DESC:FIELD OF THE INVENTION:
This invention relates to the field of electronics and computer engineering.

Specifically, this invention relates to a mobile application security testing system and method.

BACKGROUND OF THE INVENTION:
Plenty of mobile application testing tools have been developed and are available. These exist to support mobile development and applications’ development. As more and more companies and start-ups need to develop mobile products and mobile applications, the need for testing has exaggerated. In response to the growing number of mobile devices and platforms correlating to these mobile devices, it is vital that the mobile testing tools be more accommodating to understand and deal with this range. Furthermore, it is necessary that these mobile testing tools be more dynamic and scalable. Plenty of options exist in the mobile testing tool space, each with different strengths and weaknesses.

Due to a variety of workflows and functions in any given mobile application, rigour testing or regression testing is a very critical aspect before launch. Failure to catch bugs or regressions can cost companies thousands of dollars a day, and releasing broken apps can frustrate and alienate users.

Building test cases and human testing may be a robust way of testing application, today. But, it has its limitations in terms of scale, changing parameters instantaneously, recording performances, and the like. Further, it is an arduous, slow, and resource intensive process.

Therefore, there is a need for an automated mobile application testing system. By automating testing, one can run a suite of tests that would take a number of manual testing hours to complete in minutes or seconds. Speeding up testing can allow expansion of test coverage so that a bug-free application can be released.

OBJECTS OF THE INVENTION:
An object of the invention is to provide a mobile application security testing system and method which automates mobile application security testing.

Another object of the invention is to provide a mobile application security testing system and method which automates mobile application security testing by following real-world security testing approaches such as black box penetration testing, gray box penetration testing adopted by security testers or penetration testers.

Yet another object of the invention is to provide a mobile application security testing system and method which provides dynamic as well as static analysis for security flaws and issues.

Still another object of the invention is to provide a mobile application security testing system and method which provides speed, scalability, and repeatability.

SUMMARY OF THE INVENTION:
According to this invention, there is provided a mobile application security testing system configured to provide a mobile agent and a server communicably coupled to test an application on said mobile device through an installed mobile agent, said system comprises:
- an installation mechanism configured to be communicably coupled to a mobile device that is to be tested;
- a test case configuration mechanism configured to build test cases for testing saidapplication, said test cases comprising a variety of variable payloads;
- virtual node defining mechanism configured to define a plurality of virtual nodes for each test, thereby forming a network of said nodes in said mobile device, through said mobile agent, communicably coupled to said server, said nodes being configured to record data in relation to said test, said formed network being configured per test;
- capturing mechanism configured to record data at each of said defined nodes;
- a mapping mechanism configured to map each of said virtual nodes to said device, depending on device type, so that as said application is tested and as it encounters a virtual node, it activates a capturing mechanism for that specific stage in order to form a record file per specific node per specific test;
- scanning mechanism communicably coupled to said capturing mechanism configured to scan said application at each of said nodes, said scanning mechanism being configured to enable a dynamic scan or a static scan;
- an access and navigation module configured to allow access to the installed application to navigate through its flow and screens and further to use the application and to communicate and transact with said application, by navigating through the defined network of virtual nodes defined by the virtual node defining mechanism; and
- logging mechanism to capture test mobile device logs and application logs.

Typically, said scanning mechanism is configured to enable a Black Box Dynamic Analysis for analysis of said application on said mobile device through said agent, characterized in that, said scanning mechanism being configured with:
- a black box file chooser module configured to select an application that is to be tested;
- a black box navigate listener mechanism configured for capturing target hosts and for navigating steps of said mobile application having navigation functionality, thereby allowing said application to capture requests’ data to server and to collect vulnerability data;
- a black box step listener mechanism for navigating with steps having navigation functionality and further configured with a function to be called for checking data and its updates per parameter per node per application per mobile device;
- a black box proxy listener mechanism configured to serve as a gateway for transmission of information from said mobile agent to said server; and
- a black box traffic sniffer node configured to act as a proxy on said system in order to captures traffic in and out of said target mobile application for analysis;
- a black box test configuration mechanism configured to apply test cases to captured parameters of target application whilst running said test; and
- a black box screen capturing mechanism configured to allow a capturing screenshots ontarget mobile device for said application under testing.

