Mobile Web Application Testing
Mobile application testing for iOS and Android across Europe: data storage, pinning, reverse engineering and API abuse. Fixed price, free retest.
Mobile application testing examines your iOS and Android apps, and the APIs behind them, for the flaws that ship inside the binary and travel to every device that installs it. We test by hand across Europe against the OWASP Mobile standard and show you what an attacker can pull out of your app once it is on their phone.
A mobile app is a piece of your infrastructure that you hand directly to strangers. Once it is installed, the attacker owns the device it runs on: they can read its storage, watch its network traffic, decompile the code, and run it under a debugger. Anything the app trusts to be secret on the device is not. This changes the test entirely from a web app, and it is why mobile application security testing has its own methodology built around the assumption that the client is hostile.
What mobile application testing covers
We test the app on the device, the traffic it sends, and the API back end it depends on, structured around the OWASP Mobile Application Security Verification Standard (MASVS) and its testing guide. Coverage spans both platforms where you ship both, because the same product often stores data and pins certificates differently on iOS and Android.
Where mobile apps actually leak
Mobile apps fail in ways that surprise teams used to web security, because the trust boundary sits in a different place. A good mobile application security testing engagement goes straight for the failures that matter on a device the owner does not control.
Insecure data storage
The most common finding by far. Session tokens written to a plaintext file, personal data cached in an unencrypted database, credentials stored in shared preferences, or secrets left in the app’s logs. On a lost or compromised phone, any of these is a straight handover of the user’s account. We inspect exactly what the app writes to disk and where.
Weak transport security
Traffic that can be intercepted, certificate validation that can be disabled, or pinning that is trivially bypassed with a common tool. If an attacker on the same network can read or modify the app’s traffic, the security of the back end no longer matters. We test whether the channel between app and server actually holds up against interception.
Secrets baked into the binary
API keys, encryption keys, back-end URLs and third-party credentials compiled into the app in the belief that nobody will look. Decompiling an app is routine, and these secrets come straight out. We reverse the binary the way an attacker would and report every secret it gives up.
Insecure back-end APIs
The app is only half the system. Behind it sits an API that too often assumes requests only ever come from the official app, which is never true once someone has the token and the endpoints. We test that API for broken object level authorization, weak token handling and the other flaws that let one user reach another’s data.
How we test
Every mobile application testing engagement is run manually by a certified offensive engineer (OSCP, OSWE) on real or emulated devices, including rooted and jailbroken ones so we can see everything the app does. Among the best mobile application security testing tools we rely on are Burp Suite for traffic analysis, Frida for runtime instrumentation, and platform decompilers for static review, but the analysis and the exploitation are a person’s work.
Static analysis
We decompile and inspect the app without running it, looking for hardcoded secrets, insecure API usage, weak cryptography, and the endpoints and permissions it declares. This maps the attack surface and surfaces the low-effort wins an attacker would find first.
Dynamic analysis
We run the app on an instrumented device and watch what it actually does: what it writes to storage, how it authenticates, how it handles a bypassed certificate pin, and how it behaves when we tamper with it at runtime. Frida lets us hook functions and defeat client-side checks the way a real attacker would.
Back-end and reporting
We test the API the app talks to as a first-class part of the engagement, then deliver an executive summary and a technical report with every finding scored by CVSS, its impact explained, exact reproduction steps and a specific fix. After you remediate, the retest is included so you can confirm the fixes hold across both platforms.
Mobile web apps and hybrid frameworks
Not every mobile app is fully native. Plenty are progressive web apps, or hybrids built in React Native, Flutter or a WebView wrapper, and each brings its own risks on top of the usual web ones.
Progressive and mobile web apps
A mobile web app is still a web app, so it inherits the full range of web flaws, but the mobile context adds concerns around local storage, offline caching and how session data survives between visits. We test both the web layer and the way the app persists data on the device.
Hybrid and cross-platform apps
Frameworks like React Native and Flutter bundle a JavaScript or Dart layer that is often easier to decompile than native code, and WebView-based apps can expose native functionality to web content in ways that become an attack path. We test the bridge between the web and native layers, which is where hybrid apps most often go wrong.
Want this tested on your own systems?
Free 20-minute scoping call, a fixed price with no hourly surprises, and a free retest once you fix what we find.
Compliance and standards
Mobile apps handle personal and payment data like any other channel, and the report is written to prove the coverage your obligations require.
