Mobile app penetration testing

Mobile apps, taken apart.

iOS and Android apps, the data they keep on the device, and the API traffic underneath them.

  • iOS
  • Android
  • Runtime instrumentation
  • Certificate pinning
Book a scoping callWhat we look at

Scope and deliverables

What we look at

  • The shipped build, for secrets and hidden endpoints
  • Runtime instrumentation past pinning and client-side checks
  • Local storage, deep links and exported components
  • The mobile API, which often lags behind the web one

What you get

Separate results per platform, with device-side and server-side causes kept apart.

Typical length

1 to 2 weeks per platform

Methods aligned with

OWASP MASVS, CVSS 3.1

Why it matters

We pull the build from the store, decompile it, instrument it on rooted and jailbroken devices, and test the API underneath.

The mobile API often lags behind the web one: an older version, a forgotten endpoint, or a check the web app makes on the server that the mobile app only makes on the device.

How we test it

Hackbots for breadth. Hackers for depth. Every lead is proven or discarded by a researcher before it reaches your report.

Our hackbots

  • Scan the shipped build for secrets and hidden endpoints
  • Replay every endpoint the app calls, with each role

Our researchers

  • Instrument the app at runtime, past certificate pinning and client-side checks
  • Test local storage, deep links and exported components
  • Keep device-side and server-side causes apart, so each team gets its own fixes

How an engagement runs

Five steps from the first call to the retest. You work directly with the researchers testing your systems at every one of them.

  1. Scope

    1 to 3 days

    We agree on assets, test accounts and rules of engagement, then send a fixed price.

  2. Recon

    First days of testing

    Hackbots map every host, route and role. A researcher builds the threat model.

  3. Exploit

    Most of the window

    Hackbots run the matrix at scale while researchers test by hand and take each lead to the end.

  4. Report and fix

    Within 5 working days

    Verified issues only, each with a CVSS 3.1 vector, replayable proof and a patch.

  5. Retest

    Free, within 90 days

    We confirm each fix and issue an updated report and attestation letter.

All 9 services

Tell us what you run. We’ll send a fixed quote.

No obligation and no sales sequence. A senior researcher reads every request and replies within one working day.

Book a scoping call[email protected]