Mobile application penetration testing
Your iOS and Android apps, and the services behind them, tested the way an attacker with your app on their own phone would.
When you need it
- Before launching or majorly updating an app
- Your app handles payments, health or personal data
- An app store, partner or customer requires it
- After a change of development team
What we test
We test the app on real and rooted or jailbroken devices, and the back-end it talks to, following the OWASP Mobile Application Security Testing Guide (MASTG).
Tokens, personal data or keys stored insecurely, in logs, backups or caches.
TLS validation, certificate pinning and what is sent in clear text.
Biometrics, PINs, session tokens and how the app enforces them.
Hard-coded secrets, tampering protections, and the API the app depends on.
How the test runs
- Scoping. Platforms (iOS, Android or both), app builds, test accounts and the API in scope.
- Builds. A test build (TestFlight, APK or IPA) is best; production store builds can also be tested.
- Testing. Usually five to eight days for both platforms and the shared back-end.
- Report and debrief. Platform-specific findings with fixes, a walkthrough, and one retest within 90 days.
Supports
- OWASP MASVS
- PCI DSS
- SOC 2
- App store and partner requirements
Questions
Do we need to test both iOS and Android?
If both are live, yes: the platforms store data and enforce security differently. The shared back-end only needs testing once.
Can you test an app built with Flutter or React Native?
Yes. Cross-platform frameworks change some techniques, not the risks we look for.
Is the app's API included?
The parts the app uses are. A full API test is worth adding if partners or other clients use it too.
Know exactly what your test will cost by tomorrow
Tell us what you need tested. You'll get questions or a fixed quote within three working days.