Service 1.5
Mobile application penetration testing.
We test your iOS and Android apps and the API behind them: what the app keeps on the phone, what it sends, and what a user can do that they should not.
1 What we test
- Data on the device: what the app stores on the phone, and whether it is protected.
- Traffic: what the app sends, and whether it checks it is talking to your server (certificate pinning).
- Sign-in: login, sessions, and unlock by fingerprint or face.
- Secrets in the build: keys and passwords shipped inside the app.
- Deep links: links from the web or other apps that open screens or start actions.
- The API behind the app, with each role, as in our API test.
Method: OWASP MASVS, OWASP MASTG, NIST SP 800-115.
2 Not included
Store accounts, device theft scenarios.
3 What you provide
- The build (IPA or APK) or the store link.
- Test accounts for each role.
- Which platforms are in scope: iOS, Android or both.
- A contact we can call during the test windows.
4 How the test runs
- Scope call: we agree the platforms, the roles, the test windows and who to call. You get a written offer with dates and price.
- You sign the authorization. Nothing reaches your app or API before that.
- We test the app on our own test devices, then the API it calls.
- A critical finding goes to your contact as soon as it is proven. It does not wait for the report.
- Report and readout, then a retest once you have fixed.
5 What you get
| Document | What it holds | For |
|---|---|---|
| Technical report | Each finding with its exploit path, proof, CVSS 4.0 score, CWE and fix. | Developers, IT |
| Executive report | Five to eight pages on business risk, in plain words. | Management, board |
| Remediation plan | Findings ranked by what to fix first. | IT, project leads |
| Readout | A remote session to walk through the findings and answer questions. | Both |
| Retest attestation | Proof that the findings were fixed. | Auditors, clients |
6 Questions
- How long does it take?
- It depends on the platforms and the size of the app. The written offer gives the number of testing days and the dates before you sign.
- iOS and Android both?
- Yes, or just one. The two apps are tested apart, since they are often built differently.
- Do you need the source code?
- No. We test the build you ship, as an attacker would get it from the store.
- Is the API included?
- The API the app calls is tested with your accounts. A full API test, every endpoint including ones the app never calls, is its own service.
Get a scope for this test
Tell us what needs testing. A tester replies with a written offer: scope, dates and price.
Request a scope