Mobile · iOS · Android

Penetration testing for your mobile app

An app installed on someone else’s phone can be taken apart, modified and listened to. We check what someone doing exactly that learns — and what they can do with the API behind it.

iOS and AndroidOWASP MASVSBackend APIs on request
Request a quote →How we work
What we test

The app, the phone and the server

We start from the APK or IPA package (black-box) or also from the source code and documentation (graybox).

Local storage

What stays on the phone: tokens, personal data, temporary files, cache and logs — and whether the system protects them or they sit in plain view.

Secrets in the app

API keys, passwords and internal addresses written into the code (hardcoded), which surface at the first decompilation.

Communication with the server

TLS, certificate pinning and what someone intercepting the traffic between the app and the server sees.

Authentication and sessions

Biometric authentication, session persistence, logout and what happens to the data when the phone is lost.

Code protection

Resistance to decompilation and tampering, root/jailbreak detection and what someone running a modified build can change.

The backend APIs

If you include them in the test: REST and GraphQL, authentication, authorisation, injections and access to other users’ objects (IDOR).

Request a quote

Build your request in two minutes

Three steps, no prices to guess: tell us what you have, and within one business day you receive the scope, duration and schedule of the test.

  1. 1 What we test
  2. 2 How and when
  3. 3 Where we reply
Which platforms?
Do we also test the API the app talks to?
What does the app do?
How many features or screens?
How do we test?
On which environment?
Does a regulation or audit apply to you?
When do you need the report?
One per line. Nothing is tested before a signed authorisation.

We use your details only to answer this request. Privacy policy

Methodology

How the project unfolds

Following OWASP MASVS and MASTG, with static analysis (the code) and dynamic analysis (the running app), on iOS, Android or both.

  1. Scope and quote

    You tell us what is in scope; you receive a quote with the scope, duration and schedule within one business day.

  2. Testing authorization

    You sign the authorization in the portal: the targets, the testing window and the rules. No test starts without it.

  3. Reconnaissance and testing

    We map the app and the servers it talks to, then test manually, with automated tools only as support. You follow the testing status in the portal.

  4. Report and walkthrough

    You receive the executive and technical reports; serious findings are flagged to you immediately, not at the end.

  5. Remediation and retest

    Once you fix them, you request the retest from the portal: we verify each finding and close it with evidence.

What you receive

Deliverables

  • Executive report: the risk in terms management understands, without jargon
  • Technical report: every finding with severity, evidence and reproduction steps
  • Concrete remediation steps, for your technology
  • Findings in the portal: owner, due date, history and one-click retest
  • An attestation letter for auditors, publicly verifiable
Further reading

Guides related to this service

OWASP Top 10 guideHow to prepare for a pentestPCI DSS v4.0.1 guidePentest or vulnerability scan?
FAQ

What clients ask us

What do you need to start?
The app package (APK or IPA, or access through a testing programme such as TestFlight) and test accounts. For graybox, also the source code or the API documentation.
Do you test before a release?
Yes, and it is the best moment. The usual timeline is 2–3 weeks; for an imminent release, in urgent mode, 5–7 days.
Is there any risk to our systems?
We work with maximum caution: tests are scheduled with you, after a signed testing authorization, and any action that could affect operations is agreed in advance or performed on a test environment.
What do we receive at the end?
An executive report for management and a technical one for the team: every finding with its severity (critical, high, medium, low), the evidence and the remediation steps. You also track the findings in the portal, where you request the retest once they are fixed.

Want to know what someone taking your app apart finds?

Describe the scope; we reply with a quote within one business day.

Request a quote →