Typically, said scanning mechanism is configured to enable a Gray Box Dynamic Analysis for analysis of said application on said mobile device through said agent, characterized in that, said scanning mechanism being configured with:
- a gray box file chooser module configured to select an application’s executable file that is to be tested;
- a gray box navigate listener mechanism configured for capturing target hosts and for navigating steps of said mobile application having navigation functionality, thereby allowing said application to capture requests’ data to server and collect vulnerability data;
- a gray box Step Listener mechanism for navigating with steps having navigation functionality and further configured with a function to be called for checking data and its updates per parameter per node per application per mobile device;
- a gray box proxy listener mechanismconfigured to serve as a gateway for transmission of information from said mobile agent to said server; and
- a gray box traffic sniffer node configured to act as a proxy on said system in order to captures traffic in and out of said target mobile application for analysis;
- a gray box test configuration mechanism configured to apply test cases to capture parameters of target application whilst running said test; and
- a gray box screen capturing mechanism configured to allow capturing screenshots on target mobile device for said application under testing.

Typically, said installation mechanism is an installation jack which is a port for facilitating installation of said mobile agent on to a mobile device, said mobile agent further being configured to be communicably coupled to a server machine.

Typically, said system comprises at least a login module configured to allow a tester to login to a console of a server machine for testing said mobile application as well as log in to the agent installed on the device so that the mobile device communicably coupled to the server, said login module being configured to relay input IP address and port number, to said server machine, upon logging in, thereby facilitating a communication channel between said mobile agent and said server.

Typically, said virtual node defining mechanism is configured to define filter nodes in order to restrict access of said test case configuration mechanism.

Typically, said test configuration mechanism is enabled to configure reverse engineering testing analysis for said application, characterized in that, said system being configured to perform operation in two parts:
a. convert mobile application file to folder to change data in folder, through a decompiler node; and
b. convert folder to mobile application file which tester can be downloaded after the changes that are done into the folder, through a recompiler node.

Typically, said virtual node defining mechanism and said test configuration mechanism is enabled to configure at least a decompiler node provided to convert mobile application file to folder to change data in folder through.

Typically, said virtual node defining mechanism and said test configuration mechanism is enabled to configure at least a recompiler node provided to convert folder to mobile application file which tester can be downloaded after the changes that are done into the folder.

BRIEF DESCRIPTION OF THE ACCOMPANYING DRAWINGS:
The invention will now be described in relation to the accompanying drawings, in which:

Figure 1 illustrates a schematic block diagram of this invention;
Figure 2 illustrates a flow chart of the login module of this invention;
Figure 3 illustrates a flow chart for the capture current device screen of this invention;
Figure 4 illustrates a flow chart download resources module of this invention;
Figure 5 illustrates a flow chart of the New Scan Black Box Dynamic Analysis of this invention;
Figure 6 illustrates a flow chart of the New Scan Gray Box Dynamic Analysis of this invention;
Figure 7 illustrates a flow chart for the failed scan process of this invention;
Figure 8 illustrates a flow chart of the Static Scan Analysis of this invention;
Figure 9 illustrates a flow chart for the traffic sniffer node of this invention;
Figure 10 illustrates a flow chart for the database explorer mechanism of this invention;
Figure 11 illustrates a flow chart for the logging mechanism of this invention;
Figure 12 illustrates a flow chart for the reverse engineering testing analysis of this invention;
Figure 13 illustrates a flow chart for the recompiler node of this invention;
Figure 14 illustrates a flow chart for the file explorer of this invention;
Figure 15 illustrates a flow chart for the completed snapshot scan of this invention; and
Figure 16 illustrates a flow chart for the compared snapshot scan of this invention.

DETAILED DESCRIPTION OF THE ACCOMPANYING DRAWINGS:
According to this invention, there is provided a mobile application security testing system and method. This system and method specifically provides a mobile agent – server communication to test an application in a real word scenario.

Figure 1 illustrates a schematic block diagram of this invention.

