  Mobile applications are used to handle different types of data. Commonly,
there is a set of personal identifiable information present in the data stored,
shared and used by these applications. From that, attackers can try to exploit
the mobile application in order to obtain or to cause private data leakage.
Therefore, performing security assessments is an important practice to find
vulnerabilities in the applications and systems before the application is
deployed, or even during their use. Regarding security assessments, Penetration
Test (Pentest) is one of the security test types that can be used to detect
vulnerabilities through simulated attacks. Additionally, Pentest can be
performed using different methodologies and best practices, through several
frameworks to: organize the test execution, execute tools, provide estimations,
provide reports and document a Pentest. One such framework is Tramonto, which
aims to assist a cybersecurity expert during the Pentest execution by providing
organization, standardization and flexibility to the whole Pentest process.
This paper presents a Pentest case study applied to a Brazilian university
Mobile App using the Tramonto framework. The main goal of this case study is to
present how Tramonto can be applied during a Pentest execution, assisting
cybersecurity experts in the tasks included in the Pentest process. Our results
show details on how to perform a Pentest using Tramonto and the found
vulnerabilities in the Mobile App. Besides that, there is a discussion about
the main contributions obtained from our results, and we were able to verify
that Tramonto managed, organized and optimized the whole Pentest process.
