Conduct MASVS-NETWORK certificate pinning verification test per MASTG guidance

Steps

1. Set up a proxy (e.g., Burp Suite or mitmproxy) with a custom CA and install the proxy CA certificate on the test device or emulator
2. Route the device's traffic through the proxy and launch the target app; observe whether HTTPS connections to the app's backend succeed or fail with a certificate error
3. If connections succeed through the proxy CA, pinning is absent or bypassed — document as a MASVS-NETWORK-2 finding per MASTG-TEST-0022 (Android) or MASTG-TEST-0068 (iOS)
4. For apps with pinning, attempt dynamic bypass using a Frida script targeting the platform's certificate validation APIs (SSLContext on Android, SecTrust on iOS) to confirm whether runtime bypass is feasible
5. Inspect the app binary statically for pinned hash values embedded as string literals or byte arrays; verify these match the production server's current SPKI hashes
6. Document findings with evidence of whether pinning is implemented at the application layer, network security config layer, or via a third-party library, as remediation steps differ for each