iOS & Android Security Testing

Your app is only as
secure as what's
running inside it

Expert-led penetration testing for iOS and Android applications — covering the client binary, local storage, API communication, and backend logic that automated scanners can't reach.

Request a Mobile Pentest Our methodology

iOS & Android

Full platform coverage

OWASP M10

Full mobile top 10 coverage

48h

First critical finding alert

9:41

Analysis in progress

Target Application

com.client.mobileapp · v3.2.1

Active findings

Critical Hardcoded API key in binary

Critical Auth token stored in plaintext

High Broken certificate pinning

High PII logged to device log

Medium Exported activity — no auth

OWASP Mobile Top 10

Improper Credential Use

✓

Inadequate Supply Chain

✓

Insecure Auth/Auth

▶

Insufficient I/O Validation

—

Overview

Mobile apps are a different attack surface entirely

Web application testing doesn't translate directly to mobile. The attack surface is fundamentally different — you're dealing with a client binary that runs on a device you don't control, storing data in ways that vary by platform, communicating with APIs over networks that may be intercepted, and relying on OS-level protections that can be bypassed on jailbroken or rooted devices.

Our mobile penetration tests cover the full stack: static binary analysis, dynamic runtime testing, local storage and keychain inspection, network traffic interception, API backend testing, and platform-specific abuse vectors — on both iOS and Android.

Every engagement follows the OWASP Mobile Application Security Testing Guide (MASTG) and covers the full OWASP Mobile Top 10. Findings include reproduction steps specific to the platform, business impact context, and developer-ready remediation guidance.

Platforms tested — iOS and Android in one engagement

M10

Full OWASP Mobile Top 10 coverage every time

100%

Remediation retest included at no extra cost

Every engagement includes

Full-scope mobile
security assessment

Static binary analysis

Reverse engineering the compiled binary for hardcoded secrets, exposed logic, and insecure configurations

Dynamic runtime testing

Live instrumentation of the running app — hooking functions, inspecting memory, and bypassing protections

Local data & keychain testing

Inspection of all data stored on-device — databases, shared preferences, keychain, and temp files

Network traffic interception

Full MITM analysis of all API calls — certificate pinning bypass, traffic analysis, and API-level testing

Backend API testing

The mobile backend is tested with the same depth as a dedicated web app assessment

Dual-platform coverage

iOS and Android tested in a single engagement — platform-specific findings reported separately

Free remediation retest

We verify every fix across both platforms — not just checking a box, confirming it's actually resolved

Platform Coverage

iOS and Android — tested differently

The two platforms have fundamentally different security architectures. Our testing is tailored to each — same rigour, platform-native techniques.

iOS

iPhone & iPad applications

IPA binary reverse engineering

Objective-C and Swift binary analysis using class-dump, Hopper, and custom tooling to uncover hidden logic and hardcoded secrets

Keychain & data protection

Testing of Keychain storage, NSUserDefaults, Core Data, and file protection attributes for insecure credential storage

Runtime manipulation with Frida

Live function hooking, jailbreak detection bypass, certificate pinning bypass, and biometric authentication bypass

URL scheme & deep link abuse

Testing for cross-app communication vulnerabilities, custom URL scheme hijacking, and universal link misconfigurations

ATS & network security config

App Transport Security exceptions, certificate validation, and TLS configuration review

Android

Phone & tablet applications

APK decompilation & analysis

Full APK decompilation with jadx, apktool, and MobSF — reviewing Java/Kotlin code, manifest permissions, and embedded resources

SharedPreferences & SQLite

Local storage testing across SharedPreferences, SQLite databases, internal/external storage, and Android Keystore usage

Exported components & IPC

Testing of exported activities, services, broadcast receivers, and content providers for unauthorized access and intent injection

Root detection bypass

Bypassing root and emulator detection, tampering protections, and anti-debugging mechanisms using Frida and Magisk modules

Deep links & WebView testing

Deep link hijacking, WebView JavaScript bridge abuse, and cross-origin access control testing

What We Test

OWASP Mobile Top 10 and beyond

The OWASP Mobile Top 10 is our baseline. We go further — testing platform-specific attack vectors, backend APIs, and third-party SDK integrations that standard checklists overlook.

Improper Credential Usage

Hardcoded API keys, tokens, and passwords in the binary or configuration files. Insecure credential storage in plaintext on device.

Insecure Data Storage

Sensitive data stored in plaintext on-device — unencrypted SQLite databases, SharedPreferences, logs, backups, and temp files accessible without auth.

Insecure Communication

Broken or missing certificate pinning, weak TLS configuration, cleartext HTTP, and API calls transmitting sensitive data without adequate transport protection.

Insufficient Authentication

Client-side authentication checks that can be bypassed, insecure biometric implementation, missing session expiry, and broken token refresh logic.

Insufficient Cryptography

Weak or custom encryption algorithms, insecure random number generation, improper IV handling, and encryption keys stored alongside encrypted data.