In accordance with an embodiment of this invention, there is provided an installation mechanism configured to be communicably coupled to a mobile device that is to be tested. In a preferred embodiment, this installation module is an installation jack which is a port for facilitating installation of this system on to a mobile device. The installation on the mobile device, that is to be tested, in is in the form of an agent (MA) or a client that is deployed. The installation module is further configured to setup a server application (SA) on a server machine in order to facilitate the testing.

In accordance with another embodiment of this invention, there is provided a login module (LM) configured to allow a tester to login to a console of the server machine for testing the mobile application as well as log in to the agent installed on the device so that the mobile device communicably coupled to the server. Upon logging in for the first time, input IP address and Port number is captured.

Figure 2 illustrates a flow chart of the login module of this invention.

This facilitates a communication channel between the agent and the server. Using traditional client server mechanism, authentication the mobile Agent and the Server is initiated.

In accordance with an additional embodiment of this invention, there is provided a test case configuration mechanism (TCM) configured to build test cases for testing a mobile application on the mobile device. These test cases may have a variety of variable and a variety of payloads. Typically, this test case configuration mechanism is enabled to configure Black Box, Gray Box testing approaches and generate report.

Thus, for each test that is configured, virtual nodes are defined by means of a virtual node defining mechanism. These virtual nodes form a network in the mobile device in order to define points at which recording of processes or results is to take place.

In a preferred embodiment, there is a three way authentication mechanism. Pre-defined filter nodes are set up by means of the virtual node defining mechanism in order to restrict the access of processes and mechanisms between Login and Logout. It is executed at all times, irrespective of whether a user is logged in or not.

If a user is not logged in to an application, at least one filter node redirects to the login mechanism, and if the user is logged in to the tool, then access is provided with normal flow. Further, in a preferred embodiment of the authentication procedure, license verification is carried out followed by authentication credentials determination and pattern lock determination.

With a mapping mechanism configured for the system and method of this invention, each of these virtual nodes are mapped on to the device, depending on device type, so that as the application is being tested, it crosses a virtual node, which then activates a recording mechanism for that specific stage in order to form a record file per specific stage per specific.

Test configuration mechanism can configure dynamic testing analysis (DTA) or runtime analysis for applications. This comprises security testing of mobile application for security flaws such as SQL Injection, XSS, Session related issue etc. Dynamic testing analysis configured by the test configuration mechanism is configured to Gray Box Testing as well as for Black Box Testing.

Test configuration mechanism can configure static testing analysis (STA) for applications. This comprises security testing on a mobile application file for security flaw such as client side injection, insecure data storage, Intent Leakage, permissions issues, etc.

Test configuration mechanism can configure mobile application infrastructure security testing analysis for applications. This comprises web server security issues. Virtual nodes are set-up at pre-defined locations in order to check security issues at those nodes.

In accordance with yet another embodiment of this invention, there is provided an access and navigation module configured to allow a tester to access the installed mobile application to navigate through its flow and screens and further to use the application and to communicate and transact with the application, by navigating through the defined network of virtual nodes defined by the virtual node defining mechanism. This module is provided for background tasks and continues to run in background. Typically, the access and navigation mechanism is enabled for surfing a target mobile application once the proxy listener mechanism (PLM) is started and is enabled for collecting all the information with respect to requests.

In accordance with still another embodiment of this invention, there is provided a capturing mechanism configured to capture functions related to the flow, use, communication, and / or transactions of the application. These functions comprise requests and response to / from the mobile application.

In at least one embodiment, the capturing mechanism comprises a screen capture mechanism configured to capture current device screen (CDS) of the application. This captured screen is downloaded and can be analysed.

Figure 3 illustrates a flow chart for the capture current device screen of this invention.

In at least one embodiment, the capturing mechanism is communicably coupled to a scanning mechanism configured to scan the application and capture scan details. Scan details gives the entire information about whatever scans were completed by the User having the details including Scan Name, Type of Testing (Static Analysis, Black Box OR Gray Box) and Date and Time of Scan. The details are shown in a tabular form wherein user can view the particular scan Report, can add his own Manual Findings and also he can Export the Report any format.
Scan Details contains mainly four sub menus:
A. Completed Scan
B. Failed Scan
C. Completed Snapshots
D. Completed Compared Snapshots

