Skip to main content
VexaroSecurity
Mobile app pentest

Mobile application penetration testing

We test your iOS and Android apps the way an attacker would: static and dynamic analysis, runtime instrumentation to get past client-side controls, and the backend API the app relies on. Coverage is mapped to the OWASP Mobile Application Security project.

Scope

What we test

Scope follows OWASP MASVS v2.1.0 and its eight control groups (Storage, Crypto, Auth, Network, Platform, Code, Resilience and Privacy), tested according to OWASP MASTG. Mobile apps are thin clients over server APIs, so the backend is in scope too.

Typical scope
  • Insecure local storage and weak cryptography (MASVS-STORAGE / -CRYPTO)
  • Authentication, session handling and network/TLS validation (MASVS-AUTH / -NETWORK)
  • Platform interaction: exported components, deep links, IPC and WebViews (MASVS-PLATFORM)
  • Code quality, hardcoded secrets and insecure build settings (MASVS-CODE)
  • Resilience: root/jailbreak detection, attestation and anti-tampering (MASVS-RESILIENCE)
  • Privacy controls and the backend API the app depends on (MASVS-PRIVACY)
How we work

Static + dynamic, with instrumentation

We combine static analysis (decompilation, manual and automated code review) with dynamic testing (runtime, TLS interception, certificate-pinning checks). Client-side controls can be bypassed by design, so the rule is that the server must not trust the client. If pinning can't be bypassed, that is itself a resilience finding.

  1. 1

    Preparation

    We agree scope (apps, versions, accounts, the MAS basis) and the test environment, and sign an NDA.

  2. 2

    Intelligence gathering

    We profile the app, its platform integrations and its backend to plan static and dynamic coverage.

  3. 3

    Mapping

    We map components, deep links, IPC, storage and API calls against the MASVS control groups.

  4. 4

    Exploitation

    Static review plus runtime instrumentation (Frida/Objection) to defeat client-side controls and reach logic and traffic.

  5. 5

    Reporting & free re-test

    You get a prioritised report; we re-test fixed issues at no extra charge, within the window set in the Statement of Work.

Deliverables

What you receive

The same deliverable depth as our sample report, with every finding mapped to the MAS standards so the coverage is auditable.

What you get
  • Executive summary and overall risk posture
  • Each finding: description, impact, evidence, steps to reproduce and remediation
  • Scope statement covering apps, versions, APIs, accounts and the MAS basis
  • Severity scored with CVSS 3.1 and translated into business risk
  • References to the MASVS control group, MASTG test and CWE
  • Free re-test of remediated issues, within the window set in the SoW; optional CycloneDX SBOM
Methodology & standards

Grounded in OWASP MASVS & MASTG

OWASP MASVS v2.1.0OWASP MASTGMAS Testing ProfilesCVSS 3.1CWECycloneDX SBOM

Coverage maps to OWASP MASVS v2.1.0 (eight control groups, including the Privacy group added in 2.1.0) and is tested per OWASP MASTG, scoped with the MAS Testing Profiles. Findings are scored with CVSS 3.1.

Test your mobile app.

Tell us about the app, the platforms and your goals. We'll scope the engagement, agree the rules with you and deliver the report under NDA. The first consultation is free.