// mobile
Mobile app testing
We test Android and iOS apps against the OWASP MASVS — and the APIs behind them, because most mobile risk lives on the server. Static and dynamic analysis, on real devices, with the app's own traffic.
// scope
What's in scope
We scope every engagement in person-days against your real attack surface. Here's what a typical test of this kind covers.
- Insecure local storage (keystore, SQLite, shared prefs, plists)
- Weak or misused cryptography
- Certificate pinning and TLS validation bypass
- Hardcoded secrets and keys in the bundle
- Tampering, root/jailbreak detection, repackaging
- Deep links, inter-app communication, exported components
- The backend APIs: auth, IDOR, business logic
- Session handling and token storage
- App-store takedown or fraud investigations
- Denial-of-service against the backend
- Third-party SDKs you can't authorize testing of
// method
How we test it
Manual-first, grounded in our five-stage methodology. Scanners cover ground; a person reproduces and proves every finding.
- 01
Scope & authorize
We agree the build (APK/IPA), platforms, test accounts and backend scope in a signed letter.
- 02
Static analysis
Decompile and review the bundle for secrets, weak crypto, insecure storage and exported components.
- 03
Dynamic analysis
Run the app on instrumented devices, bypass pinning, and intercept and tamper with live traffic.
- 04
Backend testing
Attack the APIs the app talks to — the usual suspects: IDOR, auth bypass, mass assignment.
- 05
Report & retest
MASVS-mapped findings with CVSS scores and fixes, plus a free retest.
// deliverables
What you get
A report a developer can act on and a manager can understand — plus a free retest to confirm the fixes.
- Findings mapped to OWASP MASVS control groups
- Per-finding CVSS score, evidence and remediation
- Separate app-side and backend-side findings
- Reproduction steps that work on a standard device
- A free retest of every finding after you fix
// faq
Common questions
Do you need source code?
No — we test the shipped build like an attacker would. If you share source we'll use it to go deeper, but it isn't required.
Android, iOS, or both?
Either or both. Pricing scales with platforms and the size of the backend API surface.
Do you test the backend too?
Yes. Most serious mobile findings are server-side, so the APIs the app calls are in scope by default.
Ready to scope this?
Share your targets and timeline and we'll reply with a scope and a quote. Most scoping calls take thirty minutes.