Mobile Application Testing
Mobile application penetration testing for iOS and Android. We test the app on the device, the traffic it sends and the API behind it, because the backend is usually where the serious findings are.
What the Test Covers
A mobile application penetration test looks at three things together: the app as installed on the device, what it sends over the network and the API it talks to. We test the build you give us on test devices, both statically and while it runs, following the OWASP Mobile Application Security Testing Guide. iOS and Android are tested separately because the two platforms store data, handle permissions and protect secrets in different ways.
The App Is Not the Boundary
Everything shipped in an app can be read by whoever installs it. Code can be decompiled, strings pulled out and traffic intercepted. An API key in the binary is a published API key. A check made in the app and not repeated on the server is a check an attacker simply skips. The most serious mobile findings tend to sit in the backend: an endpoint that trusts the app to send the right user ID, or one that returns more data than the screen ever shows.
What Lives on the Device
Phones get lost, sold and borrowed. We check what the app leaves behind: tokens in unprotected storage, personal data in logs and caches, screenshots of sensitive screens, data shared with other apps. We also look at whether a session survives logout, whether certificate pinning is in place where it matters and how easily the app can be tampered with or repackaged.
What You Get From the Test
Both Halves Tested
The app on the device and the API behind it, tested together so nothing falls between the two.
Platform Specific Fixes
Remediation written for iOS or Android as appropriate, so your developers know exactly what to change.
Safe to Release
Testing before launch finds the issues while they are still cheap to fix and before any user is affected.
How the Test Runs
We agree the scope in writing first: the builds, platforms, user roles and the APIs behind them. You send us the app files for each platform. Static analysis covers the package itself: embedded secrets, permissions, third party libraries and how it is protected. Dynamic testing runs the app on a test device, watches what it stores, intercepts the traffic it sends and tests the API directly with each user role. Authentication, session handling and the data each role can reach get most of the attention. Anything critical is reported the moment it is confirmed.
At a Glance
Static Analysis
Package reviewed for embedded secrets, permissions and third party libraries.
Dynamic Analysis
Runtime behaviour, network traffic and local storage observed on a test device.
Authentication & Session Testing
Login, token handling, session expiry and logout tested against the API.
Local Storage Review
Checks for tokens, personal data and secrets left on the device.
Report & Retest
Platform specific remediation guidance. Free retest included.
Findings appear in your client portal as we find them. Our day rate is published on the pricing page.
You May Also Be Interested In
Frequently Asked Questions
Do you test both iOS and Android apps?
Yes, both. Our methodology follows the OWASP Mobile Application Security Testing Guide and covers the issues specific to each platform, including local data storage, communication between apps, network traffic and protection against reverse engineering.
Do you need access to the source code?
No, but it helps. We can test from the compiled app alone or with access to source code and API documentation. More information means more of the time goes on finding problems rather than working out how the app is put together.
What are the most common vulnerabilities found in mobile apps?
Sensitive data stored unprotected on the device, API keys and credentials built into the app, missing or weak certificate pinning and an API that trusts the app too much. The last one is where account takeover and data exposure usually come from.
Can you test apps before they are released to the app store?
Yes. Before release is the best time to do it. We test unreleased builds on test devices or emulators, so issues are fixed before any user is affected. We can also fit testing into your release process so each major version is checked before it ships.