EspañolEnglish

Mobile application pentest

The app ships with the keys inside. We look.

A mobile application penetration test covers the app on the device and the backend it talks to: local storage, platform misuse, network defenses, and the API behind it. iOS and Android, static and dynamic, against the real build.

Book a free scoping call What we test

iOS or Android, one app per scope. Remote. Scoped on the call.

What a mobile pentest answers.

A mobile app runs on a device you do not control, in the hands of someone who might. Everything shipped in the binary can be read: hardcoded keys, weak crypto, secrets in local storage, endpoints never meant to be public. The test looks at the app the way a motivated attacker with the binary and a rooted device would, and at the API that trusts it.

Why it matters.

The binary gives up its secrets

Hardcoded API keys, encryption keys, and endpoints are all in the package. We reverse the app and pull out what should never have shipped inside it.

The backend is the real prize

Most mobile risk is in the API, not the app. A client-side control an attacker removes in seconds is only as strong as what the server enforces. We test both, and the trust between them.

Data left on the device

Tokens in plaintext, PII in an unencrypted database, secrets in logs and backups. On a lost or shared device, that is the whole breach.

How we test it.

Static and dynamic, aligned to OWASP MASVS and MASTG.

Static analysis

Reversing the binary: hardcoded secrets, weak crypto, insecure configuration, and the endpoints it talks to.

Dynamic analysis

The app running on a rooted or jailbroken device: traffic interception, runtime instrumentation, and control bypass.

API testing

The backend the app depends on, tested as its own surface, because that is where the impact usually is.

How it runs.

The app, the device, and the backend, in one pass.

  1. 01

    Recon and reversing

    Unpacking the app, mapping its components, and pulling secrets, endpoints, and logic out of the binary.

  2. 02

    Storage and platform

    Local data, keychain and keystore use, IPC, permissions, and platform-specific misconfiguration.

  3. 03

    Network and transport

    TLS validation, certificate pinning and its bypass, and the traffic between app and backend.

  4. 04

    API and backend

    Authentication, authorization, and business logic on the server the app trusts.

  5. 05

    Runtime and hardening

    Root and jailbreak detection, anti-tampering, and how far each is worth relying on.

What gets tested.

The app, the device, and the backend behind them.

  • Insecure local storage (databases, files, preferences)
  • Hardcoded secrets and keys in the binary
  • Keychain and Keystore usage
  • Certificate pinning and TLS validation
  • Authentication and session handling
  • The backend API and its authorization
  • IPC and exported components (Android)
  • Weak or misused cryptography
  • Root and jailbreak detection, anti-tampering
  • Logging, backups, and data leakage

What we usually find.

  • An API key hardcoded in the binary, valid for the production backend.
  • Session tokens stored in plaintext in a local database.
  • Certificate pinning that a one-line hook disables.
  • An API that trusts a client-side role flag the app sets itself.

What you get.

  • Findings with CVSS scores and reproduction steps
  • Static and dynamic results, app and API
  • Remediation written for iOS or Android
  • Mapping to OWASP MASVS
  • Free retest of Critical findings within 30 days

Mobile pentests are scoped on the call, per app and platform. See services and pricing.

Questions.

iOS, Android, or both?

Either, or both. They share a backend but differ on storage, platform APIs, and hardening, so each platform is its own scope. Cross-platform builds are tested per platform.

Do you need the source code?

No. We work from the build the way an attacker does. Source speeds up a few checks and can be included, but it is not required.

Is the backend included?

The API the app depends on is in scope, because that is where most of the impact is. A large or separate backend can be scoped as its own web/API engagement.

Do we need a jailbroken device?

No, we handle that. Testing runs on rooted or jailbroken devices we control, so nothing is needed on your side beyond the build and a test account.

Mobile application

Everything in the binary can be read.

Thirty minutes, NDA first. You talk to the operator who tests it.

Book a free scoping call

Prefer email? engagements@redghostops.com