# Your app ships to every attacker’s phone. We open it first.

> A mobile app penetration test examines an iOS or Android app and the backend it talks to. Testers reverse engineer the app, inspect what it stores on the device, intercept its network traffic and attack the APIs behind it, following the OWASP Mobile Application Security Verification Standard (MASVS). Zyberum tests the app and its API together, because most serious findings sit in the backend.

Pentests for iOS and Android apps: local data storage, reverse engineering, API communication and backend access control, following OWASP MASVS. Fixed price.

Source: https://zyberum.com/mobile-app-pentest

Anyone can download your app, take it apart and watch how it talks to your servers. We do exactly that for iOS and Android, and tell you what an attacker learns from it.

## On the device and behind it

### Reverse engineering

What the app reveals when decompiled: API keys, hidden endpoints, debug features, hard-coded secrets.

### Data on the device

What is stored, where, and how well it is protected if the phone is lost or rooted.

### Network traffic

Transport security, certificate pinning and what can be changed on the way.

### Backend API

Access control and business logic of the API: the place where other users’ data leaks.

### Authentication

Login, biometrics, tokens and how sessions survive.

### Device communication

For companion apps: Bluetooth pairing and commands to your IoT device.

## When the app is the way in

## FAQ

**Do you test the app or the backend?**

Both. The app is the map, the backend is where the data is. Testing only the app misses the findings with the highest impact.

**Do you need the source code?**

No, a test build is enough. With source code we can go deeper in the same time.

**Is one platform enough?**

If iOS and Android use the same backend, the API findings apply to both. Platform-specific issues such as local storage need a test per platform.

---
Zyberum GmbH. Canonical page: https://zyberum.com/mobile-app-pentest