Mobile Penetration Testing
Android and iOS apps against OWASP MASTG — insecure storage, weak cryptography, insecure IPC, certificate-pinning bypass and client-side trust issues.
Mobile application penetration testing is an assessment of Android and iOS apps against the OWASP Mobile Application Security Testing Guide (MASTG). Passeca finds the flaws unique to mobile clients — insecure data storage, weak cryptography, insecure IPC, certificate-pinning bypass and client-side trust issues — tests on real rooted and jailbroken devices, and reports each with evidence and developer-ready remediation.
What concrete vulnerabilities do we test for?
Mapped to OWASP MASVS / MASTG controls. Mobile risk concentrates in how the app stores data and how much it trusts the device.
Insecure data storage
Sensitive data — tokens, PII, credentials — written to shared preferences, SQLite, logs, or the clipboard, readable by a local attacker or a malicious app.
Weak cryptography
Hard-coded keys, insecure algorithms (DES, ECB), predictable random number generation, and key material embedded in the binary.
Insecure inter-process communication (IPC)
Exported activities, services, content providers and broadcast receivers that leak data or allow unauthorised invocation by other apps on the device.
Certificate-pinning bypass
Missing or weak TLS certificate pinning that allows a man-in-the-middle to intercept or tamper with app traffic using a proxy.
Client-side trust & code tampering
Security decisions enforced on the device — root/jailbreak detection that is trivially bypassed, anti-debugging defeated, and runtime patching of logic.
Authentication & session handling
Long-lived tokens without refresh, session tokens that survive logout, biometric bypass, and PIN handling that leaks to storage.
Methodology for mobile apps
OWASP MASVS / MASTG drives the test catalogue. Static analysis of the binary plus dynamic analysis on rooted and jailbroken devices.
Each engagement combines static analysis — decompilation, deobfuscation, secret discovery and a review of exported components — with dynamic analysis on real rooted Android and jailbroken iOS devices, using runtime instrumentation to hook logic, bypass anti-tampering and inspect storage and network traffic.
We assess data storage (shared preferences, Keychain/Keystore, SQLite, logs, clipboard), cryptography, network communication and certificate pinning, platform interaction (IPC, deep links, intents, app extensions), and resilience against reverse engineering and code tampering. The backend API the app talks to is covered where in scope.
Example findings from real (anonymised) mobile tests
Mobile findings are typically data-handling and trust issues invisible from the server side.
Session token written to plaintext shared preferences
A local attacker or malicious app could read the active session token from device storage and fully hijack the account without re-authentication.
Certificate pinning absent — full traffic interception
Without TLS pinning, a proxy with a custom CA certificate could intercept and modify all app traffic, exposing credentials and data in transit.
Exported content provider leaked the local database
An Android content provider declared exported and unguarded allowed any installed app to query the app's private database.
Root detection bypassable with a single hook
The app's jailbreak/root check was defeated by a runtime hook, unlocking a privileged code path intended to be blocked on rooted devices.
Findings are anonymised and paraphrased. Specific reproduction steps are reserved for the engagement report.
How long does a mobile pentest take, and what does it cost?
Driven by platform count (Android / iOS), anti-tampering complexity, and the breadth of IPC and data-storage paths.
| Engagement size | Typical duration | Price band |
|---|---|---|
| Single platform (Android or iOS) | 3–5 days | Price on request |
| Both platforms | 1–2 weeks | Price on request |
| Complex (anti-tamper, HW keys) | 2+ weeks | Price on request |
Use the free pentest scoping tool for a precise estimate.
What's in the report?
- Executive summary — mobile risk in business terms.
- Graded findings — CVSS and business impact, with the component and platform.
- Reproduction steps — device state, tools and payloads as evidence.
- Remediation guidance — Keystore/Keychain use, pinning, IPC hardening, anti-tamper.
- Compliance mapping — PCI DSS, ISO 27001, SOC 2, DORA, NIS2.
- Remediation retest — fixes retested within the engagement window.
Which compliance requirements does this satisfy?
| Framework | Relevant requirement | How the pentest maps |
|---|---|---|
| PCI DSS | Req. 11.4 | Penetration testing of payment applications in scope |
| ISO 27001:2022 | A.8.25 / A.8.29 | Secure development lifecycle & security testing |
| SOC 2 | CC4.1 | Monitoring of system performance & security |
| DORA | Art. 24–25 | Digital operational resilience testing |
| NIS2 | Art. 21 | Risk-based security measures, evidenced |
Mobile pentest, answered
Android vs iOS, devices vs emulators, and compliance for mobile testing.
What is mobile application penetration testing?
Which platforms do you test — Android and iOS?
Which methodology is used for mobile pentests?
Do you test on real devices or emulators?
Do you need the app source code?
Which compliance requirements does a mobile pentest satisfy?
How long does a mobile app pentest take?
Tell us the platforms — get a day estimate
The free pentest scoping tool converts your mobile app surface into a day estimate and price band, then hands to Passeca's offensive-security team for a precise quote.