Local storage
Sensitive data saved in clear text on the device.
home / services
service · mobile
Android and iOS mobile app penetration testing
Package analysis and tests on a test device. Only for apps the client owns or has the right to test.
what it covers
What we check in the app.
Network communication
Clear traffic, certificates not verified, no certificate pinning.
Components exposed to other apps
Screens or services accessible from other apps.
Excessive permissions
Permissions the app does not use or should not ask for.
Secrets in code
Keys and tokens included in the package.
Runtime behaviour
Controls that can be bypassed on the test device.
how we work
A fixed method, with a person at the end.
Package analysis
The APK or IPA file is analysed without running it.
Hypotheses
The plan proposes the most promising dynamic checks.
Test on device
Tests run on a test device, with test accounts.
Review
A person reproduces each vulnerability and assigns the severity.
Report
Steps, evidence and fix for each confirmed vulnerability.
included and not included
What you receive, and what is not in the service.
Included
- Package analysis
- Tests on a test device
- Report with reproduction steps
- Fix for every confirmed vulnerability
Not included
- Testing without a signed authorisation
- Denial-of-service testing
- Social engineering or physical attacks
- Testing of third-party systems
- Testing of apps from third parties or not owned by the client
service sheet
To get started.
| Item | Detail |
|---|---|
| Type of test | Static and dynamic, on a test device |
| To start, we need | APK or IPA file, test account, test device |
| Delivery | Report and action log |
| Price | from €2,500 to €5,000 |
Want to test your mobile app?
We reply by hand with a written proposal.