With over 6,000 validated vulnerabilities identified across engagements with 257+ clients in 30+ countries, our certified ethical hackers bring platform-specific depth to every assessment.
What We Test on iOS
iOS imposes stricter sandboxing than Android, but that doesn’t make the attack surface small. Our iOS assessment covers:
- Keychain misconfigurations: tokens and credentials stored with
kSecAttrAccessibleAlwaysor equivalent, remaining accessible when the device is locked or via unencrypted backups- Data Protection API misuse: files written to unprotected NSFileProtection classes, persisting across reboots and accessible under forensic imaging
- URL scheme and Universal Link abuse: deep links that bypass authentication steps or leak session context to third-party apps
- Pasteboard exposure: sensitive values copied to the system clipboard without restriction, readable by any foregrounded app
- Binary protection checks: stack canary presence, PIE enforcement, and ARC usage reviewed directly from the IPA without requiring source code
- Runtime manipulation: Frida-based hooking to bypass biometric checks, jailbreak detection routines, and SSL pinning without binary patching
- Third-party SDK risks: analytics and advertising SDKs exfiltrating PII or transmitting data over insufficiently encrypted channels
- ATS exception review:
NSAllowsArbitraryLoadsand per-domain overrides examined inInfo.plistfor downgrade risk
What We Test on Android
Android’s open architecture produces a wider IPC (inter-process communication) attack surface. Our Android assessment covers:
- Exported components: Activities, Services, Broadcast Receivers, and Content Providers reachable without declared permissions, mapped using Drozer
- Intent injection manipulating implicit intents to redirect sensitive data flows or trigger unintended privileged operations
- Insecure SharedPreferences and external storage: credentials, tokens, or PII written in cleartext to world-readable locations or unexcluded backup targets
- Android Keystore usage: verifying cryptographic keys are bound to hardware-backed storage and not derived from predictable seeds
- APK reverse engineering: JADX and apktool decompilation to extract hardcoded secrets, internal API endpoints, and embedded credentials
- Root and tamper detection bypass: SafetyNet/Play Integrity attestation reviewed and bypass attempted using Frida hooks and Magisk modules
- WebView misconfigurations:
setJavaScriptEnabled,addJavascriptInterface, andsetAllowFileAccessreviewed for JavaScript injection and file-theft paths
Real-World Attack Scenarios We Simulate
These are findings from real engagements, not theoretical attack trees.
Credential extraction from the binary
An e-commerce app embeds its payment gateway API key in a string resource. Decompiling the APK with JADX takes under five minutes. The key is live in production and valid across all environments.
Session hijacking via unprotected token storage
A fintech app stores its OAuth access token in SharedPreferences without encryption. On a rooted device or through a compromised backup any app with storage read access extracts it and authenticates silently as that user.
Certificate pinning bypass enabling full traffic interception
A healthcare app implements certificate pinning, but the check runs in Java on the client. A Frida script hooks the validation method and returns true unconditionally. All API traffic becomes visible in Burp Suite, including PHI in JSON response bodies.
Authorization failure behind a secure-looking mobile front-end
The app enforces role separation correctly in the UI. The backend API doesn’t check. Replaying an authenticated request from a standard user account with a modified resource ID returns another user’s medical records, a direct OWASP Mobile Top 10 M3 (Insecure Authorization) finding.
For a related look at how authorization failures surface across SaaS and API-connected platforms, see our post on 7 SaaS Security Vulnerabilities We Found in Real Engagements.
How We Work
We run manual-led assessments aligned to the OWASP Mobile Top 10 and OWASP MASVS (Mobile Application Security Verification Standard). Static analysis covers the binary directly — no source code required. Dynamic testing runs on physical or emulated devices with full traffic interception via Burp Suite, and runtime instrumentation via Frida for bypass testing. For dual-platform engagements, iOS and Android are scoped and tested as independent assessments, each with its own toolchain and checklist — not a shared scope split across both platforms. Backend APIs in scope receive the same authorization and data exposure validation we apply in a standalone API penetration test.
Compliance Requirements This Engagement Supports
HIPAA
The Security Rule’s requirements for PHI in transit and at rest apply directly to mobile apps handling patient data. Our report documents every location where PHI is cached locally, transmitted unencrypted, or accessible beyond the intended authorization boundary. → HIPAA compliance consulting
PCI DSS (Req. 6.2 and 11.4)
Mobile apps that initiate, display, or transmit cardholder data fall within PCI scope. We assess the full transaction flow from the mobile client through to the payment API, including any in-app token handling and SDK integrations. → PCI DSS readiness services
SOC 2 (CC7.1)
Penetration test evidence is routinely requested by auditors evaluating threat detection and anomaly monitoring controls. Our report is structured for direct inclusion in SOC 2 audit packages.
ISO/IEC 27001
Risk treatment evidence for mobile app attack surfaces, mapped to relevant Annex A control areas. Shofiur Rahman, our ISO/IEC 27001 Information Security Associate™-certified lead, can provide findings contextualization aligned to your risk register.
GDPR
Data minimization and storage limitation obligations mapped to specific findings where PII is unnecessarily persisted on-device or transmitted to third-party SDKs without explicit user consent.
What You Receive
Every engagement delivers:
- Technical report with CVSS-scored findings, step-by-step reproduction instructions, and tool-verified proof-of-concept for each vulnerability — not automated scan output
- Executive summary written for non-technical leadership, board review, or direct submission to an auditor
- Developer-level remediation guidance — specific API calls, storage mechanisms, and configuration changes, not generic “encrypt sensitive data” recommendations
- OWASP Mobile Top 10 and MASVS traceability — each finding mapped to its relevant framework control reference
- Evidence artifacts — annotated screenshots, Burp Suite traffic captures, and Frida scripts demonstrating the exploited path
Free Retest Included
After your team applies fixes, we verify them. Retesting confirms each finding is closed and checks for regressions introduced during remediation. Included at no additional cost within the agreed retest window — because a closed vulnerability that was fixed incorrectly is still a vulnerability.
Frequently Asked Questions (FAQs)
Send Us Your App Build, We’ll Scope the Engagement Within 24 Hours
Share your IPA or APK, the platform(s) in scope, any relevant compliance deadline, and backend API access details. We’ll return a fixed-price quote, a clear testing timeline, and targeted scoping questions, no sales process, no retainer.