Análisis de vulnerabilidades mediante Pentesting a la aplicación móvil desarrollada para el centro médico de especialidades "la Dolorosa"

Abstract

This work focused on the evaluation of the security of the mobile application of "La Dolorosa" Specialty Medical Center, to identify and mitigate vulnerabilities, guaranteeing the security of patient data. To achieve this, a combination of tools for static and dynamic analysis such as MobSF,Burp Suite and SOL Map were used.. The Mobile Application Security (OWASP) methodology was applied in together with the OWASP Mobile Application Security Testing Guide (MASTG) for the definition of the phases and the Mobile Application Security Verification Standard (MASVS) for the correction of the vulnerabilities. Microsoft's DREAD model was used to classify the vulnerabilities found. Subsequently, penetration tests were carried out to validate the implemented corrections. As a result, ten high- and medium-level vulnerabilities in the mobile application were identified and confirmed. After the implementation of the corrections, a significant reduction in the level of risk associated with each vulnerability was achieved. The post-correction analysis showed a 48% risk reduction compared to the initial state of the application. Mitigation strategies based on comprehensive security analysis can significantly improve application security, thereby reducing risk to users and increasing data security.