Mobile App Security Assessment

Overview

Working in a group of four, we assessed the security of a grocery-delivery app across both its mobile and web versions. We evaluated it against four risk domains: access control, transport encryption, data storage, and API hardening, rather than looking for a single exploit. My focus was testing the transport encryption on the web application.

Testing transport encryption security

• Mapped the hosting setup with DNS and WHOIS lookups, confirming all HTTPS traffic terminated at Cloudflare’s edge before reaching the origin server,
• Verified HTTPS enforcement and certificate trust chains with curl and OpenSSL, and confirmed HSTS was correctly configured with a long max-age,
• Audited protocol and cipher support with Qualys SSL Labs and testssl.sh, confirming TLS 1.3 was prioritised with strong, forward-secret cipher suites, though the server still advertised deprecated TLS 1.0/1.1,
• Used Burp Suite to confirm no sensitive data, tokens, credentials, or PII, was transmitted over unencrypted channels.

Outcome

Beyond transport encryption, the wider team assessment uncovered an exposed production API key, weak hardcoded mobile encryption, and unrestricted local app backups.