A mobile assessment that stops at the app has tested the least interesting part. The binary runs on a device the attacker fully controls: it can be decompiled, instrumented, and its traffic intercepted. The controls that matter are the ones on the server.
We have been testing mobile applications since before there was an agreed methodology for it. Our founder taught Android Application Hacking at Black Hat USA for five consecutive years, and the platform that course was taught on was built here.
Who this is for
- You ship a consumer or enterprise app that handles payments, health data, identity or anything else worth stealing.
- You are entering an app store review, an enterprise procurement, or a regulated market that requires an assessment.
- Your app has offline functionality, local storage or device integrations and nobody has checked what it leaves behind.
- Your app is a thin client over an API that has never been tested directly.
What we actually test
The backend behind the app
Where the serious findings almost always are. Every API call the app makes is exercised against every role, with the app’s constraints removed — object-level authorization, tenant isolation, mass assignment, business logic. See API penetration testing; on a mobile engagement it is included, not separate.
Local storage and data at rest
Sensitive data in preferences, databases, cache files, logs and shared storage; credentials or tokens persisted insecurely; the iOS Keychain and Android Keystore used incorrectly or bypassed; data written to locations other applications or a backup can read; information leaked through system logs.
Reverse engineering and hardcoded secrets
Decompiling the binary to recover the developers’ intent: API keys, credentials, encryption keys, internal endpoints and feature flags embedded in the code. Weak or home-grown cryptography. Obfuscation that looks reassuring and is not.
Runtime manipulation
Hooking a running application to tamper with method calls, parameters and return values; defeating client-side controls that were never safe to trust — jailbreak and root detection, certificate pinning, in-app purchase validation, feature gating and client-side authorization checks.
Transport and platform
TLS configuration and certificate validation, pinning implementation and bypass, cleartext traffic, and the platform surface: exported components, deep links, IPC and content providers on Android; URL schemes, universal links and pasteboard exposure on iOS; excessive permissions; screenshot and background-snapshot leakage (yes, really).
How we work
- Static analysis of the binary — decompilation, secret hunting, component and permission review.
- Dynamic analysis on instrumented devices, with the app running and its traffic intercepted.
- Backend testing against every role, which is where the impact concentrates.
- Report, walkthrough and retest — as with every engagement.
Common questions
Do you test both iOS and Android?
Yes. They share a backend and much of the logic, but the platform surface differs enough – Keychain versus Keystore, URL schemes versus intents, differing IPC models – that each needs its own pass.
Do you need the source code?
No. We work from the compiled application by default, which is what an attacker has. If you provide source we will use it to go deeper and to confirm findings faster.
Do we need to give you a test account?
Yes, and ideally one per role. Most serious mobile findings are backend authorization issues, which cannot be found without multiple accounts to test across.
Our app has certificate pinning – can you still test it?
Yes. Pinning is a control we assess and bypass as part of the work; an attacker with a rooted or jailbroken device does the same. Pinning raises the bar, it does not make the backend safe.
Will this satisfy an app store or enterprise security review?
Our reports are routinely used for enterprise procurement and regulated-market reviews. Tell us which review you are facing and we will make sure the report addresses it.
Talk to us about testing your mobile application
Expert-led testing of complex authenticated applications – multi-tenant isolation, authorization/BOLA, business-logic and workflow abuse, complex role models – with developer-usable remediation.
Tell us what the application does and what worries you about it. We will come back with scoping questions, a clear proposal and a realistic timeline — and if a test is not what you need yet, we will say so. Get in touch.
See also: API penetration testing · our Black Hat Android course · the mobile tools we built and retired.