Mobile Application Penetration Testing
Manual testing of your iOS and Android apps and the APIs behind them by OSCP-certified testers, aligned with OWASP MASVS v2 and the MASTG.
A mobile app ships your authentication logic, your session tokens and often your customers' most sensitive data onto a device you do not control. Attackers do not need to compromise that device; they install your app on a jailbroken phone, hook it with an instrumentation framework, read what it stores, strip its certificate pinning and talk to your backend directly. Automated mobile scanners find hardcoded strings and permission flags. They do not find the authorisation bypass in the API the app calls, or the token that survives logout. Our mobile application penetration tests do, with a report that speaks to both your mobile and your backend team.
What is mobile application penetration testing?
Mobile application penetration testing is a manual security assessment of a native, hybrid or cross-platform app (Swift, Kotlin, React Native, Flutter) and of the backend services it depends on. We test the app on real iOS and Android devices with and without jailbreak or root, decompile and analyse the binary, instrument it at runtime, inspect what it stores in the Keychain, the Keystore, databases and caches, intercept and tamper with its traffic, abuse deep links and inter-process communication, and then attack the API with the knowledge gained. Coverage follows the OWASP Mobile Application Security Verification Standard (MASVS v2) and the Mobile Application Security Testing Guide (MASTG), so every control group, from MASVS-STORAGE to MASVS-RESILIENCE, is tested and reported.
Key Capabilities
Local Data Storage and Secrets
Keychain and Keystore usage, databases, caches, logs, backups, clipboard and screenshots: what the app leaves on the device and how well it is protected (MASVS-STORAGE, MASVS-CRYPTO).
Network Security and Certificate Pinning
TLS configuration, certificate pinning and its bypass, proxy detection and the unencrypted or over-trusting channels that let an attacker read or modify traffic (MASVS-NETWORK).
Authentication, Sessions and Biometrics
Login flows, token lifetime and revocation, biometric prompts that can be bypassed locally, PIN and step-up logic, and offline authentication states (MASVS-AUTH).
Deep Links, IPC and Platform Interaction
Universal links, custom URL schemes, intents, content providers, WebViews and pasteboard handling that let another app or a crafted link drive yours (MASVS-PLATFORM).
Reverse Engineering and Resilience
Decompilation, hardcoded secrets, obfuscation quality, jailbreak and root detection, anti-debugging, anti-tampering and runtime hooking (MASVS-CODE, MASVS-RESILIENCE).
Backend API Coverage
Every endpoint the app calls, tested per role and per user: object-level authorisation, business logic, rate limiting and the server-side trust placed in client-side checks.
Who needs mobile application penetration testing?
Banks, payment institutions and fintechs whose apps fall under PSD2 strong customer authentication and the DORA testing requirements; healthcare providers and e-health vendors handling patient data under NEN 7510:2024 and the GDPR; retailers, insurers, utilities and SaaS vendors whose app is a primary customer channel; and enterprises distributing internal apps through MDM. If your app holds a session, a payment credential or a medical record, it is in an attacker's hands the moment it ships.
How a Mobile Application Penetration Test Works
Scoping and Build Delivery
We agree platforms, app versions, MASVS level (L1 or L2 plus resilience), test accounts per role, backend scope and exclusions, and receive debug or release builds through a secure channel.
Static Analysis and Reverse Engineering
The IPA and the APK or AAB are decompiled and reviewed for secrets, insecure storage calls, exported components, third-party SDKs and weak cryptography.
Dynamic Instrumentation on Real Devices
The app runs on jailbroken and rooted test devices and on clean ones; we hook it at runtime, bypass pinning and detection controls, and watch what it does with data.
Storage, Crypto and Authentication Testing
Keychain, Keystore, databases, caches and backups are inspected; token handling, biometric flows and session logic are attacked locally and against the backend.
Backend API Attack
With the full picture of the client, we test the API per role and tenant for authorisation, business logic and injection issues the app itself hides.
Report, Debrief and Retest
Findings mapped to MASVS controls and your compliance framework, with evidence and fix guidance for both teams, a debrief and a retest after remediation.
How We Work
Manual testing by OSCP-certified testers, led by Michael van Mameren, on physical iOS and Android devices rather than emulators alone, using the MASTG test cases as the coverage baseline and instrumentation frameworks for runtime analysis. We agree rules of engagement before the first request reaches your backend, escalate critical findings the same day, and reproduce every finding with evidence. Findings are mapped to MASVS v2 controls and to the framework you report against, whether that is PSD2 and DORA, NEN 7510, ISO 27001 or PCI DSS, and explained in the terms your mobile and backend engineers use.
What you receive
Mobile Application Penetration Testing FAQ
The questions product and security leaders ask us most often before commissioning a mobile app assessment, answered straight.
What is mobile application penetration testing?
Mobile application penetration testing is a manual security assessment of an iOS or Android app and the backend APIs it uses, carried out on real devices from an attacker's position. It covers local data storage, cryptography, authentication, network security, platform interaction, code quality and resilience against reverse engineering, following the OWASP MASVS v2 and MASTG. The result is a list of exploitable findings with evidence, not a scan of permission flags.
What are OWASP MASVS and MASTG and why do they matter?
MASVS v2 is the OWASP Mobile Application Security Verification Standard: eight control groups (STORAGE, CRYPTO, AUTH, NETWORK, PLATFORM, CODE, RESILIENCE, PRIVACY) that define what a secure mobile app must do. The MASTG is the companion testing guide with the test cases that verify each control. We use them as the coverage baseline so you can show an auditor or a customer exactly which controls were tested and how.
Do you need our source code?
No. We test the compiled app as an attacker would, by decompiling the IPA and APK and instrumenting it at runtime. Source code access does shorten the time to find certain classes of issue and allows us to point at the exact line, so for MASVS L2 engagements we recommend a code-assisted test where it is available. Either way the choice is yours; the scope records which approach was used.
Which devices and OS versions do you test on?
Physical iOS and Android devices, both jailbroken or rooted for instrumentation and clean for realistic behaviour, on the current major OS versions and the oldest version your app still supports. Emulators are used for coverage, never as the only environment, because detection controls, biometrics and hardware-backed key storage behave differently on real hardware.
How is a mobile pentest different from a web application pentest?
A web application runs on servers you control; a mobile app runs on hardware the attacker controls. That adds the device side: what is stored, how it is protected, whether the binary can be reversed and modified, and whether local checks such as biometrics or pinning can simply be switched off. The backend API is tested in both cases, but in a mobile test we drive it with the knowledge gained from the client, which exposes endpoints and parameters no web interface reveals.
Does the test satisfy PSD2, DORA, NEN 7510 and ISO 27001 requirements?
Yes. The PSD2 regulatory technical standards on strong customer authentication require independence of the authentication elements and protection of the mobile device channel; DORA Articles 24 and 25 require testing of ICT systems supporting critical functions; NEN 7510:2024 requires Dutch healthcare organisations to verify the security of systems processing patient data; and ISO 27001 controls A.8.8 and A.8.29 call for vulnerability management and security testing in development. Our report maps each finding to the framework you name.
How much does a mobile application penetration test cost?
Every test is quoted on scope; there is no fixed price list. The drivers are the number of platforms and apps, the MASVS level, the number of roles and user journeys, the size of the backend API, whether source code is available and whether a retest is included. After a scoping call you receive a written proposal within a few working days with the day count and the named lead tester.
Ready to test your mobile apps?
Named, certified testers, MASVS-aligned coverage and a report your iOS, Android and backend engineers can act on.