OWASP MASVS coverage
MASVS sets out security requirements for storage, cryptography, authentication, network traffic, platform interaction, code quality and resilience. We test each area that applies to your app.
Advisory
Mobile App Penetration Testing for iOS and Android
OWASP MASVS-aligned testing of your iOS and Android apps and the APIs behind them. Vectra holds the CREST Mobile App Security Testing accreditation, and our testers are based in Australia.
Mobile app penetration testing in Australia, on the device and behind it.
Mobile app penetration testing examines an iOS or Android app the way an attacker would: by pulling the app apart, watching it run on a compromised device and attacking the services it talks to. Vectra offers mobile app penetration testing across Australia, and Mobile App Security Testing is one of our six CREST accreditations. We assess apps against the OWASP Mobile Application Security Verification Standard (MASVS) and its testing guide (MSTG). Static binary analysis, runtime hooking with Frida and Objection, and testing of the back-end API are all part of the scope. Every High-and-above issue is exploited by hand before it reaches the report.
What a mobile app penetration test involves.
The essentials of a Vectra mobile engagement. The detail is set at scoping, around your app, platforms and back end.
-
Platforms
iOS and Android, tested separately or together in one engagement.
-
Accreditation
CREST Mobile App Security Testing, one of Vectra's six CREST accreditations.
-
Standard
OWASP MASVS and its testing guide (MSTG).
-
Techniques
Static binary analysis, reverse engineering, anti-tamper review and runtime hooking with Frida and Objection.
-
Back end
API assessment bundled into the mobile scope.
What we test in a mobile application penetration test.
A mobile app runs on hardware you do not control. We test it as though the attacker holds the device.
Static binary analysis
We decompile the app to look for hard-coded keys, secrets, debug code, weak cryptography and logic that should never have left your developers' machines.
Runtime hooking
Using Frida and Objection, we intercept functions while the app runs, alter return values and switch off client-side checks to expose what the app trusts.
Local data storage
We inspect what the app leaves on the handset: files, databases, caches, logs, screenshots, the iOS Keychain and the Android Keystore.
Transport and certificate pinning
We intercept traffic between app and server, check TLS configuration and test whether certificate pinning stops a man-in-the-middle attack.
Anti-tamper, jailbreak and root detection
We assess how easily an attacker could repackage the app, bypass integrity checks or run it on a jailbroken or rooted device.
Platform interaction
Deep links, Android intents, WebViews, clipboard use and permissions can all expose data to other apps. We test each one your app uses.
Back-end API testing
We call the app's API directly, outside the app, to find authorisation gaps and data exposure that the mobile interface never reveals.
When to pen test a mobile app.
Mobile apps change quickly and travel everywhere. These moments call for a test.
-
Before the first release to the App Store or Google Play.
-
Before any release that changes sign-in, payments or local data storage.
-
When the app holds passwords, health information or other regulated data.
-
When the app takes payments or stores card details.
-
After adding a third-party SDK or changing the back-end API.
-
When a bank, partner or enterprise customer asks for independent evidence.
Why use Vectra for mobile application penetration testing.
Mobile testing needs its own tools and techniques. This is what we bring to it.
CREST Mobile App Security Testing
A specific CREST accreditation for mobile work, separate from our general penetration testing accreditation. You can verify it on the CREST Marketplace.
iOS and Android in one engagement
When your app ships on both platforms, we can test both builds side by side and report shared weaknesses once, with platform-specific fixes.
App and API as one scope
Backend API assessment is bundled into mobile testing, so a flaw that starts on the handset and ends in your database is traced end to end.
Hands-on runtime analysis
Frida and Objection let testers change the app's behaviour while it runs, which reveals what static review and automated scanning cannot.
How we test an iOS or Android app.
Our six CREST-aligned steps, as they apply to a mobile application and its back end.
-
Step 1: Scope & kick-off
We agree the platforms, app versions, test builds, back-end environment and user roles, and confirm how builds will be shared.
-
Step 2: Threat modelling
We consider who might attack the app: a thief holding the phone, malware on the device, or someone intercepting traffic on public Wi-Fi.
-
Step 3: Reconnaissance
We decompile and inspect the binary, listing embedded secrets, third-party SDKs, exported components and the endpoints the app calls.
-
Step 4: Exploitation
Testers hook the running app, bypass client-side controls and attack its storage, transport and API calls against the MASVS requirements.
