Offensive Security

Mobile Application Pentesting

iOS & Android security testing covering storage, transport, and runtime risks.

Request This Service All Services

What it is

Android and iOS testing that treats the handset as hostile territory, because that is what it is. We inspect what the app stores on disk, what it trusts from the server, what it leaks in logs and backups, and whether its certificate pinning and root/jailbreak checks survive contact with a determined user.

How we do it

  1. 1

    Static analysis of the package

    We decompile the APK or IPA and review hardcoded secrets, endpoints, third-party SDKs and debug artefacts left in the shipped build.

  2. 2

    Local storage inspection

    Databases, shared preferences, keychain entries, caches and backups examined for credentials, tokens and personal data stored unprotected.

  3. 3

    Transport and pinning

    We attempt interception, then test whether pinning holds and whether the app fails closed when it does not.

  4. 4

    Runtime instrumentation

    Using Frida and similar tooling to bypass root and jailbreak detection, tamper with client-side checks and reach hidden functionality.

  5. 5

    Server-side validation

    The important part: whether the backing API re-checks what the app enforces only on the client.

  6. 6

    Platform hardening review

    Exported components, deep links, IPC surfaces, WebView configuration and clipboard exposure.

What's included

  • Both Android and iOS where you ship both
  • Reverse engineering of the shipped build
  • Runtime bypass of client-side controls
  • Backing API tested, not just the app
  • OWASP MASVS-aligned coverage
  • Annotated evidence from a real device

Who needs it

  • Fintech and wallet apps holding credentials on device
  • Health and identity apps subject to store and regulator scrutiny
  • Teams whose app enforces business rules client-side

Deliverables

  • Findings mapped to OWASP MASVS controls
  • Extracted secrets and their blast radius
  • Device-level evidence and bypass walkthroughs
  • Hardening checklist for the next release

Compliance relevance

OWASP MASVSPCI MPoCGDPRHIPAA

Frequently asked questions

No. We test the shipped build the way an attacker would. Source access speeds up triage and widens coverage, so we take it where you can share it, but it is not a prerequisite.
Yes, and it is usually where the interesting findings are. Pinning raises the bar for casual interception; it does nothing about what the app stores locally or what the API accepts once you are past it.
Real devices, rooted and jailbroken, plus emulators where a specific OS version matters. Emulator-only testing misses hardware-backed keystore and biometric behaviour.
New to penetration testing?

Our complete guide covers methodology, standards, what a good report contains, and how often to test.

Read the guide

Related services

API Security Testing

REST, GraphQL, and gRPC testing for broken auth, BOLA, and data exposure.

Learn More

Penetration Testing

Manual, OSCP-grade testing that emulates real attackers against your assets.

Learn More

Secure Code Review

Manual and assisted source review aligned to SAST findings.

Learn More