Mobile App Penetration Testing Guide (iOS & Android)
What a mobile app pentest covers on iOS and Android, how OWASP MASVS shapes it, what testers need from you, and the issues that come up most often.
Application testing
Mobile App Penetration Testing (iOS & Android)
We test your mobile apps on real devices, from local storage to the APIs behind them, and show you what an attacker holding your app could do.
- OWASP MASVS
- OWASP MASTG
Overview
A mobile app runs on a device you don’t control, in the hands of anyone who downloads it. Attackers can unpack it, read what it stores, watch its traffic and talk to your backend directly. Anything the app keeps secret, or any rule it enforces on its own, should be treated as public.
Our testers look at your app from that angle. We test the build itself, the device-side storage and platform interfaces, and the APIs behind it, using the OWASP Mobile Application Security Verification Standard (MASVS) and the Mobile Application Security Testing Guide (MASTG) as our baseline.
iOS and Android
Both platforms can be tested together in one engagement, with the shared backend covered once. Each platform also gets its own focused checks.
iOS
- Local data storage: files, Core Data, SQLite,
NSUserDefaults, caches, screenshots and backups - Keychain: what is stored there, with which access-control attributes
- Network security: App Transport Security exceptions and certificate pinning
- URL schemes and universal links: what they can open or trigger, and how input is validated
- IPC and extensions: app extensions, pasteboard use and shared app groups
- WebViews:
WKWebViewconfiguration and JavaScript message handlers - Reverse engineering and tampering: binary protections, runtime manipulation and integrity checks
- Jailbreak detection: how it works and how easily it is bypassed
Android
- Local data storage: shared preferences, SQLite, external storage, logs and backups
- Keystore: key generation, storage and use of hardware-backed keys
- Network security: network security config, cleartext traffic and certificate pinning
- Deep links and intents: intent filters, app links and handling of untrusted input
- IPC and exported components: activities, services, broadcast receivers and content providers
- WebViews: JavaScript interfaces, file access and URL loading
- Reverse engineering and tampering: obfuscation, repackaging and runtime instrumentation
- Root detection: how it works and how easily it is bypassed
Scope
What we test
- Local data storage, caches, logs and backups
- Keychain and Keystore usage
- Network security and certificate pinning
- Authentication, session handling and biometrics
- Deep links, URL schemes and Android intents
- IPC and exported components
- WebViews and JavaScript bridges
- Hardcoded secrets, keys and API endpoints
- Reverse engineering and tampering resistance
- Jailbreak and root detection
- Third-party SDKs and their permissions
- The backend APIs the app depends on
Findings
Common issues we find
Generic examples of what this kind of testing tends to uncover. Every engagement is different, and we never share client findings.
Critical
Backend trusts the app too much
The API relies on the app to enforce limits or access, so a modified client or direct request bypasses them.
High
Secrets shipped inside the app
API keys, cloud credentials or signing secrets that anyone can extract from the app package.
High
Sensitive data stored in plain text
Tokens or personal data written to preferences, local databases or logs instead of the Keychain or Keystore.
High
Exported components reachable by other apps
Android activities, services or providers that any installed app can call without permission.
Medium
Deep links that skip checks
Links that open sensitive screens or trigger actions without confirming who the user is.
Low
Pinning missing or easily bypassed
Traffic can be intercepted on a modified device, which makes attacks on the backend much easier.
Severity shown is typical, not fixed. We rate each finding on its real impact in your environment.
Approach
How we test it
Analyse the app package
We unpack and decompile each build to understand its structure, find embedded secrets and review how sensitive features are implemented.
Test on real devices
We run the app on test devices, inspect what it stores, intercept its traffic and examine how it behaves on rooted and jailbroken devices.
Probe platform interfaces
We test deep links, intents, exported components, WebViews and other ways the operating system or other apps can talk to yours.
Attack the backend
Using what we learned from the app, we test the APIs it depends on for authorization, data exposure and logic flaws.
Map to MASVS and report
Findings are verified, rated by impact and mapped to OWASP MASVS controls, with platform-specific fixes for your iOS and Android teams.
Deliverables
What you receive
Every finding comes with proof-of-concept evidence, so your engineers can reproduce it and your auditors can trust it.
Executive summary
A plain-English view of risk for leadership, boards and customers.
Technical findings
Each issue with impact, evidence, reproduction steps and a clear fix.
Free retest
Once you’ve fixed the findings, we retest them and update the report.
Attestation letter
A letter you can share with customers and auditors to show testing was done.
Preparation
What we need from you
We'll confirm the details during scoping. Having these ready helps testing start on time.
- Test builds for each platform (IPA via TestFlight or ad hoc, APK or AAB)
- Test accounts for each user role
- Backend environment details and API documentation, if available
- Notes on any features that need special hardware or data to reach
- A technical contact for each platform
- An agreed testing window
FAQ
Mobile (iOS & Android) testing questions
Can you test iOS and Android together?
Yes, and it usually makes sense. Both apps tend to share a backend, so we test the shared APIs once and focus the rest of the effort on what is different about each platform.
Do you need the source code?
No. We test the compiled apps as an attacker would. If you can share source code, we can combine the test with a targeted code review for deeper coverage.
Should we disable certificate pinning or root detection for testing?
A build with these controls relaxed lets us spend more time on the issues that matter. We still assess the controls themselves, either on the production build or as a separate check.
Do you test the backend API too?
Yes. Most serious mobile findings sit in the backend. The APIs the app calls are included in scope as part of the engagement.
Is a retest included?
Yes. Once you ship fixes in a new build, we retest the reported issues at no extra cost and update the report.
Guides and free tools
API Security Testing Guide
The OWASP API Security Top 10 (2023) in plain English: what each risk means, how testers look for it, and what to prepare for an API penetration test.
AppSleuth, a mobile app security scanner
One command-line tool for mobile app security triage. Scan an IPA, APK, APKS or AAB for risky settings, secrets and weak hardening, compare builds, and audit app data. Free and open source.
Open source · install
Related services
API Penetration Testing
Hands-on testing of REST, GraphQL and gRPC APIs for broken authorization, data exposure and abuse of business logic.
Web Application Penetration Testing
Manual testing of your web app's authentication, access control and business logic, the places scanners can't reach.
Secure Code Review
Manual review of your most critical code, with findings mapped to exact lines and fixes your developers can apply.
Need a pentest for an audit, a customer, or peace of mind?
Tell us what you need tested. You’ll get a fixed-fee proposal with tester-days and timeline stated, usually within a few days of the scoping call.