API Penetration Testing
Testing for your REST and GraphQL APIs, focused on authorisation, business logic and data exposure.
Services
Mobile Application Penetration Testing
A mobile app runs in your user's pocket and is open to reverse engineering. We test the app itself together with the servers it talks to.
The issues we see most often in mobile apps are unencrypted data stored on the device, API keys embedded in the app, and missing authorisation checks on the server side.
Static analysis examines the app package; dynamic analysis observes runtime behaviour and network traffic. Findings are classified according to the OWASP MASVS control groups.
What we test
- On-device storage: keychain/keystore, shared preferences, caches and logs
- Network communication: TLS validation and certificate pinning
- Authentication, session and biometric authentication flows
- Hard-coded secrets, keys and debug artefacts
- Platform interaction: deep links, intents and WebView usage
- The backend APIs the app communicates with
How we work
Static analysis
We examine the APK/IPA and assess permissions, libraries and embedded data.
Dynamic analysis
We run the app on a test device and observe traffic and runtime behaviour.
Backend testing
We test the APIs used by the mobile client for authorisation and business logic flaws.
Reporting
We map findings to MASVS and give your developers platform-specific remediation advice.
What you receive
- Executive summary
- Technical findings by MASVS control group
- CVSS v4.0 scores and reproduction steps
- Separate remediation advice for Android and iOS
A good fit for
- Apps published in the app stores
- Apps handling payments, health or personal data
- Games and social apps
Frequently asked questions
Do you test both Android and iOS?
We can test either platform or both. Testing both together is usually more efficient, as the shared backend only needs to be tested once.
Do you test the store version?
Ideally we test a build connected to a test environment. If necessary, we limit ourselves to passive analysis of the store version.
Related services
External Network Penetration Testing
An attacker's view of your internet-facing servers, services and remote access points.
Internal Network Penetration Testing
How far can an attacker get once inside your network? Testing for Active Directory and internal systems.
See your weaknesses before attackers do.
Let's define the scope together. You'll receive a written proposal with the right type of test and a clear timeline.