Scan it. Bypass it. Prove it.
SentryScan Mobile is a self-hosted Android and iOS application security platform for authorized mobile VAPT. It takes an APK or IPA, tells you what the app is built on and which defences it ships, runs the full MASVS rule set plus a 58-control banking & fintech checklist, then hands you the exact Frida bypasses for those defences — with your device screen live inside the console and every proof captured to the evidence locker as you work.
The console
Four tabs — Scanner, Bypass, Capabilities, Settings — with an Android / iOS segmented control that switches the whole interface to that platform. Drop an APK or IPA on the scanner and the workflow starts.
↑ Scan results, resilience matrix and the recommended bypass order in one view.
The full workflow, end to end
Most mobile tooling stops at the static report and leaves you to assemble the dynamic half by hand. This runs the whole engagement in one place.
Drop the build
APK or IPA, drag and drop. The scanner identifies the app architecture — Native, Flutter, React Native, Xamarin or Cordova — plus packers and obfuscators.
Read the defences
It reports which controls the app actually implements — root/jailbreak detection, SSL pinning, anti-debug, anti-Frida, emulator checks, integrity — as intel, not noise.
Get the bypass plan
Those detections drive an ordered, numbered bypass plan with a plain-language reason per script. Run one, or run all in order.
Capture the proof
Before/after screenshots and the live Frida output stream land in the evidence locker automatically, ready to drop into the report.
Re-test the fix
Drag the reassessment build in beside the original and get the security delta — new permissions, trackers, behaviours and fixed vs. new findings.
What makes it different
The features that came out of doing real mobile assessments and getting tired of the parts that waste a tester's day.
Your device screen, in the tool
Mirror an Android Studio virtual device or a physical phone straight into the console — pick which one from a dropdown. Tap through the app while your bypasses run, with a one-button Refresh & Connect and an scrcpy fallback for stubborn ROMs.
PoC capture built into testing
Every bypass run stores before/after device snapshots and a live Frida terminal transcript in the evidence section, so the proof for the report is produced while you test — not reconstructed afterwards.
Banking, fintech & NBFC checklist
A 58-control checklist across 12 categories aligned to OWASP MASVS v2.1, Mobile Top 10 (2024), PCI-DSS / PCI-MPoC and RBI digital-payment guidance — mPIN encryption, device binding, app attestation, secure keypad, forced update, published checksum. Each control scores PASS / FAIL / REVIEW / N/A with impact, mitigation and verification steps.
40 Frida scripts, and yours too
28 Android + 12 iOS scripts across 18 categories: universal and native SSL unpinning, Cronet, Flutter, React Native, Xamarin, Cordova, root & Magisk, jailbreak, anti-debug, anti-Frida, emulator, biometric, FLAG_SECURE, keychain dump, traffic and crypto interception. Drop your own .js in and it loads automatically after the built-ins.
One-click environment setup
A built-in setup doctor checks every required tool — adb, jadx, apktool, frida, frida-tools, objection — and installs what's missing with one click, printing the exact command for macOS, Linux or Windows when a package manager is needed.
frida-server, handled
Upload the frida-server binary (raw or .xz) from Settings and the tool pushes it to the device, sets execution rights and starts it. It also compares host vs. device Frida versions — the single most common reason a bypass silently does nothing — and tells you the fix.
Assessment vs. reassessment
Drag in two builds and get the security regression delta in one click: added/removed permissions, dangerous permissions, trackers, behaviours, packer changes, plus fixed and newly introduced findings — with a grade delta and a REGRESSION flag.
Local-first AI assist
Optional and off by default. Every finding gets Explain · How to bypass · Remediate · Frida hook, answered by a model running on your own machine through Ollama. Target data never leaves the host — which matters when scan output describes someone else's app.
It tells you why, not just that
A connection diagnostic walks the whole chain — adb present, server up, device authorised, frame grabbed, frida-server running, versions matched, app installed — each with a concrete fix. If a bypass can't run, a preflight self-check names the exact blocker.
The banking & fintech checklist
Standard mobile engagements get the MASVS checklist. Financial apps get this one on top — run at --threat-profile high, scored per control, and enforceable in CI with --fail-on-checklist.
| Category | Representative controls | Scored |
|---|---|---|
| Authentication & session | 2FA / mPIN, session timeout, re-authentication, device binding | PASS FAIL REVIEW |
| Payments / PCI | PAN handling, secure keypad, PCI-MPoC alignment, transaction signing | PASS FAIL REVIEW |
| Cryptography & key management | mPIN end-to-end encryption, keystore usage, no hardcoded keys or static IVs | PASS FAIL REVIEW |
| Network communication | TLS version, certificate pinning, no cleartext, network-security-config | PASS FAIL REVIEW |
| Data storage & privacy | Sensitive data at rest, backup flags, logging, screenshot protection | PASS FAIL REVIEW |
| Resilience & anti-tamper | Root/jailbreak detection, enforce-on-rooted, app attestation, integrity | PASS FAIL REVIEW |
| Platform & IPC | Exported components, deep links, WebView hardening, task hijacking | PASS FAIL REVIEW |
| Secrets & supply chain | Embedded credentials, third-party SDKs, published checksum | PASS FAIL REVIEW |
| Privacy & permissions | Dangerous permissions, tracker inventory, data-flow to network/log | PASS FAIL REVIEW |
| Build & code quality | Debuggable, signing scheme, obfuscation, minSdk | PASS FAIL REVIEW |
| iOS binary & bundle hardening | PIE, stack canary, ARC, encryption, entitlements, ATS | PASS FAIL REVIEW |
| Operational & regulatory | Forced update, incident response hooks, regulatory disclosure | PASS FAIL REVIEW |
↑ 12 categories · 58 controls · every one with description, impact, mitigation, steps-to-verify and manual verification. REVIEW controls can be confirmed on-device.
What it detects
Every finding carries severity, confidence, source (static or dynamic), CWE, MASVS control and OWASP Mobile Top 10 category — and expands to what it is, its impact, how to exploit it and how to verify it.
▲ Android
▲ iOS
Bypass & dynamic toolkit
Detected defences become an ordered plan. Everything below runs behind an explicit authorisation gate — engagement reference, allow-listed device serial and target package.
Reporting
The same output discipline as SentryScan for web: evidence first, reproducible, and shaped for the client's report.
Report formats
HTML, JSON and PDF, with an OWASP Mobile Top 10 coverage matrix, an app information & security posture panel, and a decompiled code PoC snippet attached to each finding via --poc.
Recon & supply chain
Endpoints, Firebase and S3 references, native libraries and third-party SDKs — the privacy and supply-chain lens auditors ask about.
CI gate
--min-severity, --fail-on and --fail-on-checklist turn the scan into a build gate that fails on a HIGH finding or a failed banking control.
Related reading
Android Pentesting in Practice
The methodology this product automates — and where manual testing still wins.
// product · webSentryScan for web & API
The proof-based web scanner this shares its report pipeline and philosophy with.
// product · freeVAPT Report Builder
Turn the findings and captured evidence into a client-ready PDF or Word report.
Testing a banking or fintech app?
SentryScan Mobile was built for exactly that engagement — the checklist, the evidence trail and the bypasses that pinned financial apps actually need. Early access is opening to a small group.
Request early access →