security testing through ZAP.  But I could not find the exact info about Hybird and Native application security testing.  Do we have any info. regarding this ? or Can someone please provide the info. about how to go head with Hybird / Native application security testing. ?

Please help me in this regard ASAP. 

Thanks,
Sathish D

[sathish dachepally]

Please help me out here.

[psiinon]

ZAP doesnt really have any specific support for native applications.
It can intercept, change, scan and fuzz all HTTP based communication. For that you will need to insert ZAP in-between the app and any services it communicates with.
Thats usually done via proxy settings, but I think there are other options if your application doesnt support those.
This is not really my area of expertise, but if you can explain a bit more about your requirements then maybe someone else here will be able to help.

Cheers,

Simon

[sathish dachepally]

Thanks Simon for the update:

Here is the details about my above query:

Say for example, once we installed any Hybrid/Native app like Gmail / Linked etc in the Mobile Device, How do we go head security testing for these Hybrid / Native apps using Zap ?  If Zap does not support for these Hybrid/Native apps, do we have any alternative tool from OWASP Organization ?

[kingthorin+owaspzap]

Perhaps something here can help you:

https://www.owasp.org/index.php/OWASP_Mobile_Security_Project
https://www.owasp.org/images/0/04/Security_Testing_Guidelines_for_mobile_Apps_-_Florian_Stahl%2BJohannes_Stroeher.pdf