Authorization & Access Control

IDOR in mobile APIs, missing server-side authorization checks, privilege escalation through manipulated API parameters, and horizontal access control failures.

Code Quality & Binary Protections

Missing anti-tampering, missing obfuscation, debug builds in production, stack smashing protections, and reverse engineering resistance assessment.

Third-Party SDK Risk

Known vulnerabilities in bundled analytics, advertising, and crash reporting SDKs — and assessment of what data they collect and where they send it.

WebView & Deep Link Abuse

JavaScript injection via WebView bridges, deep link hijacking by malicious apps, intent redirection, and cross-app data leakage via exported components.

Methodology

How we approach every mobile engagement

We follow the OWASP Mobile Application Security Testing Guide (MASTG) and Mobile Application Security Verification Standard (MASVS) — with platform-specific tooling and techniques for iOS and Android.

Scoping & Setup

We receive the app binary (IPA/APK), backend API documentation, and test account credentials. Environment setup includes device preparation for jailbreak/root and proxy configuration.

Static Analysis

Binary decompilation and code review — examining app logic, permissions, hardcoded secrets, cryptographic implementations, and third-party SDK usage without running the app.

Dynamic Testing

Live testing with the app running — intercepting network traffic, hooking runtime functions with Frida, inspecting local storage, and bypassing tamper detection and certificate pinning.

API & Backend Testing

Dedicated testing of the mobile backend using intercepted traffic as a baseline — authentication, authorization, IDOR, injection, rate limiting, and business logic abuse.

Reporting & Retest

Platform-separated findings with CVSS scores, proof-of-concept reproduction steps, and developer-ready remediation guidance. Retest included once fixes are deployed.

Compliance

Built to satisfy your audit and store requirements

Mobile app security testing satisfies requirements across major compliance frameworks and increasingly — Apple App Store and Google Play security guidelines. Our reports are formatted for auditors and include the evidence packages your compliance team needs.

PCI-DSS v4

Required for mobile apps that process, store, or transmit cardholder data

SOC 2 Type II

Mobile app testing supports security and availability trust service criteria

HIPAA

Required for health apps handling PHI — covers both client and backend

GDPR / CCPA

Privacy-focused testing of data collection, storage, and third-party SDK data flows

App Store Guidelines

Apple and Google security guidelines for apps handling sensitive user data

Cyber Insurance

Mobile app assessment increasingly required for tech and healthcare sector carriers

Report deliverables

Full technical report with platform-separated findings (iOS / Android)

CVSS scores, PoC reproduction steps, and business impact for each finding

Executive summary for leadership and board presentation

Prioritized remediation roadmap with developer-level guidance

OWASP Mobile Top 10 coverage matrix

Letter of attestation confirming scope, methodology, and dates

Retest report confirming remediation across both platforms

OWASP MASTGOWASP MASVSOWASP Mobile Top 10CVSS v3.1PTESCWE

Client Results

What our clients say

We had shipped our iOS app to 50,000 users before Radical found hardcoded staging credentials in the binary. The engagement paid for itself in the first 20 minutes of testing.

CTO, Micro Notes

B2B SaaS Platform

HIPAA compliance required mobile app testing. Radical covered both our iOS and Android apps in a single engagement — the report was exactly what our auditors needed, delivered on time.

CTO, Wheel Health

Healthcare Technology

Our app handled payment data and we needed serious assurance before launch. Radical found certificate pinning issues and an API authorization flaw we hadn't caught internally. Thorough and professional throughout.

CPO, Luminary Audio

Consumer Platform

Why Radical Security

The Radical difference

Mobile pentesting requires a different skill set than web or network testing. Our practitioners are experienced in both iOS and Android reverse engineering, runtime instrumentation, and mobile-specific attack techniques.

Platform specialists

Dedicated iOS and Android expertise — not web testers handed a mobile scope. We know the platform internals, tooling, and attack techniques specific to each OS.

Real device testing

We test on physical jailbroken and rooted devices, not just emulators. Real-world conditions surface issues emulators miss entirely — especially hardware-backed security features.

API depth included

The mobile backend is tested with the same rigour as a standalone web app assessment. Client and server findings are reported together in a single, unified engagement.

Developer-first reports

Findings include platform-specific remediation guidance written for iOS and Android developers — not generic advice. Your team can act on day one.

Your app is only as
secure as what's
running inside it

Mobile apps are a different attack surface entirely

iOS and Android — tested differently

OWASP Mobile Top 10 and beyond

How we approach every mobile engagement

Built to satisfy your audit and store requirements

What our clients say

The Radical difference

Ready to test your mobile app?

Related services

Your app is only assecure as what'srunning inside it

Mobile apps are a different attack surface entirely

iOS and Android — tested differently

OWASP Mobile Top 10 and beyond

How we approach every mobile engagement

Built to satisfy your audit and store requirements

What our clients say

The Radical difference

Ready to test your mobile app?

Related services

Your app is only as
secure as what's
running inside it