Mobile Application Penetration Testing (iOS and Android)
A mobile application penetration test examines how an iOS or Android app behaves on the device, what data it stores and the backend services it talks to, all from an attacker's point of view. Nokta Guard runs this test based on the OWASP Mobile Application Security Verification Standard (MASVS) and the Mobile Application Security Testing Guide (MASTG). The APIs the app relies on are included in scope alongside the app itself.
A mobile app runs on a device in the user's hands and can be reverse engineered. Keys embedded in the app, session data stored unencrypted on the device or checks performed only on the client can give an attacker a direct route to the backend.
We examine the app not only through its screens but on the device and in its network traffic.
Control Scope
areas · OWASP MASVS · MASTG
Data storage
Session data, personal data, cache, logs and backups that hold sensitive information on the device.
Cryptography
Algorithms in use, key storage and secrets embedded in the app.
Authentication and session
Biometric authentication, token handling and server-side session termination.
Network communication
TLS configuration, certificate validation and certificate pinning.
Platform interaction
Permissions, deep links, WebView usage and data sharing with other apps.
Code quality and dependencies
Libraries with known vulnerabilities and insecure code patterns.
Resilience against reverse engineering
Obfuscation, root/jailbreak detection and integrity checks (depending on scope).
Backend APIs
Authorisation, excessive data exposure and bypassing client-side checks on the services the app uses.
We analyse the app package statically and then run it dynamically on test devices. Network traffic is observed through an intercepting proxy, and we check whether client-side controls are also enforced on the server. We ask for a test account for each user role.
Duration depends on the platforms (iOS, Android or both), the number of screens and functions and whether backend APIs are in scope. Critical findings are shared without waiting for the report.
Executive summary per platform. Technical findings mapped to MASVS control areas, with evidence and CVSS score. Separate remediation advice for mobile and backend teams. Retest report.
Mobile banking, payments, healthcare, e-commerce and internal enterprise apps. Recommended before submitting a new release to the app stores and after major functional changes.