Mobile Pentest Android & iOS
A mobile pentest is a penetration test of Android and iOS apps run with the OWASP MASVS/MASTG methodology, assessing data storage, network communication, cryptography, authentication and resistance to reverse engineering and tampering to prove, with evidence, what an attacker could extract or manipulate in your app.
What is a mobile pentest?
A mobile pentest is a penetration test of a mobile app — Android or iOS — from a real attacker's perspective, covering the app code, the data it stores on the device, its communication with the backend and its embedded security controls. Unlike a traditional web pentest, a mobile app pentest must deal with the binary installed on the device, the mobile operating system and the possibility that the device is compromised (rooted or jailbroken).
Berghem follows the OWASP MASVS (Mobile Application Security Verification Standard) and the OWASP MASTG testing guide, combining static analysis of the binary, reverse engineering, dynamic runtime instrumentation and testing of the API the app consumes. The result is a concrete map of what an attacker could reach — from sensitive data left on disk to authentication that can be bypassed — with proof of concept, evidence and impact-prioritized recommendations.
For regulated institutions, mobile scope must also meet sector requirements — including the BACEN/CMN resolutions on cybersecurity. Apps that process payments require additional controls, and we structure the test to produce evidence useful to your compliance process.
What's included
What do we test in a mobile pentest?
We follow the OWASP MASVS verification categories. Each domain below is analyzed statically and dynamically, manually validated and chained into attack scenarios that demonstrate real impact — never just an isolated tool finding.
Insecure data storage
Data left on the device is the first target. We inspect SQLite databases, SharedPreferences, plists, cache files, logs and the Keychain/Keystore for credentials, tokens, personal data and sensitive information stored without protection. We also review backups, background screenshots and leakage through keyboard and clipboard.
Network communication
We intercept traffic between the app and backend to assess TLS usage, certificate validation and the robustness of SSL pinning. We test whether pinning can be bypassed, whether cleartext endpoints exist, protocol downgrade and data exposure in transit — the classic man-in-the-middle vector against mobile apps.
Cryptography and key management
We analyze the algorithms, modes and crypto libraries the app uses, looking for weak implementations, keys and IVs hardcoded in the code, predictable randomness and inadequate storage of cryptographic material. We verify that sensitive data is actually encrypted and that the Keystore/Keychain is used correctly.
Authentication, session and biometrics
We test login flows, tokens, session expiration, logout and local authentication logic — including PIN and biometrics. We assess whether authentication can be bypassed with a modified app, whether validation happens server-side and not only on the client, and whether sessions can be reused or fixed.
Platform interaction and IPC
Each platform exposes its own surfaces. We test exported Activities, Services, Broadcast Receivers and Content Providers on Android, URL schemes and universal links on iOS, WebViews, deep links and inter-process communication. We look for exposed components that let controls be bypassed or data be injected.
Resilience, reversing and tampering
We reverse-engineer the binary to assess obfuscation, embedded secrets and the app's resistance to manipulation. We test root/jailbreak detection, anti-hooking and anti-debug, and how well those controls hold up against Frida instrumentation and repacking of a modified app.
Coverage by platform
Android and iOS have distinct security models, binary formats and attack surfaces. We adapt the methodology to each system's specifics, using real and emulated test devices.
Android pentest
Penetration test of Android apps starting from the APK/AAB: decompilation with jadx and apktool, analysis of the AndroidManifest and exported components, storage inspection, dynamic instrumentation with Frida and bypass of root detection and SSL pinning. We assess Java/Kotlin apps and native code.
iOS pentest
Assessment of iOS apps from the IPA: analysis of the binary and Objective-C/Swift classes, inspection of the Keychain and local storage, URL schemes and universal links, and on-device instrumentation on a jailbroken device. We test data protection, biometrics (Face ID/Touch ID) and tampering resistance.
How do we run the test?
We work with agreed rules of engagement and a secure channel with the client from start to finish. The test combines static analysis of the binary, dynamic on-device testing and assessment of the API the app consumes, aligned with the OWASP MASTG.
Scope and preparation
We define the platforms and versions in scope, the target MASVS level, test credentials, environments and limits. We receive the binaries (APK/IPA) and, where applicable, backend access, and agree on the goals and model of the exercise.
Static analysis and reversing
We decompile and analyze the binary for embedded secrets, endpoints, authentication logic, crypto usage and exposed components. We map the app's attack surface before moving to dynamic exploitation.
Dynamic analysis and exploitation
We run the app on an instrumented device, intercept traffic, bypass security controls where possible and exploit storage, authentication, network and IPC flaws — chaining findings into full attack scenarios while preserving environment stability.
Report and remediation
We deliver each finding with proof of concept, evidence, severity rating and impact-prioritized remediation, mapped to the MASVS. We run a technical debrief and offer a retest to validate the applied fixes.
Related services
A mobile app pentest usually goes hand in hand with testing the API it consumes and other offensive-security and secure-development tracks.
API Pentest
Every mobile app talks to a backend. We test authentication, authorization and business logic of the REST and GraphQL APIs behind the app.
Cloud Pentest
The app backend usually runs in the cloud. We assess IAM, storage exposure and misconfigurations across AWS, Azure and GCP.
DevSecOps
Security integrated into the mobile build pipeline — SAST, dependency analysis and automated tests that fix app flaws at the source.
Offensive Security
Overview of Berghem's offensive-security pillar: pentest, Red Team and adversary simulation.
Frequently asked questions about mobile pentest
What is a mobile pentest?
What is the difference between a mobile pentest and a web pentest?
What is the OWASP MASVS and why do you follow it?
Do you need the app's source code?
Does the mobile pentest include testing the app's API?
Ready to test your app?
In a 30-minute conversation we map your Android or iOS app and design the ideal mobile pentest scope.
Talk to a specialist