MOBILE APP PENETRATION TESTING
iOS and Android application testing with static, dynamic and network analysis, performed by an OSCP and eMAPT-certified team.
Your mobile app ships to devices you do not control, over networks you cannot trust, carrying logic and secrets an attacker can pull apart at their own pace. We test iOS and Android applications the way a real attacker would: from the binary on the device, to the app while it runs, to the traffic it sends. The result is findings your developers can reproduce and fix.
Why mobile needs its own test
A mobile app is distributed as a binary that lives on a device in the user's hands, so an attacker can decompile it, tamper with it at runtime, and inspect everything it stores locally: attack surface a server-side test never touches. These are the issues we find again and again, and none of them show up if you only test the API from the outside.
Hard-coded keys
Weak certificate pinning
Insecure local storage
Logic that trusts the client
Mobile testing also pairs with the backend the app talks to. Many of the highest-impact findings, such as broken authorisation, weak session handling, and leaked API keys, only become exploitable when the client and the server are examined together, so our mobile engagement can extend into the APIs and backend services the app depends on. We recommend a test before any major release, and again after changes that touch authentication, payments, or the data the app keeps on the device. Because app stores push frequent updates, mobile security is rarely a one-off: the versions your users run drift away from the one you last assessed.
How we test
Every engagement runs through three analysis phases on both iOS and Android: from the shipped binary, to the app at runtime, to the traffic it sends. The tools shift with the target, such as Frida, Objection, Burp Suite, jadx, Drozer, and platform SDKs. Every reported issue is validated by hand.
Static analysis
We work from the shipped package (IPA and APK). On Android, reading the recovered Java source shows how the app really behaves.
iOS: binary analysis
- List all libraries
- Reverse engineer by disassembling the package
- Analyse the components
Class-dump-z otool hopper
Android: reverse engineering
- Decompile
- Patch
- Analyse the components
- Access the decompiled Java source
jadx eclipse Drozer
Dynamic analysis
We hook the running application to intercept and modify function calls, explore the file system, and inspect memory and logs. This is where client-side trust assumptions, insecure storage, and bypassable controls surface.
iOS tools
Frida Appmon iExplorer xcode Snoop-it iFunbox Objection
Android tools
Frida adb Android Studio Genymotion
Network analysis
We intercept the app's HTTP/SSL/HTTPS/TLS traffic and tamper with it, testing certificate validation, transport security, and whether the backend re-checks everything the client claims.
iOS tools
Burpsuite sslkillswitch2
Android tools
Burpsuite Frida
The engagement, end to end
Around that technical methodology sits the same five-step process we run on every penetration test.
Scoping
We agree on the apps, platforms (iOS, Android, or both), and build variants in scope.
You get a proposal with a fixed timeline and price.
Rules of engagement
Test accounts, backend environments, and data-handling rules.
Agreed before testing starts
Testing
Static, dynamic, and network analysis against the agreed scope.
Performed manually
Reporting
An executive summary for management and technical findings for your engineers.
Every finding is reproducible
Retest & debrief
After your team fixes the issues, we verify each one.
The engagement closes with a debrief
What you get
Executive summary
The business-level risk picture, suitable for management and auditors.
Findings with severity ratings
Each issue scored with CVSS and mapped to the affected platform, so remediation can be prioritised.
Reproduction steps
The exact steps to reproduce each finding, with tooling, commands, and screenshots.
Remediation guidance
Practical, platform-specific fixes for iOS and Android.
Retest verification
Findings are re-checked after your fixes and the report is updated to reflect closed items.
Every engagement to date has produced validated findings.
Team credentials
Certifications
- OSCP
- OSCE
- CREST CRT
- CREST CPSA
- GIAC GREM
Mobile testing is performed by our in-house team holding industry certifications including these. See the full list of certifications the team holds.
Mobile-specific
- eMAPT
- GMOB
The team also holds mobile-specific credentials such as the eLearnSecurity Mobile Application Penetration Tester (eMAPT) and GIAC Mobile Device Security Analyst (GMOB).
Standards
- NIST SP800-115
- OWASP MASVS
- OWASP MASTG
Our testing follows the NIST SP800-115 methodology and is guided by the OWASP Mobile Application Security Verification Standard (MASVS) and Mobile Application Security Testing Guide (MASTG), the recognised references for what a thorough mobile assessment should cover. When your compliance or app-store requirements call for it, we can align the engagement to a specific MASVS verification level.
Related services
Penetration test
Mobile testing runs the same five-step process as every penetration test.
PCI DSS penetration test
If your app handles card data, mobile testing folds into the wider PCI DSS scope.
Consulting
If your app processes personal data, it feeds the privacy controls our consulting team helps you build.
Last reviewed: 12 Oct 2026
Mobile App Penetration Test
Tell us which apps and platforms are in scope. We agree the build variants with you and send a proposal with a fixed timeline and price.
Frequently asked questions
Why does a mobile app need its own test, separate from the web or API test?
A mobile app ships as a binary on a device you don't control, so an attacker can decompile it, tamper with it at runtime, and read whatever it stores locally, none of which a server-side or API test ever reaches. Because app-store updates are frequent, we recommend testing before any major release and again after any change to authentication, payments, or on-device data storage.
How do you test a mobile app?
Three analysis phases on both iOS and Android: static analysis (working from the shipped IPA/APK: binary analysis on iOS, decompiling and reverse-engineering on Android), dynamic analysis (hooking the running app to intercept function calls, inspect storage, and bypass controls), and network analysis (intercepting and tampering with HTTP/TLS traffic to test certificate validation and transport security). Every issue is validated by hand.
Do you test the backend and APIs the app talks to?
Yes, when it's in scope. Broken authorisation, weak session handling, and leaked API keys often surface only once the client and server are tested together, which is why the engagement can extend into the APIs and backend services the app depends on rather than stopping at the app binary.
Which platforms and standards do you cover?
iOS and Android, against MASVS and MASTG, with NIST SP800-115 governing how the engagement itself runs. MASVS defines verification levels, and a statement of MASVS compliance is only meaningful once a level is named. A banking app and an internal tool are held to different ones, and picking that level is the decision that sets the depth and the price of the engagement.
From our team
ARTICLES/11 Dec 2025
รีวิว GMOB 2025 เนื้อหาสอบและวิธีเตรียมตัว
รีวิวสอบ GMOB 2025 เจาะลึกเนื้อหา Mobile Security ครอบคลุมทั้ง Android และ iOS พร้อมสรุปเทคนิคการใช้เครื่องมือ Pentest และวิธีการทำ Index สำหรับสอบ Open Book เพื่อแนวทางการเตรียมตัวที่ครบถ้วนและตรงจุด
ARTICLES/19 Apr 2025
Reverse Engineering แอปพลิเคชัน React Native ที่ใช้ Hermes: พื้นฐานและ Hermes Bytecode
อธิบายว่า app React Native ที่ใช้ Hermes engine ต่างจาก JavaScriptCore อย่างไร ตรวจสอบได้อย่างไรว่า app ใช้ Hermes และ disassemble Hermes bytecode ด้วย hbcdump พร้อมตัวอย่างจาก DemoSecret app
ARTICLES/29 May 2023
Application Penetration Tester (eMAPT) 2023
วันนี้ผมจะมาเล่าถึงการไปสอบเอา Certificate ที่สายทำ Mobile Application Penetration Testing ต้องมีกัน คือ eLearnSecurity Mobile Application Penetration Tester (eMAPT)
Tell us which apps are in scope
We agree the apps, platforms and build variants with you, then send a proposal with a fixed timeline and price.