PCI DSS, ISO 27001 and SOC 2
Where a mobile app takes payments, PCI DSS 4.0 requirement 11.4 covers the application and its API, and our reporting is built to satisfy it. For ISO 27001 the results support control A.8.29, and SOC 2 auditors accept independent mobile testing as evidence under the security criteria.
GDPR
Mobile apps collect a lot of personal data, often including location and device identifiers, so testing supports the technical measures GDPR expects. A dated report mapped to a recognised mobile standard is clear evidence of due care.
Client-side controls and what they are worth
Root and jailbreak detection, anti-tampering and obfuscation are worth having, but it helps to be honest about what they buy you. They raise the effort for an attacker; they do not stop a determined one. Every client-side check runs on a device the attacker controls, so any of them can eventually be patched out or hooked at runtime. We test how well yours hold up, and just as importantly we check that nothing security-critical depends on them. A control that assumes the app cannot be tampered with is a control that has already failed.
Where client-side checks help
These defences make sense as a speed bump for casual attackers and fraud, and as a way to keep honest users on a supported configuration. The mistake is treating them as a security boundary. Anything that must be enforced has to be enforced on the server, where the attacker cannot reach the code, and a large part of a mobile test is confirming that the server does not blindly trust the app.
When to test your mobile app
A mobile app is harder to fix in a hurry than a website, because a fix has to pass app-store review and then wait for users to update, which many never do. That makes pre-release testing especially valuable. Test before a first submission, before a major feature release, after adding payments or a new authentication method, and whenever you take on a new back-end integration. Apps handling money or health data are worth testing at least annually, since a flaw baked into a shipped binary reaches every install and can linger for as long as old versions stay in use.
Why manual testing beats an automated mobile scan
Automated mobile scanners are useful for a first pass: they flag hardcoded strings, outdated libraries and obvious misconfigurations. What they cannot do is bypass a certificate pin at runtime, reason about whether a stored secret is actually reachable, chain a client-side bypass with a back-end authorization gap, or test the business logic the app enforces. Those need a person with the app running under instrumentation on a rooted device. That is what real mobile application testing delivers, and it is the difference between knowing your app has an old library and knowing an attacker can take over an account with it.
Pricing
Pricing depends on whether you ship one platform or both, how complex the app is, whether the back-end API is in scope, and how deep you want the test to go. Here is the shape of a typical European engagement.
| Engagement | What’s included | Timeline | Price |
|---|---|---|---|
| Mobile web app | Progressive or mobile web app, one role, OWASP coverage plus device-storage checks, report and free retest | 3–5 working days | from €2,500 |
| Single platform | Native iOS or Android app, static and dynamic analysis, MASVS coverage and back-end API testing | 4–6 working days | from €3,000 |
| iOS and Android | Both platforms plus the shared back-end API, token and business-logic testing, exec and technical reports | 6–10 working days | €4,000–€9,000 |
| Compliance add-on | MASVS and framework mapping plus an attestation letter for PCI DSS, ISO 27001, SOC 2 or GDPR | with any tier | from €800 |
| Custom / large estate | A suite of apps or a complex platform, scoped to your needs | on scoping | custom |
Every engagement is fixed-price, quoted after a free 20-minute scoping call, so there are no hourly surprises and a retest is always included. Get a fixed quote
FAQ
How much does mobile application testing cost?
Do you test both iOS and Android?
Do you test the API behind the app too?
What tools do you use for mobile application security testing?
How long does the test take?
What do I receive at the end?
Does this satisfy PCI DSS or ISO 27001?
Are the app and findings kept confidential?
Related services
Any team shipping a mobile app that handles accounts, payments or personal data: fintech and banking apps, healthtech, retail and loyalty apps, and product teams releasing on iOS and Android who need assurance before an app-store submission or an enterprise rollout.
Security you can prove
The same standard on every engagement, big or small.
Evidence, not opinions
Every finding ships with a reproduction and proof of concept — no vague "maybe vulnerable".
Humans over scanners
Certified engineers find the logic flaws and chained attacks automated tools walk straight past.
Fixed price, free retest
You know the cost up front, and verifying the fix is part of the deal — not a second invoice.
Ready to lock this down?
Free scoping call, fixed price, free retest. Tell us what you're running and we'll take it from there — usually within one business day.
Tell us what you're running
Scoping is free. We reply within one business day, and under 30 minutes for active incidents.