A. Completed Scans contains the List of all Scans which are done by the system. List contains the Name of Scan, Testing Type, Date and Time of Scan.
A database shows the entire List of Completed scan Details and sub modules as mentioned below:
a. View Report
b. Add Manual Findings
c. Export Report
d. Download Logs
e. Download Resources For mobile application files (Reverse Engineering Files)

a. View Report: In view report module, user can view the report vulnerability wise according to vulnerability risk like HIGH, MEDIUM and LOW.

b. Add Manual Findings: In add manual findings module, user can add manual findings related to a particular scan. Additionally, a user can add finding from the database or can add new one in other vulnerability option. A user needs to add add vulnerable URL, tampered request if any, header request and header response for affected URL.

c. Export Report: In Export Report module, user can download the scan report in any format.

d. Download Logs: In Download Logs module, user can download the scan logs.

e. Download Resources For mobile application files (Reverse Engineering Files):
In Download Resources module, user can download the resources related to the current selected scan (if any).

Figure 4 illustrates a flow chart download resources module of this invention.

B. Failed Scan Contains the List of all Scans which are not completed successfully by the User. List contains the Name of Scan, Testing Type, Date & Time of Scan. User can Export report in any format. Additionally, User can download the Logs related to that scan, User can also rescan the particular scan.

Here, first of all system checks if any scan has failed previously, i.e. database for the report was created or not. If it is available then the system tries to connect to the DATABASE.

Figure 7 illustrates a flow chart for the failed scan process of this invention.

Example: At the start of scanning the system adds the status of that scan as Failure, once it gets completed successfully then the system updates the Status as Success for particular Scan No. with particular User, from which the system can identify the completed scans and failed scans.

And finally Data Table shows the entire list of failed scan Details and sub module as below:
a. View Report
b. Export Report
c. Download Logs
d. Action (Rescan)

a. View Report: In view report module, user can view the report vulnerability wise, according to vulnerability risk like HIGH, MEDIUM and LOW.

b. Export Report: In Export Report module, user can download the scan report in any format.

c. Download Logs: In Download Logs module, user is facilitated to download the scan logs.

d. Action (Rescan): In this module user can resume the scan where the scan was aborted and once that scan will complete, full report will be generated for that scan.

For displaying the dashboard of Rescan Scan, three charts can be used i.e. bar chart, meter gauge and pie chart. While scan is in progress, the system updates the latest data into charts, counter and label for displaying the Testcase name.

A Listener mechanism is configured to provide a method name which is to be called or checked for data and it updates a per identity given in update parameter. For update, identity of the component is provided on poll. For interval, interval time for call poll listener /update component is to be provided.

C. Completed Snapshots contains the List of all Snapshots which are executed by the User. List Contains the Name of Scan, Snapshot Type. User can Export report in Format and User can download the Logs related to particular snapshot.

Figure 15 illustrates a flow chart for the completed snapshot scan of this invention.

That object scan contains all variables which were added into that object while returning to data table and from that object the system can fetch the variables with the same name declared into the system. The system has a list of all declared Variables, Constructors, getters, setters and Methods. The system first checks if any snapshot was completed previously, i.e. database for the report was created or not.

a. View Report: In view report module, user can view the report of snapshot by category wise.

b. Export Report: In Export Report module, user can download the scan report in any format.

c. Download Logs: In Download Logs module, user can download the scan logs.

D. Compared Snapshots contains the list of all comparison executed on Snapshots which are executed by the User. List Contains the Name of Scan, Snapshot Type. User can Export report in PDF format. Additionally, User can download the Logs related to particular snapshot also.

Figure 16 illustrates a flow chart for the compared snapshot scan of this invention.

a. View Report: In view report module, user can view the report of snapshot by category wise.

b. Export Report: In Export Report module, user can download the scan report in any format.

c. Download Logs: In Download Logs module, user can download the scan logs.

In at least an embodiment, the scanning mechanism is configured to work in a plurality of modes as discussed below:
a. New Scan Static Analysis
b. New Scan Black Box Dynamic Analysis
c. New Scan Gray Box Dynamic Analysis

a. New Scan Static Analysis is used to scan the target mobile application file which user has to test. User can test the mobile application file from target test device which should be a rooted device or user can upload the mobile application file.