-
Step 5: Post-exploitation
We show what an attacker gains from a compromised app, such as other users' accounts, payment functions or back-end data.
-
Step 6: Reporting & retest
Findings are reported per platform with fixes for each, followed by a retest once your developers ship a corrected build.
Mobile app pen test deliverables.
Mobile findings often differ between iOS and Android, so our report shows clearly which platform and build each issue affects.
You also receive the deliverables that come with every Vectra engagement, set out on our penetration testing page.
-
Platform-specific findings
Each issue is tagged by platform and build, with reproduction steps and screen captures of the exploit chain.
-
Fixes for each platform
Developer-ready remediation for iOS and Android, with a suggested code fix where one applies.
-
Executive report and debrief
A narrative report for leaders and a walkthrough with your mobile and back-end developers.
-
Retest of corrected builds
A retest window for High-and-above findings, plus 90 days of portal access to track remediation.
Mobile app testing for regulated industries.
Mobile apps often carry the most sensitive data a business holds. A test supports the frameworks that govern it.
Banking and finance
Mobile banking and payment apps are core systems for APRA-regulated entities, and CPS 234 expects their security controls to be tested.
Payments and PCI DSS
Apps inside your cardholder data environment fall under requirement 11.4 testing. Payment SDKs can be assessed under the PCI Secure Software Standard.
Healthcare
Patient apps hold health information, which the Privacy Act treats as sensitive. Testing local storage and the API protects it.
Retail and e-commerce
Shopping and loyalty apps combine stored accounts, saved cards and promotions, which makes them an attractive target for fraud.
ISO 27001
Testing each significant release supports Annex A control 8.29, security testing in development and acceptance.
Government
Citizen-facing apps for federal, state and local government handle identity and personal data that must be protected.
Scoped quotes for mobile app testing.
Platforms, user roles and the size of the back-end API shape the effort, so each app is scoped and quoted individually.
Related penetration testing services.
A mobile app is the visible part of a bigger system. These tests cover the rest of it.
API penetration testing
A deeper look at the API your app calls, including partner access, GraphQL and gRPC services.
Web application penetration testing
The customer website or portal that often shares accounts and data with your mobile app.
Cloud penetration testing
The cloud accounts, storage and functions that host your mobile back end.
Penetration testing in Australia
Every type of test we run, our methodology and our CREST accreditations.
Mobile penetration testing near you.
Our city pages cover the sectors, compliance needs and procurement routes that matter to app teams in each location. Each one also lists the local office contact details.
- Penetration Testing Sydney - 3 Spring Street, Sydney NSW 2000. Call +61 2 9276 1800.
- Penetration Testing Melbourne - 454 Collins Street, Melbourne VIC 3000. Call +61 3 9036 3800.
Mobile app penetration testing FAQs.
Do you need a test build of our app?
A test build gives the best results. For Android, send an APK or app bundle; for iOS, share an IPA or invite our testers through TestFlight. Point the build at a test environment and provide accounts for each user role. If a test build is not possible, we can assess the public store version, although some checks then take longer.
Can you test iOS and Android in one engagement?
Yes. Where an app ships on both platforms, testing them together usually makes sense. The two builds often share an API and business logic but differ in how they store data, handle certificates and detect tampering. Testing them side by side lets us report common issues once and give platform-specific fixes where the builds diverge.
Should we pen test before every app store release?
Test before each release that changes sign-in, payments, data storage or the API the app depends on. Minor interface updates rarely need a full retest. Many organisations also test at least once a year, and apps that hold passwords, regulated data or payment details may need testing more often.
Do you test the API behind the mobile app?
Yes. Back-end API assessment is part of our mobile app scope, because that is where most of the valuable data sits. Attackers can bypass any check the app performs on the device and call the API directly. If the API also serves a website or partners, our API penetration testing page explains how we test it on its own.
Can you test apps with certificate pinning or jailbreak detection?
Yes. We test whether those controls can be bypassed, since a determined attacker will try. For the rest of the assessment, we either bypass them or ask for a build with them switched off, so the time goes on testing the app rather than fighting its defences. Both results appear in the report.
Start with a conversation.
Speak to us about your cyber governance and compliance requirements.
Message sent
Thanks. We have your message.
A member of our team will be in touch soon at . You can also reach us during business hours on 1800 816 044.
- Topic
- Company
Need us sooner? Call +61 8 8208 0800, or the 24/7 incident line on 1800 816 044 if something is happening now.