Mobile App Penetration Testing (Android & iOS)
Mobile apps run on devices you do not control, talk to APIs you do control, and often store more sensitive data than they should. Mobile app penetration testing looks at all three: the app itself, the data it keeps on the device, and the backend it talks to.
I have tested Android and iOS apps for fintech and consumer products, and I test both the client and its API in the same engagement.
What I test
- Local data storage: secrets, tokens and personal data in files, databases, logs and the keychain/keystore.
- Network communication: TLS, certificate pinning and what the app sends and receives.
- Authentication and session handling, including biometric and PIN flows.
- Backend API security: authorisation, data exposure and logic flaws in the APIs the app uses.
- Platform interaction: exported components, deep links, intents, WebViews and URL schemes.
- Resilience: root/jailbreak detection, tamper protection and hard-coded secrets found by reverse engineering.
How I work
Testing follows the OWASP Mobile Application Security Verification Standard (MASVS) and Testing Guide (MASTG).
- Scoping: you provide the APK/IPA (or store links), test accounts and any backend scope.
- Static analysis: decompiling the app to review code, configuration and embedded secrets.
- Dynamic analysis: running the app on test devices with tools such as Frida and Burp Suite to observe and manipulate its behaviour.
- API testing: testing the backend endpoints the app relies on.
- Reporting and retest.
What you get
- A report covering both Android and iOS findings, with severity, impact and reproduction steps.
- Platform-specific fix guidance for your developers.
- A retest once fixes ship.
Related services
Because most mobile risk sits in the backend, this pairs well with API penetration testing.
Get started
Tell me what you want tested, how large it is and when you need it, and we can agree a scope. Based in India? See how I work with companies across India. Contact me to discuss your mobile app.