Figure 8 illustrates a flow chart of the Static Scan Analysis of this invention.

There are two primary steps for executing the Static Analysis scan.

To display this module step wise, a Step Listener mechanism is created for navigating with steps having navigation functionality. The Step Listener mechanism is configured with method steps which are called in order to check for data. Intervals for polling such data can be defined. If vulnerability is found, it is added to a database for reporting.

Figure 5 illustrates a flow chart of the New Scan Black Box Dynamic Analysis of this invention.

b. New Scan Black Box Dynamic Analysis is used for scanning the mobile application file and all application requests (URL’s) navigation which user has to test. User can test the target application mobile application file only from rooted device. In this analysis, the system or its user is not required to obtain authentication with respect to the mobile application that is to be tested. The system of this invention is configured to conduct a Black Box Scan with ease.
In at least one embodiment, the application to be tested is selected using a file chooser module. A proxy along with a proxy listener mechanism is engaged for this analysis.

A Navigate Listener mechanism is configured for capturing target hosts and for navigating with steps having navigation functionality. In this step user needs to navigate the target mobile application, for which requests will be captured. Additionally, if a user wants to test limited number of requests, then user can select the host URL’s and it shows entire URL’s from all navigated requests for particular Black Box scan. Intervals for polling such data can be defined. If vulnerability is found, it is added to a database for reporting.

A test configuration mechanism is configured to apply test cases and to capture parameters of target hosts whilst running the test.

c. New Scan Gray Box Dynamic Analysis is used to scan the target application mobile application file and the entire application requests (URL’s) / navigation which user has to test. Gray box scanning is a scanning approach which facilitates the tester to login in to the target mobile application and navigate to the desired modules which are to be covered under current scan. User can test the target application mobile application file from rooted device only. The system of this invention is configured to conduct a Gray Box Scan with ease.

In at least one embodiment, the application’s executable file to be tested is selected using a file chooser module. A proxy along with a proxy listener mechanism is engaged for this analysis.

Figure 6 illustrates a flow chart of the New Scan Gray Box Dynamic Analysis of this invention.

To display this module step wise, a Navigate Listener mechanism is configured for capturing target hosts and for navigating with steps having navigation functionality. In this step user needs to navigate the target mobile application, for which requests will be captured. Additionally, if a user wants to test limited number of requests, then user can select the host URL’s and it shows entire URL’s from all navigated requests for particular Black Box scan. Intervals for polling such data can be defined. If vulnerability is found, it is added to a database for reporting.

A test configuration mechanism is configured to apply test cases and to capture parameters of target hosts whilst running the test.

In at least an embodiment of the system, there is provided a proxy listener mechanism. A proxy is a server that passes information to its clients without changing it, is usually called a gateway or sometimes tunneling proxy. Proxy servers get their name because they act like a proxy (a stand-in) and act on behalf of a Client's computer. The proxy listener mechanism listens (accepts incoming connections) the entire request which is traversing through a custom implemented the custom proxy server. Primary aim of the custom proxy is to intercept traffic between the target applications mobile application file’s to its Server.

An application file chooser mechanism is configured to retain and for future retrieval of all applications which are installed on target mobile device. A database explorer mechanism is communicably coupled to the system and which shows all the files associated with the applications on the target device. Test functions can then be performed on the selected files of the application.

Figure 10 illustrates a flow chart for the database explorer mechanism of this invention.

In at least one embodiment, the system comprises a traffic sniffer node (TSN) configured to act as a proxy on the connection / communication in a network of this system and method. This sniffer node captures traffic in and out of the target mobile application for analysis. Typically, the traffic sniffer node acts like a proxy on the active connection/communication taking place in the network. It captures the traffic going from the target mobile application and receiving from the server and analyzes it.

Figure 9 illustrates a flow chart for the traffic sniffer node of this invention.

The screen capturing mechanism allows a tester to take Screenshot of target device current screen and store it on the tester’s local workstation. The traffic sniffer node is used to capture the entire traffic going from device towards any external network. It facilitates the user with packer capture file which can be opened in a packet analyzer utility.

Test configuration mechanism can configure reverse engineering testing analysis for applications. This comprises downloading mobile application file from mobile device perform reverse engineering activity on selected mobile application file and automated facility to push mobile application file to the mobile device.

