Reverse engineering
What the app reveals when decompiled: API keys, hidden endpoints, debug features, hard-coded secrets.
Mobile app pentest
Your app ships to every attacker’s phone. We open it first.
Anyone can download your app, take it apart and watch how it talks to your servers. We do exactly that for iOS and Android, and tell you what an attacker learns from it.
- iOS and Android
- OWASP MASVS
- App plus backend API
In short
A mobile app penetration test examines an iOS or Android app and the backend it talks to. Testers reverse engineer the app, inspect what it stores on the device, intercept its network traffic and attack the APIs behind it, following the OWASP Mobile Application Security Verification Standard (MASVS). Zyberum tests the app and its API together, because most serious findings sit in the backend.
What we test
On the device and behind it
Data on the device
What is stored, where, and how well it is protected if the phone is lost or rooted.
Network traffic
Transport security, certificate pinning and what can be changed on the way.
Backend API
Access control and business logic of the API: the place where other users’ data leaks.
Authentication
Login, biometrics, tokens and how sessions survive.
Device communication
For companion apps: Bluetooth pairing and commands to your IoT device.
Case studies
When the app is the way in
IoTAPI security
Case Study: Root on a Robot Vacuum, and Other People’s Cameras
Full root access on the device, and access to the live WebRTC camera of other users through the cloud API.
We tested a camera-equipped robot vacuum: root access on the device, and cloud API flaws that opened the live camera of other users. What went wrong and why.
Read the case studyIoTMQTT
Case Study: A Smart Irrigation System Anyone Could Control
We could see and activate other customers’ devices through MQTT, and geolocate where they are installed.
We tested a smart irrigation system: a broken MQTT setup let us see and switch the devices of other customers, and locate where they are installed.
Read the case studyFAQ
Mobile pentest FAQ
Do you test the app or the backend?
Both. The app is the map, the backend is where the data is. Testing only the app misses the findings with the highest impact.
Do you need the source code?
No, a test build is enough. With source code we can go deeper in the same time.
Is one platform enough?
If iOS and Android use the same backend, the API findings apply to both. Platform-specific issues such as local storage need a test per platform.
Get started
Get your mobile app pentest scoped in 15 minutes
Tell us which platforms, what the app does and which backend it uses. You get a fixed-price offer after the call.
- iOS, Android or both
- Fixed-price offer after the call
- A test build and test accounts are all we need
Your call is withTom ZaubermannFounder & CEO, Zyberum
Or send us a message
We reply within one business day.