Mobile app (iOS and Android)

Pentest of your mobile app

We test your app on iOS and Android the way an attacker with the phone in hand would: what it stores, what it exposes and what it can ask your server for that it should not.

Mobile app pentest to OWASP MASVS: static and dynamic analysis of the binary, local storage, network and certificates, authentication, and the API the app consumes.

Duration: 3 weeks
Start: Together with the audit

from US$3,900

Added to Dig, Rabbit Hole or Warren. Retests: the same as the audit it is added to.

Test my app

Releasing a new version soon? Write to us and we test it before it goes live.

It is for you if

You have an app on the App Store or Google Play that your customers use.
The app handles personal data, payments or bookings.
A large customer or a bank asked you for a test of the app.

What we check

What the app stores on the phone and whether someone holding it can read it.Local storage, Keychain and Keystore, logs and backups (MASVS-STORAGE).

Whether someone on the same Wi-Fi can spy on what the app sends.Encrypted traffic, certificate validation and pinning (MASVS-NETWORK).

Whether someone can get in without the password or take over another user’s session.Authentication, biometrics, tokens and session (MASVS-AUTH).

Whether the app ships hidden keys or data someone can pull out by taking it apart.Reverse engineering of the binary, embedded secrets and protections (MASVS-CODE and MASVS-RESILIENCE).

What the app can ask your server for that it should not, such as another customer’s data.Pentest of the API the app consumes: access control, IDOR and server-side validation.

How we work

Week 0
Scope
You send us the test build for iOS and Android and 2 accounts per user type.
Test builds (IPA and APK or TestFlight), accounts per role, and the app goes into the signed authorization.
Weeks 1 and 2
Testing
We take the app apart, use it on test phones and attack the API. If something is serious, we tell you the same day.
Static and dynamic analysis on test devices, traffic interception and API pentest.
Week 3
Report
A second Lop reviews every finding and we hand you the report with how to fix it.
Review by a second Lop, technical and executive reports, wrap-up meeting.

What you get

The findings in the app and its API, with what each one could cost you.
Findings with CVSS severity, the failing MASVS control, proof of concept and impact in money.
How to fix each one, for iOS and for Android.
Remediation per platform for your team or your vendor.
Every fix tested again in the next version.
Retests on the same terms as the audit.

Scope limits

Includes

1 app, on iOS and on Android.1 application on both platforms.
Up to 2 user types.Up to 2 authenticated roles.
The API the app uses.Endpoints the app consumes, with the in-scope accounts.

Does not include

It is not sold on its own: it goes with Dig, Rabbit Hole or Warren.Audit module; not sold separately.
We do not test on your customers’ phones or on the published store version.Testing only on our own devices with test builds.
We do not fix the app’s code: Lop Fix can do that.No remediation; available with Lop Fix.

Several apps or more than 2 user types? We give you a fixed price before signing.

Questions before you buy

Do you need the source code?

No. We work with the compiled app, the way an attacker would. If you give us the code, we review faster and in more detail.

Why can I not buy it on its own?

Because almost everything serious in an app happens on the server behind it. Testing only the phone leaves out what breaks most, and the audit already covers that server.

Does it work if the app is built with Flutter or React Native?

Yes. We test the app that reaches the phone, whatever it is built with.

Does your business live in an app?

In 3 weeks we test it on iOS and Android, together with its API, and verify every fix.