Figure 12 illustrates a flow chart for the reverse engineering testing analysis of this invention.

A decompiler node is provided to reverse engineer a target application mobile application file which user has to test. Firstly, the device data is fetched to show all mobile application file which are installed on a target device. The target device has to be connected to the server. Typically, a decompiler node is configured to extract source code of the application and assist in further analysis for any known security issues under static testing. Additionally, it facilitates in verifying reverse engineered code to check for possible modification and tampering.

A recompiler node is provided to reverse engineer a target application mobile application file which user has to test. The device data is downloaded from the decompiler node and changes are done to recompile into mobile application file which is then sent to device to test changes which a user has made.

Figure 13 illustrates a flow chart for the recompiler node of this invention.

Using reverse engineering testing analysis, the system is configured to perform operation in two parts:
a. convert mobile application file to folder and if a tester has to change the data from the folder, then the tester do the changes, this is Decompiler process
b. second, convert folder to mobile application file which tester can test the mobile application file after the changes that are done into the folder, this is Recompiler process

Furthermore, the testing configuration is configured to comprise logging mechanism to capture test mobile device logs, traffic sniffing feature to captured TCP traffics in same network, File Explorer for mobile device – wherein a tester can download/create/copy/delete files and directories present in mobile devices, DB Explorer for mobile device, explorer tester wherein a tester can download update/view/edit/delete database present on mobile device, tester which can check file changes/modification using comparison feature of snapshots, feature with facility to capture Mobile Device Screen and take screenshot of current screen for Proof of Concept.

Figure 14 illustrates a flow chart for the file explorer of this invention.

Typically, the logging mechanism captures device logs of the target mobile device and allows a tester to download it in plain text on local machine for further analysis.

It may work in association with a file explorer mechanism which is related to a target mobile device file explorer; it shows all the files and directories which are present on the target device.

In accordance with an embodiment of this invention, there is provided a report module wherein a tester can view and export testing reports in various file formats. Also there is a reporting feature which facilitates tester in writing custom report and/or add new vulnerabilities to the report.

Typically, the logging mechanism captures device logs of target mobile device and allows a tester to download it in plain text on a workstation for further analysis. The logging mechanism is used to capture all the logs of running applications (in background) on the target device. The logging mechanism can be manufactured for a specific application for a specific time duration.

Figure 11 illustrates a flow chart for the logging mechanism of this invention.

File explorer is used to explore the files located on the target test device from which user can easily manage operations on the files present on the target test device.
It has some sub functions which can be very much of help to the user, as follows:
• Back
• Refresh
• Home
• Create New File
• Create New Directory
• Copy File
• Copy Directory
• Delete File
• Delete Directory
• Rename
• Download File
• Download Directory
• View Downloads
• Search Box

Here, the system is enabled to call the device data to show all mobile application file which are installed on the target test device.

While this detailed description has disclosed certain specific embodiments for illustrative purposes, various modifications will be apparent to those skilled in the art which do not constitute departures from the spirit and scope of the invention as defined in the following claims, and it is to be distinctly understood that the foregoing descriptive matter is to be interpreted merely as illustrative of the invention and not as a limitation.

,CLAIMS:WE CLAIM,

1. A mobile application security testing systemconfigured to provide a mobile agent and a server communicably coupled to test an application on said mobile device through an installed mobile agent, said system comprising:
- an installation mechanism configured to be communicably coupled to a mobile device that is to be tested;
- a test case configuration mechanism configured to build test cases for testing saidapplication, said test cases comprising a variety of variable payloads;
- virtual node defining mechanism configured to define a plurality of virtual nodes for each test, thereby forming a network of said nodes in said mobile device, through said mobile agent, communicably coupled to said server, said nodes being configured to record data in relation to said test, said formed network being configured per test;
- capturing mechanism configured to record data at each of said defined nodes;
- a mapping mechanism configured to map each of said virtual nodes to said device, depending on device type, so that as said application is tested and as it encounters a virtual node, it activates a capturing mechanism for that specific stage in order to form a record file per specific node per specific test;
- scanning mechanism communicably coupled to said capturing mechanism configured to scan said application at each of said nodes, said scanning mechanism being configured to enable a dynamic scan or a static scan;
- an access and navigation module configured to allow access to the installed application to navigate through its flow and screens and further to use the application and to communicate and transact with said application, by navigating through the defined network of virtual nodes defined by the virtual node defining mechanism; and
- logging mechanism to capture test mobile device logs and application logs.

