Penetration Testing
Mobile Application Penetration Test
We test your iOS and Android apps along with the device, network traffic and the APIs behind them. We show where the app leaves sensitive data and which protections can be bypassed.
What it is
A mobile application penetration test assumes the app runs on a device outside your control. It examines data stored on the device, communication with the server and the app's own protections. The APIs used by the app are tested in the same engagement. The method follows OWASP MASVS and MASTG.
Scope
- Data, keys and session information stored on the device
- Communication with the server and certificate pinning
- Biometric login, local authentication and session lifetime
- Root and jailbreak detection, obfuscation and integrity checks
- Authorization in the APIs behind the app
- Deep links and data sharing with other apps
The need
When organizations need it
- Before submitting a new mobile banking, insurance or health app to the app stores.
- Before a major release that changes the payment, transfer or authentication flow.
- When you want an independent assessment before accepting an app developed by an external agency.
Method
How we work
-
Scope
We agree on the app versions, test accounts and APIs in scope.
-
Static review
We examine the app package for embedded keys, permissions and configuration errors.
-
Dynamic testing
We run the app on test devices and examine stored data, traffic and protections.
-
APIs and retest
We test the APIs behind the app independently and retest after fixes.
Outcome
What you have at the end
You know which sensitive data your app leaves unprotected on the device or in traffic, and which protections can be bypassed. Findings are mapped to MASVS controls.
Frequently asked questions
Does root and jailbreak detection protect our app?
These protections slow an attacker but do not stop one. Real security relies on server-side controls and not leaving sensitive data on the device.
Do you need the source code?
It is not required, as the test uses the same app package submitted to the stores. If the source code is shared, some findings can be confirmed faster and more precisely.
Are iOS and Android tested separately?
Yes, the two platforms have different data storage and security models. Shared APIs are tested once.
Penetration Testing
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting