Mobile application pentest
iOS and Android apps and their back-end APIs, following the OWASP Mobile Application Security Testing Guide.
- Typical length
- 5–8 testing days
- Approach
- Build or store release
- Price
- Quoted after scoping
What we test
- Insecure local data storage
- Certificate pinning bypass
- Hard-coded secrets
- Deep link and intent abuse
- Back-end API authorization
Standards we follow
- OWASP Mobile Application Security Testing Guide (MASTG)
- OWASP MASVS
- OWASP Mobile Top 10
- CVSS 3.1 scoring
Issues we often find
Typical findings from this kind of test, written the way they appear in our reports.
- Session tokens or personal data stored unencrypted on the device
- API keys hard-coded in the app
- A deep link opens a privileged screen without checks
- The back-end API trusts values the app is supposed to control
What we need from you
We send this checklist at kickoff so testing starts on day one.
- App builds (IPA/APK) or store links
- Test accounts for each user role
- Documentation of the back-end API
- Information about any jailbreak/root detection
How the engagement runs
Scope
We agree on targets, test accounts, rules of engagement and testing windows. You get a fixed quote.
Recon
We map your attack surface: hosts, routes, roles, third-party services and data flows.
Exploit
Testers chain weaknesses the way a real attacker would and confirm impact without harming production.
Report
Findings are rated with CVSS 3.1, with proof, business impact and a clear fix for each one.
Retest
Once you have fixed an issue, we verify it and update its status in the report.
Attest
We issue a signed letter of attestation you can share with customers and auditors.
Get a fixed quote
Tell us what is in scope and we send a fixed quote, usually within one business day.