Offensive security
Assume the attacker owns the device.
iOS and Android penetration testing across the app binary, local data storage, transport security and backend APIs.
Test sequence
Static: Binary, code and configuration analysis of the shipped app.
Mobile Application Penetration Testing is a comprehensive security assessment for iOS, Android or cross-platform apps. It identifies weaknesses that could expose sensitive data, compromise user accounts or disrupt app functionality, then examines what a real-world attacker can do when they control the device. Testing follows OWASP MASVS and MASTG on rooted and jailbroken devices and covers local storage, transport, runtime controls and backend behaviour.
Mobile testing is a specialised form of penetration testing built around an attacker-controlled device.
If the backend serves other clients or has a broader interface, add dedicated API Penetration Testing beyond the endpoints exercised by the app.
For connected customer portals and administrative interfaces, use Web Application Security Testing.
€2,100 excl. VAT
Configure with our team€2,100 excl. VAT
Configure with our team€4,200 excl. VAT
Configure with our teamOur experts hold certifications including OSEE, OSCP, OSWE, OSEP, OSED, OSWP, eWPTx, eMAPT, eCPPT, CRTO and CEH.
Evolvice operates certified quality-management and information-security systems under ISO 9001:2015 and ISO 27001:2022.
More than thirteen years of technology delivery inform scoping, communication, reporting and remediation support.
“Their penetration testing report was not only detailed but actionable. Our developers could immediately start fixing the issues.”
“They helped us identify critical vulnerabilities we didn’t know existed. A truly professional and responsive team.”
“From the initial scoping call to the final report, everything was handled with precision and professionalism.”
Jailbroken-device testing: keychain usage, data protection classes, IPC and URL scheme handling.
Rooted-device testing: shared preferences, exported components, intents and WebView configuration.
Credentials, tokens and personal data left recoverable on the device.
TLS configuration, certificate validation and pinning bypass resistance.
Frida and Objection-based hooking, root/jailbreak detection bypass, tamper resistance.
Server-side authorisation checks that must hold even when the client is fully compromised.
They can be scoped separately or together. Shared backend testing is performed once; platform-specific client testing is performed per platform.
The app build (IPA/APK or store access), test accounts for each user role, and any backend documentation. Source code is optional but improves depth.
The APIs the app uses are included. A broader API or infrastructure test is a separate scope — see API penetration testing.
No. Pinning raises the effort for an attacker but can be bypassed on a controlled device. Server-side authorisation must hold regardless of the client.