Mobile app penetration testing
Mobile app penetration testing checks your iOS and Android apps and the APIs behind them. HYDN tests local data storage, authentication, certificate pinning and network traffic, reverse engineers the app for hardcoded secrets and logic that can be tampered with, and tests the backend the app talks to, using OWASP MAS as a baseline.
What we test
- Data storage. Tokens, keys and personal data left in local storage, logs, backups or the clipboard.
- Authentication. Biometric and PIN flows, session handling and what happens on logout and reinstall.
- Network. TLS configuration, certificate pinning and whether traffic can be intercepted or altered.
- Reverse engineering. Hardcoded API keys and endpoints, and client-side checks that can be patched out.
- Tampering. Whether a modified or rooted or jailbroken environment can bypass controls.
- Platform features. Deep links, intents, webviews and inter-app communication.
- Backend APIs. Everything the app calls, tested directly. See API penetration testing.
Wallet and exchange apps
For apps that hold keys or move funds, we also test key generation and storage, transaction signing and the information shown to users before they approve. See wallet penetration testing.
Frequently asked questions
Do you test both iOS and Android?
Yes. The platforms store data and enforce security differently, so each build is tested on its own.
Is the backend included?
It should be. Most serious mobile findings are in the API the app calls, which an attacker can talk to directly without the app.
Published Updated