App-Ray Static and Dynamic Analysis Workflow

App-Ray Features How it works

Identify Vulnerabilities, Mitigate Risks, Comply with Regulations


App-Ray Static Analysis (SAST) and Dynamic Analysis (DAST) provides actionable results with 80+ types of security vulnerabilities, data management and privacy issues to identify - such as:

  • privacy leak, user data leak, leaky permissions - using data flow and network traffic analysis
  • vulnerable SDKs, libraries, or contains phone virus, malware, trojan
  • insecure communication on the network, improper SSL - TLS security settings
  • encryption-related issues, insufficient cryptography
  • insecure data storage, local database - SQL injection issues
  • hybrid app-related problems (unsafe WebView, Webview hijacking & more)


The workflow consists of the following steps:


Static Analysis - Static Application Security Testing, SAST

App-Ray Static Analysis uses reverse engineering - decompilation and/or disassembly - to analyze your mobile application, therefore accessing the source code is not required. This involves investigating the bytecode and structure of the application without executing it.

App-Ray features a highly efficient bidirectional data flow tracing, revealing unwanted data flows which can impose violations of security and privacy requirements. Threats to data integrity and secrecy, such as SQL injections or unprotected Intents, will be identified in this step.


Dynamic Analysis - Dynamic Application Security Testing, DAST

During plain dynamic analysis, the original app is executed in a test environment and its behaviour is analyzed. Screenshots are taken, network traffic is recorded, and a full trace of syscalls and accessed files is created. Private information sent out to advertisement and user profiling platforms is identified. Users can choose whether they wish to interact with the app or whether the analysis runs entirely automatically.

Instrumentation, Hybrid Analysis

Instrumentation makes a slight modification to the app to extract specific information from it in a hybrid static/dynamic analysis. Guided by knowledge gained from static analysis and modifications injected by instrumentation, App-Ray’s hybrid analysis engine investigates the app’s runtime behaviour under specific security-relevant conditions. It ensures that critical parts of the app are executed and observed.

Tracing of individual function calls and register values allow deep insights into the app’s behaviour. The hybrid engine attempts to provoke execution of vulnerable code fragments and records encrypted traffic in plaintext, allowing inspection for private information.



App-Ray presents its most relevant findings in a structured overview. A drill-down into detailed analysis results and raw data of the analysis is possible. All analysis results are stored in App-Ray and can be retrieved at a later time in PDF, JSON formats, or via REST API for further processing. The generated reports are digitally signed, and all outputs are optionally available in White-Labelled format as well.



Want to see how App-Ray is used in production? Click here:

INTERESTED? TRY IT NOW! // Free trial options, customized subscriptions

Test App-Ray Now

Free access to App-Ray.
No commitments, no credit card required.

Schedule a Demo

Want to see how to use App-Ray?
Book a conference call where we can demonstrate how App-Ray works.


Contact us

Would you like to talk to us, do you have questions?
Leave us a message and your contact details, we will come back to you soon.

Subscribe to App-Ray Mobile Security

Ready to use App-Ray for production? Subscribe here quickly and conveniently.
Safe online payments, instant purchase.