Mobile application penetration testing
Mobile Application Penetration Testing
Test your iOS and Android apps end to end. A mobile app is more than the code on the device, so we test the app, how it stores data, and the APIs behind it. All application testing is performed by consultants who hold both GWAPT and OSWE.
Device and backend together
Many mobile issues live in the API, not the app. Testing them together is the only way to see the full picture.
We test on real or instrumented devices and inspect traffic between the app and its backend so nothing gets missed at the boundary.
Where the same API also serves a web client, we make sure the scope reflects that so you are not paying for overlapping work.
What we test
- How the app stores data on the device, including caches and logs.
- Authentication, session handling, and token storage.
- The APIs the app depends on, including authorization between users.
- Transport security and certificate handling.
- Client-side controls that can be bypassed or tampered with.
- Handling of sensitive data in memory and at rest.
- Platform configuration on both iOS and Android.
Our process
- 1
Scope
We agree on the platforms, builds, accounts, and APIs in scope before testing begins.
- 2
Access and setup
You provide builds and test accounts. We set up devices and confirm we can exercise the app.
- 3
Testing
We test the app and its backend manually, supported by tooling, and confirm each issue.
- 4
Reporting
You receive findings with steps to reproduce, business impact, severity, and remediation guidance.
- 5
Readout and retest
We walk through the findings with your team. Retest terms are set in the statement of work.
What a good report includes
Findings your engineers can reproduce and fix, and a summary your stakeholders can follow.
- Each finding with clear steps to reproduce on the device or API.
- Business impact described in plain language.
- Severity rated with a documented, consistent method.
- Remediation guidance for both the app and the backend.
- An executive summary that reflects the actual findings.
Scoping checklist
These questions define coverage so both sides know what is included. This is about clarity, not a checklist for choosing a vendor.
- Which platforms are in scope: iOS, Android, or both.
- Which builds and versions we should test.
- Which APIs and backend services the app uses.
- How many user roles or account types to cover.
- Any jailbreak or root detection to account for.
- What is explicitly out of scope.
- Test windows and who to contact for critical-severity findings.
Scope a mobile application test
Tell us about your app and we will follow up with next steps.