OWASP Mobile Application Security Verification Standard (MASVS)
Comprehensive security requirements for mobile apps
Penetration Testing
Mobile applications
Identify and remediate vulnerabilities in your mobile applications to protect user data and prevent exploitation.
Discuss an engagement- Objective
- data leakage and unauthorised access in mobile apps
- Maturity
- a shipping build, source code not required
- Approach
- static, dynamic and backend testing across iOS and Android
- Result
- developer-ready remediation guidance
Securing iOS and Android applications
Mobile applications present a unique attack surface, with threats targeting user data, backend services, and device-level security. As mobile apps continue to evolve, so do the techniques adversaries use to exploit vulnerabilities in iOS and Android platforms.
SilentGrid's Mobile Application Penetration Testing evaluates your apps from source code to runtime, identifying vulnerabilities that could lead to data leakage, unauthorised access, and compromised user privacy. Our comprehensive assessments ensure that both client-side and backend components are secure, safeguarding users and maintaining trust in your mobile ecosystem.
Testing standards and frameworks
SilentGrid's mobile penetration testing follows recognised industry frameworks, so each assessment is consistent and thorough.
OWASP Mobile Security Testing Guide (MSTG)
Industry-standard testing methodology for mobile applications
Methodology
Our methodology evaluates vulnerabilities across application code, device interactions, and backend communications.
- 01
Static analysis and code review
- Decompiling and analysing app code to uncover hardcoded secrets, insecure configurations, and weak cryptographic implementations
- Identifying security flaws at the code level for iOS and Android
- Reverse engineering to understand app logic and data flows
- 02
Dynamic testing
- Testing the application during runtime to identify vulnerabilities through reverse engineering, API manipulation, and runtime analysis
- 03
API and backend service testing
- Assessing the security of APIs, server communications, and data flows
- Testing for unauthenticated access, weak authorisation and injection vulnerabilities
- 04
Device and local data storage
- Evaluating how sensitive data is stored on the device
- Testing for data leakage, insecure local storage, and unprotected files or databases
- 05
Network communication and encryption
- Analysing network traffic to ensure encryption standards are followed
- Testing for man-in-the-middle (MITM) vulnerabilities and insecure transport protocols
- 06
Platform-specific vulnerabilities
- iOS Keychain and Android Keystore analysis
- Biometric authentication bypass testing
- App permissions and privacy controls review
- Deep linking and URL scheme testing
- WebView security assessment
- Push notification and background services security
Why mobile security matters
Mobile applications are increasingly targeted by adversaries due to their access to sensitive user data, device functionality, and backend services. A single vulnerability can compromise user data privacy, corporate intellectual property, and reputation and user trust.
Proactive testing not only protects against these risks but also ensures compliance with privacy regulations and app store security requirements.
Plan the year
Test one build, or across the year.
A single mobile test covers a shipping build on iOS and Android, from local storage to the backend APIs. Where the app ships updates through the year, an annual program adds monthly release validation and retests fixes each quarter.
Explore annual programsDeliverables and reporting
SilentGrid's mobile assessments provide detailed insights to developers and product teams, ensuring vulnerabilities are addressed swiftly and securely.
Comprehensive vulnerability report
Detailing vulnerabilities in the mobile app and backend services
Proof of concept (PoC)
Demonstrations of exploitable weaknesses and attack paths
Remediation guidance
Actionable steps for developers to resolve vulnerabilities across mobile platforms
Executive summary
High-level overview highlighting risks and the overall security posture of the application
Consultation and support
Post-assessment guidance to help development teams address issues effectively
Why SilentGrid
SilentGrid's consultants are hand-picked, and between them they have delivered penetration testing globally over decades. Their sector experience covers banking and financial services, insurance, government, critical infrastructure and healthcare, so an assessment is read against how the systems in question are actually run.
Consultants find 0-day vulnerabilities in commercial software and speak or teach at security conferences. That research produces the custom tooling used to reach the flaws automated scanning leaves behind, and it keeps the techniques current. Testing follows concepts set out in NIST, OWASP, PTES and OSSTMM.
CREST ANZApproved company Individual credentials across our team include
- OSEE
- OSCE3
- OSED
- OSEP
- OSWE
- GXPN
- CRTO
- CRTE
- CRTP
- OSCP
Common questions
What is mobile application penetration testing?
Mobile application penetration testing examines an iOS or Android app the way an attacker would: decompiling and reverse engineering the build, manipulating it at runtime, inspecting what it stores on the device and sends over the network, and testing the APIs and backend services behind it. Source code is not required, and testing follows OWASP MASVS and the Mobile Security Testing Guide.
What does mobile application testing cover?
The application from source code to runtime, plus the APIs and backend services behind it. Both client-side and backend components are assessed, along with how data is stored on the device and transmitted over the network.
Do you test both iOS and Android?
Yes. Security flaws are identified at the code level on both platforms, including iOS Keychain and Android Keystore analysis, biometric authentication bypass, app permissions and privacy controls, deep linking and URL schemes, WebView security, and push notification and background service handling.
Do you need our source code?
No. App code is decompiled and analysed to uncover hardcoded secrets, insecure configurations and weak cryptographic implementations, and reverse engineering is used to understand app logic and data flows.
Do you test the backend APIs as well?
Yes. API security, server communications and data flows are assessed, including unauthenticated access, weak authorisation and injection vulnerabilities.
What standards does the testing follow?
The OWASP Mobile Application Security Verification Standard (MASVS) and the OWASP Mobile Security Testing Guide (MSTG). Adhering to these frameworks ensures thorough testing that meets recognised security benchmarks.
Does testing help with app store and privacy requirements?
Proactive testing protects against the risks to user data, intellectual property and reputation, and supports compliance with privacy regulations and app store security requirements.
What do we receive at the end?
A vulnerability report covering the app and its backend services, proof-of-concept demonstrations of exploitable weaknesses, remediation guidance written for developers, an executive summary, and post-assessment consultation.
Secure your mobile apps
Get started with mobile application security
Protect your mobile applications from exploitation
Ensure user data remains secure across iOS and Android platforms.