Android application penetration testing

Android holds 72% of the global mobile market and is attackers' favourite target. We audit your app against OWASP MASVS to ensure your users' data stays protected.

Why is Android especially critical for security?

Android's fragmentation, the ease of installing third-party APKs and the wide variety of manufacturers with their own customisations vastly expand the attack surface. An exported Activity with no protection, a ContentProvider that exposes data to other apps or a misconfigured WebView can all be exploited without the user ever noticing.

What we cover in an Android pentest

  • Static APK analysis: decompilation with jadx/apktool, Manifest review, permissions and code
  • Insecure exported components: Activities, Services, Receivers, Providers
  • Insecure storage: SharedPreferences, SQLite, external files, logcat
  • Communications: interception with Burp Suite, certificate pinning bypass, TLS analysis
  • WebView: JavaScript interface, file:// access, allowBackup, debuggable
  • Dynamic analysis with Frida: hooking, root detection and anti-tampering bypass
  • Data exposure in ADB backups and system logs
  • Aligned with OWASP MASVS 2.0 and OWASP MASTG

Android pentesting methodology

  1. Decompilation and Manifest analysis: Analysis of the AndroidManifest.xml, permissions, exported components and security configurations.
  2. Static code analysis: Review of the decompiled code looking for hardcoded secrets, insecure APIs, sensitive data handling and vulnerable components.
  3. Dynamic analysis: Instrumentation with Frida on a rooted device for real-time behaviour analysis and control bypass.
  4. Traffic interception: Proxy setup and certificate pinning bypass for a complete analysis of communications with backends.
  5. MASVS report: Classification of findings by MASVS-L1/L2 levels with specific recommendations for Kotlin/Java.

Deliverables

  • Executive report with MASVS score
  • Technical report with evidence and PoC per vulnerability
  • OWASP MASVS 2.0 classification with compliance levels
  • Code recommendations for the Android team (Kotlin/Java)
  • Re-test included

What types of apps do we test?

  • Banking and fintech apps with biometric authentication and payments
  • Healthcare apps holding patients' clinical data
  • Enterprise apps with MDM and corporate email access
  • Marketplaces and e-commerce with integrated payments
  • Messaging or communication apps with private data

Frequently asked questions

Do you need the source code of the Android app?

It is not essential. We can work directly with the APK through black/grey box analysis. The source code allows a deeper analysis, especially for detecting business logic vulnerabilities.

Can you run the test without a physical device?

Part of the analysis (static and network) can be performed with emulators. For full dynamic analysis with Frida and hardware-backed security analysis, we recommend a rooted physical device.

Does the audit help with GDPR compliance in Android apps?

Yes. We identify where personal data is stored and transmitted, whether it is adequately protected and which permissions are excessive or unnecessary, all of which is key to a privacy impact assessment (DPIA).