2. A mobile application security testing system as claimed in claim 1 wherein, said scanning mechanism being configured to enable a Black Box Dynamic Analysis for analysis of said application on said mobile device through said agent, characterized in that, said scanning mechanism being configured with:
- a black box file chooser module configured to select an application that is to be tested;
- a black box navigate listener mechanism configured for capturing target hosts and for navigating steps of said mobile application having navigation functionality, thereby allowing said application to capture requests’ data to server and to collect vulnerability data;
- a black box step listener mechanism for navigating with steps having navigation functionality and further configured with a function to be called for checking data and its updates per parameter per node per application per mobile device;
- a black box proxy listener mechanism configured to serve as a gateway for transmission of information from said mobile agent to said server; and
- a black box traffic sniffer node configured to act as a proxy on said system in order to captures traffic in and out of said target mobile application for analysis;
- a black box test configuration mechanism configured to apply test cases to captured parameters of target application whilst running said test; and
- a black box screen capturing mechanism configured to allow a capturing screenshots on target mobile device for said application under testing.

3. A mobile application security testing system as claimed in claim 1 wherein, said scanning mechanism being configured to enable a Gray Box Dynamic Analysis for analysis of said application on said mobile device through said agent, characterized in that, said scanning mechanism being configured with:
- a gray box file chooser module configured to select an application’s executable file that is to be tested;
- a gray box navigate listener mechanism configured for capturing target hosts and for navigating steps of said mobile application having navigation functionality, thereby allowing said application to capture requests’ data to server and collect vulnerability data;
- a gray box Step Listener mechanism for navigating with steps having navigation functionality and further configured with a function to be called for checking data and its updates per parameter per node per application per mobile device;
- a gray box proxy listener mechanism configured to serve as a gateway for transmission of information from said mobile agent to said server; and
- a gray box traffic sniffer node configured to act as a proxy on said system in order to captures traffic in and out of said target mobile application for analysis;
- a gray box test configuration mechanism configured to apply test cases to capture parameters of target application whilst running said test; and
- a gray box screen capturing mechanism configured to allow capturing screenshots on target mobile device for said application under testing.

4. A mobile application security testing system as claimed in claim 1 wherein, said installation mechanism is an installation jack which is a port for facilitating installation of said mobile agent on to a mobile device, said mobile agent further being configured to be communicably coupled to a server machine.

5. A mobile application security testing system as claimed in claim 1 wherein, said system comprising at least a login module configured to allow a tester to login to a console of a server machine for testing said mobile application as well as log in to the agent installed on the device so that the mobile device communicably coupled to the server, said login module being configured to relay input IP address and port number, to said server machine, upon logging in, thereby facilitating a communication channel between said mobile agent and said server.

6. A mobile application security testing system as claimed in claim 1 wherein, said virtual node defining mechanism being configured to define filter nodes in order to restrict access of said test case configuration mechanism.

7. A mobile application security testing system as claimed in claim 1 wherein, said test configuration mechanism being enabled to configure reverse engineering testing analysis for said application, characterized in that, said system being configured to perform operation in two parts:
c. convert mobile application file to folder to change data in folder, through a decompiler node; and
d. convert folder to mobile application file which tester can be downloaded after the changes that are done into the folder, through a recompiler node.

8. A mobile application security testing system as claimed in claim 1 wherein, said virtual node defining mechanism and said test configuration mechanism being enabled to configure at least a decompiler node provided to convert mobile application file to folder to change data in folder through.

9. A mobile application security testing system as claimed in claim 1 wherein, said virtual node defining mechanism and said test configuration mechanism being enabled to configure at least a recompiler node provided to convert folder to mobile application file which tester can be downloaded after the changes that are done into the folder.

Dated this 13th day of February, 2017.

CHIRAG TANNA
of LEGALANCE
APPLICANT’s PATENT AGENT