Mobile app penetration testing
Your mobile app runs on devices you do not control, in the hands of anyone who downloads it. We test the app itself, the data it keeps on the phone, the traffic it sends and the APIs behind it, against the OWASP Mobile Application Security Verification Standard.
What we test
Every engagement is scoped to your environment. These are the areas a mobile app testing engagement covers as standard.
Data storage
Whether tokens, personal data or secrets are left unprotected on the device, in logs, caches or backups.
Network traffic
TLS configuration and certificate pinning, and what could be read or changed in transit.
Authentication
Login, biometrics and session handling, and whether checks made only on the device can be bypassed.
Platform features
Deep links, shared components, embedded web views and permissions.
Code protection
Hard-coded keys, tamper resistance and how much an attacker learns from the app package.
The backend APIs
The APIs the app calls, tested for authorization flaws that affect every user of the app.
How deep we go
Choose how much access we start with. We will recommend one on the scoping call, based on what you want to learn.
Static analysis
We review the app package for secrets, insecure settings and risky code.
Dynamic analysis
We run the app on test devices and watch how it behaves, stores data and talks to its servers.
API testing
We test the backend the app relies on, where the most serious issues are usually found.
From first call to clean exit
Every engagement follows the same five steps. Our penetration testing process page explains each one in detail.
- Day 0
Scoping call
A free call to understand what you want tested and why: the applications, networks or APIs, your deadlines and any compliance requirement behind the test. You get a written quote with the scope, timeline and deliverables set out.
- Before testing
NDA and rules of engagement
We sign a mutual NDA, or work under yours, then agree the rules of engagement: targets, testing windows, contacts, and anything that must not be touched. Testing can start within 48 hours of the scope being signed.
- Testing
Hands-on testing
Our testers combine tools with manual testing, following OWASP, PTES and NIST SP 800-115. If we confirm a critical issue, we tell you straight away instead of waiting for the report.
- Report
Report and walkthrough
Every finding is reproduced by a tester before it goes in the report, with severity, evidence and a fix written for your stack. We walk your team through the results and answer questions.
- After
Retest and clean exit
When you have fixed the issues, we can retest and issue an updated report. When the engagement ends, we remove test accounts, credentials and working files, and confirm it in writing on request.
Findings your developers can act on
Each finding explains what is wrong, what an attacker could do with it, and how to fix it in your stack. No raw scanner output, and nothing we have not reproduced ourselves.
Long-lived sign-in token stored without encryption on the device
- Affected area
- Android app, local storage
- Impact
- Anyone holding a copy of the phone's data could stay signed in to the account for months, without the password or MFA.
- Fix
- Keep tokens in the platform's secure storage, leave them out of backups and shorten how long they stay valid.
An illustrative example. Client names, systems and data are always kept confidential.
What we need from you
- The app build, or a TestFlight or internal testing invite
- Test accounts for each user role
- The backend environment the build points to
- Any features that need special hardware or regions
What you receive
- Findings mapped to OWASP MASVS and the Mobile Top 10
- Platform-specific fixes for iOS and Android
- Backend API findings in the same report
- Critical issues reported as soon as we confirm them
Questions about mobile app penetration testing
Do you test both iOS and Android?
Yes. We can test one platform or both. Many issues are shared through the backend, so testing both in one engagement is usually efficient.
Do you need our source code?
No. We work from the app package. Source code helps us confirm root causes faster, so it is welcome but optional.
Does the test include the backend?
Yes. The APIs your app calls are part of the test, because that is where the most serious mobile issues usually sit.
Can you test an app that is not released yet?
Yes, and before release is the best time. Send a TestFlight invite, an internal testing track or a build.
Do we need a mobile test if our app wraps our website?
If the app mostly displays your website, a web application test may cover most of the risk. Tell us how the app is built and we will recommend the right scope.
Further reading
Guides from the Krylo Security blog.
Penetration testing explained
Read the guide ↗API penetration testing
Read the guide ↗IoT cybersecurity: 7 essential practices
Read the guide ↗Other penetration tests
Web application penetration testing
Customer portals, SaaS platforms, dashboards and online stores, tested by hand against the OWASP Top 10 and your business logic.
API penetration testing
REST, GraphQL and partner APIs tested for broken authorization, data exposure and abuse, against the OWASP API Security Top 10.
Network penetration testing
Your internet-facing perimeter and internal network, including Active Directory and cloud hosts, tested from outside and from within.
Start your security assessment.
Tell us about your application, architecture or compliance requirements. Our team will scope a penetration test around them.