Mobile application penetration testing: iOS and Android

Your mobile app stores credentials, accesses sensitive APIs and handles customer data. Do you know what happens when someone pulls it apart? We assess the app, the API it consumes and the communication channel between them.

Mobile apps have vulnerabilities invisible to the user

Unlike a website, the user of an app installs the code on their own device. This lets an attacker decompile it, analyse its traffic, extract hardcoded API keys, identify the business logic and attack the backend API with full knowledge of how it works internally. The OWASP Mobile Top 10 captures the most exploited flaws, but the real-world casuistry goes far beyond that.

What we assess

  • Insecure storage of sensitive data (keychain, shared preferences, local databases)
  • Credentials and API keys embedded in the code
  • Insecure communications: certificate pinning, TLS, traffic interception
  • Weak authentication: tokens, biometrics, sessions that never expire
  • Vulnerabilities in the backend API the app consumes
  • Static code analysis (reverse engineering): APK/IPA decompilation
  • Integrity controls: root/jailbreak detection, anti-tampering

Audit process

  1. Environment setup: We set up the analysis environment: emulators/devices, interception proxy and decompilation tooling.
  2. Static analysis: We break down the binary (APK or IPA), analyse the generated source code and look for credentials, keys and sensitive logic.
  3. Dynamic analysis: We run the app under controlled conditions, intercept its traffic and test its behaviour in real time.
  4. Backend API audit: We review every endpoint the app consumes using the same criteria as a standard API pentest.
  5. Reporting and delivery: We document every finding with evidence, impact and a recommended fix.

Deliverables

  • Static analysis report: code findings, exposed credentials, excessive permissions
  • Dynamic analysis report: intercepted traffic, runtime vulnerabilities
  • Backend API report: authentication, authorisation and business logic vulnerabilities
  • Consolidated executive report with the application's overall risk
  • Review meeting with the mobile and backend development teams

When do you need it?

  • Before launching an app on the App Store or Google Play
  • Banking, healthcare, insurance or any sector handling sensitive data
  • Apps with payment integrations (Stripe, PayPal, in-house gateways)
  • When a distributor, franchisor or enterprise client requires it
  • After a major update to the app or the backend API

Frequently asked questions

Do you need the app's source code?

It is not essential. We can work from the binary alone (APK or IPA) for the static analysis. Source code, when available, allows a deeper and more efficient review.

Do you audit both iOS and Android apps?

Yes. We work with both platforms. iOS requires jailbroken devices or the use of the simulator for certain dynamic analyses. Android is more accessible for emulator-based analysis.

What impact does it have on store publication?

None directly. The audit is carried out on a test build or the production version already published. Fixes are implemented before the next release.

Can you audit just the API without analysing the app?

Yes. If your app has already been audited or your concern is the backend, we can focus solely on the API. See our API pentesting service.