Insecure Data Storage
The most common high-severity finding in our mobile engagements. Applications write sensitive data, including authentication tokens, session identifiers, PII and financial records, to SharedPreferences (Android), NSUserDefaults (iOS), unencrypted SQLite databases, application logs or cache directories in plaintext. On a rooted or jailbroken device, this data is immediately accessible. Even on stock devices, backup extraction and third-party keyboard caches can expose it.
MASVS mapping
MASVS-STORAGE. We enumerate every local persistence mechanism the app uses, extract data from each, and verify whether encryption is applied and whether keys are properly stored in the platform keystore.
Insecure Communication & Transport
Mobile apps that rely solely on TLS without certificate pinning are trivially intercepted using a proxy with a custom CA certificate. Apps that do implement pinning often do so incorrectly: pinning only in the main HTTP client but not in third-party SDKs, analytics libraries or push-notification channels. We also test for cleartext HTTP fallback, improper TLS version negotiation and hostname verification bypasses.
MASVS mapping
MASVS-NETWORK. We attempt to intercept traffic with and without pinning bypass, verify that all endpoints use TLS 1.2+, and confirm that third-party SDK traffic is equally protected.
Insecure Authentication & Session Management
Mobile apps frequently implement authentication logic on the client side: biometric checks that can be bypassed with Frida, local PIN verification that never calls the server, session tokens that persist indefinitely after logout, and refresh tokens stored outside the platform keystore. We also test for missing step-up authentication on sensitive operations like fund transfers or profile changes.
MASVS mapping
MASVS-AUTH. We test the full authentication lifecycle including biometric bypass, token lifecycle, session invalidation and backend enforcement of every client-side check.
Client-Side Injection & WebView Abuse
Hybrid apps and apps with embedded WebViews are vulnerable to JavaScript injection through deep links, custom URL schemes and intent-based navigation. We test for JavaScript bridge exposure that allows native function calls from web content, local file access through file:// URIs in WebViews, and exported activities and content providers that accept untrusted input without validation.
MASVS mapping
MASVS-PLATFORM. We enumerate exported components, fuzz deep-link handlers, and test every WebView configuration for JavaScript enablement, file access and bridge exposure.
Reverse Engineering & Code Tampering
Every mobile app ships its compiled binary to the end user's device, which means an attacker can decompile it, patch it, and redistribute it. We assess the effectiveness of obfuscation (ProGuard/R8 on Android, Swift symbol stripping on iOS), root/jailbreak detection, debugger detection, integrity verification and anti-tampering controls. We attempt to repackage the app with modified behavior and test whether the server detects the tampered client.
MASVS mapping
MASVS-RESILIENCE. We decompile, patch and repackage the binary, then verify whether runtime integrity checks and server-side attestation detect our modifications.
Insufficient Cryptography
Mobile apps frequently implement cryptography incorrectly: using deprecated algorithms such as MD5 or SHA-1 for integrity checks, AES in ECB mode, hardcoded encryption keys compiled into the binary, IVs that are static or derived from predictable values, and key material stored in SharedPreferences or NSUserDefaults instead of the platform keystore (Android Keystore / iOS Keychain with Secure Enclave).
MASVS mapping
MASVS-CRYPTO. We extract all cryptographic operations from the decompiled source, verify algorithm choices, key storage locations and IV handling against current best practices.
Frequently Asked Questions About Mobile Application Security Testing
What is mobile application security testing and why does it matter?
Mobile application security testing is a structured assessment of an Android or iOS application covering its binary, runtime behavior, local data storage, network communications and backend API interactions. Unlike web applications, mobile apps ship compiled binaries to user devices, which means attackers can reverse-engineer the binary, hook into runtime functions, and intercept traffic even when certificate pinning is implemented. Testing matters because mobile apps frequently handle sensitive data (credentials, payment details, health records) on devices the organization does not control.
Do you test both Android and iOS apps, or only one platform?
We test both platforms. Android and iOS have fundamentally different security models, sandbox architectures and toolchains. An Android APK or AAB is tested with tools like jadx, apktool, Frida and objection for decompilation and runtime hooking. iOS IPAs are analyzed with class-dump, Hopper, Frida and SSL Kill Switch for similar depth. We test each platform independently because a vulnerability on one does not guarantee the same issue exists, or does not exist, on the other.
What standards does CipherTrivia align mobile security testing to?
All mobile security testing engagements are aligned to the OWASP Mobile Application Security Verification Standard (MASVS) and the OWASP Mobile Application Security Testing Guide (MASTG). Findings are scored using CVSS 4.0 and mapped to the relevant MASVS categories. For regulated industries such as banking or healthcare, we also map findings to PCI DSS, HIPAA or RBI guidelines as applicable.
Can you test apps that use certificate pinning or root/jailbreak detection?
Yes. Bypassing certificate pinning and root or jailbreak detection is a standard part of our testing methodology. We use dynamic instrumentation frameworks such as Frida and objection to bypass these controls at runtime. The goal is to verify whether these defenses are robust enough to resist a motivated attacker, and to document exactly how they can be circumvented so your development team can strengthen the implementation.
How long does a mobile application security test typically take?
A single-platform test (Android or iOS only) typically takes one to two weeks. A dual-platform engagement covering both Android and iOS takes two to three weeks. Timelines depend on the complexity of the application, the number of API endpoints, and whether source code access is provided for white-box analysis. We agree on timelines during scoping so there are no surprises.