What is mobile application penetration testing?
Mobile application penetration testing covers the app on the device, the data it stores, and the APIs it talks to. Incursion tests iOS and Android applications for UK organisations, either black box from the installed app or source-assisted where you provide the code, using named consultants with UK Cyber Security Council professional titles.
What we test
Data at rest on the device: credentials, tokens, caches, logs and databases, and whether they are protected if the device is lost or rooted.
Data in transit: certificate validation, certificate pinning and what happens on a hostile network.
Authentication, session handling and biometric or PIN bypass.
Reverse engineering resistance: hard-coded secrets, obfuscation, tamper and root/jailbreak detection.
Platform interaction: intents, URL schemes, deep links, inter-process communication and permissions.
The back-end APIs the app depends on, tested against the OWASP API Security Top 10.
Testing follows the OWASP Mobile Application Security Testing Guide.
Why it matters
A mobile app is code running on a device you do not control, on networks you do not control, with the user’s data in its hands. Most mobile findings are either secrets left in the app or an API that trusts the app more than it should. Both are invisible from the outside until someone looks.
How we run it
Scoping. Your account manager and an active penetration tester work with you to agree the scope of your test on a scoping call. The quote is fixed to it.
Testing. A named, suitably qualified consultant does the work, and you get a direct line to them before, during and after the engagement. Critical and high-risk issues are verified and reported immediately.
Reporting. Easily digestible summaries sum up the whole engagement and support detailed technical findings, written so your team can replicate and fix them. Delivered within 5 working days.
Free retesting. One day of free retesting for every five days of consultancy, taken within 90 days of report delivery, so you can be sure the fixes worked.
Scoping notes
Black box: give us the store listing or the build and we test what an attacker with the app could do. Source-assisted: provide the repository and we review code alongside dynamic testing, which finds more in less time. We need test accounts for each role and, for source-assisted work, a build we can instrument.
What you get
A named consultant with a UK Cyber Security Council professional title, who scoped the work and delivers it.
A report within 5 working days: executive summary, technical summary, and observation, impact and remediation for every finding.
Immediate notification of critical and high-risk issues, once we have verified them.
Free retesting: one day for every five days of consultancy, within 90 days of the report.
A walkthrough call with the consultant for your team, on request, at no extra cost.
Frequently asked questions
Black box or source-assisted, which should we choose?
Source-assisted finds more and is usually faster per finding, because the tester can see where secrets and logic live rather than inferring them. Black box shows what an outside attacker sees. If you own the code, source-assisted is the better use of the days.
Do you test the API as well as the app?
Yes, where it is in scope, and it usually should be. Most serious mobile findings are on the server side.
Do you need a jailbroken or rooted device?
We use our own instrumented devices. You do not need to provide hardware.
Ready to scope a test?
Book a call. Our sales team will set it up and handle the proposal; an active penetration tester agrees the scope with you. No obligation.