Cybersecurity
Mobile application penetration testing
A mobile app puts your code and a copy of your data in the attacker’s hand. We examine what the app stores, how it talks to your servers, and what the back end allows when the app is not in the way.
The problem this service solves
Mobile apps run on devices you do not control. Anyone can install your app, inspect its files, intercept its traffic and modify its behavior. Anything sensitive that the app trusts itself to protect is in reach.
The more important question is usually the back end. Attackers rarely stay inside the app: they extract the API calls and test them directly. We test both layers together.
What is in scope
-
Local data storage
Files, databases, keychain/keystore use, logs, backups and clipboard exposure.
-
Network communication
TLS configuration, certificate validation, pinning behavior and sensitive data in transit.
-
Authentication and session
Biometric flows, token storage, session expiry, device binding and recovery.
-
Platform interaction
Deep links, intents, URL schemes, exported components, WebViews and inter-app data sharing.
-
Binary and reverse engineering
Hard-coded secrets, debug features, tamper resistance and obfuscation, assessed against the risk of the app.
-
Back-end APIs
Authorization and logic flaws in the APIs the app calls, tested directly.
How the work runs
Prepare
Set up the test environment.
-
1
Build and device setup
Use test devices, instrumented where needed, with the test build you provide.
-
2
Static review
Inspect the package, manifests, permissions and embedded secrets.
Test
Run the app and see what it does.
-
3
Dynamic analysis
Observe storage, traffic and runtime behavior. Attempt to bypass client-side controls.
-
4
API testing
Replay and modify requests outside the app, as in an API penetration test.
Report
Separate client risk from server risk.
-
5
Findings by layer
Distinguish issues in the app from issues in the API so the right team fixes them.
-
6
Retest
Confirm fixes in a new build.
What you receive
- Executive summary
- Findings mapped to OWASP MASVS requirement areas
- Evidence from static and dynamic analysis
- API findings shown as requests
- Remediation guidance for app and back end
- Retest results
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Test builds for iOS and/or Android (debuggable if possible)
- Test accounts for each role
- API documentation
- A description of any anti-tamper or runtime protection in use
What this service is not
- An app-store review or compliance check
- Testing of third-party SDKs beyond how your app uses them
What changes afterwards
- Sensitive data is not left on the device unnecessarily
- The back end does not depend on the app behaving honestly
Questions people ask
Do you test jailbroken or rooted conditions?
Yes, as one scenario. We also test the app on a stock device, which is the condition most real users face.
Is certificate pinning enough?
It raises the effort to intercept traffic, but it can be bypassed on a device the attacker controls. Treat it as a speed bump and keep the API secure on its own.
Related
-
API penetration testing
Testing REST, GraphQL and internal APIs for broken authorization, tenant isolation failures, token weaknesses and business-logic abuse.
-
Web application penetration testing
Manual testing of authentication, authorization, session handling, input handling and business logic in web applications.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response