Mobile App Pentest

What is a mobile app pentest?

A mobile app pentest is a security assessment of your mobile application(s). We analyse the full attack chain: from the binary on the device to the communication with the backend API and the server-side logic. Mobile apps often store sensitive data locally, communicate with multiple backend services and process authentication credentials.

We combine static analysis (decompilation, source code review) with dynamic analysis (runtime hooking, traffic interception). With Frida we hook security-critical functions, with Objection we bypass root detection and certificate pinning, with Jadx we decompile the APK.

Why should you get a mobile app pentest?

Users trust mobile apps with sensitive actions: banking, medical data, corporate systems. The risks:

• Insecure local storage: credentials or tokens stored unencrypted on the device.
• Missing certificate pinning: man-in-the-middle attacks possible.
• Reverse engineering: an attacker decompiles your app and finds hardcoded API keys or backend URLs.
• Authentication bypass: weak biometric implementation, session management or token handling.
• Business logic flaws: manipulating prices or bypassing purchases via the app.

Our approach

We follow the OWASP MASVS and MSTG, but go beyond the checklist. We share findings with you directly:

1. Static analysis - decompilation, source code review for hardcoded secrets, insecure API calls, weak cryptography, debug functions in production.
2. Dynamic analysis - runtime analysis with Frida: hooking, root/jailbreak bypass, certificate pinning bypass.
3. Network communication - traffic interception with Burp Suite: TLS configuration, API authentication, data in transit.
4. Local storage - databases, Keychain/Keystore, SharedPreferences, cache data for sensitive information.
5. Authentication & session - biometric bypass, token handling, session fixation, account enumeration.
6. Backend API - the app is just a frontend. The real vulnerabilities are often in the API. We include it in our test.
7. Reporting - report conforming to MASVS with reproduction steps per platform. Retest available on request.

What does a mobile app pentest cost?

Our hourly rate is €175 per hour. Costs depend on complexity, authentication methods and whether the backend API is included. Fixed quote after a scoping call.