Skip to content
Penetration testing
  • External network penetration testing
  • Internal network penetration testing
  • Web application penetration testing
  • API penetration testing
  • Mobile application penetration testing
  • Wireless penetration testing
  • Cloud security assessment
  • Social engineering and phishing simulation
Security assurance
  • Essential Eight assessment
  • Configuration review and benchmarking
  • Remediation support and retesting
Managed security
  • Vulnerability management
  • Continuous application scanning
  • SIEM monitoring
  • EDR monitoring
All services on one page
Industries How we work About Blog
1300 AURIAN Contact
Menu
Penetration testing
  • Penetration testing services
  • External network penetration testing
  • Internal network penetration testing
  • Web application penetration testing
  • API penetration testing
  • Mobile application penetration testing
  • Wireless penetration testing
  • Cloud security assessment
  • Social engineering and phishing simulation
Security assurance
  • Security assurance and compliance services
  • Essential Eight assessment
  • Configuration review and benchmarking
  • Remediation support and retesting
Managed security
  • Managed security services
  • Vulnerability management
  • Continuous application scanning
  • SIEM monitoring
  • EDR monitoring
  • All services
  • Industries
  • How we work
  • About
  • Blog
Call 1300 AURIAN Contact
  1. Services
  2. Penetration testing
  3. Mobile application penetration testing

Penetration testing

Mobile application penetration testing

We test your iOS and Android apps against the OWASP mobile standard, on device, including the back-end they depend on.

Scope a test Call 1300 AURIAN

Who this is for

  • You ship an iOS or Android app to customers or staff

    A mobile app runs on a device you do not control, so what it stores and how it protects itself matter as much as the server behind it.

  • The app handles credentials, payments or personal data

    Anything sensitive stored or cached on the device is exposed if the phone is lost, stolen or already compromised.

  • The app relies on an API you also want tested

    Most of a mobile app's real risk sits in the API it calls, which we can test in the same engagement.

What our mobile application penetration test covers

Internet Web application API Perimeter Cloud tenancy Email Office network Workstation Identity Wireless Crown jewels Servers INTERNET: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. WEB APPLICATION: NOT IN SCOPE HERE Covered by web application penetration testing. Click to open that service. API: CHECKS INCLUDE The back-end API the app depends on, against the OWASP API Security Top 10 Token issuance, storage and replay between the app and the API Data exposure through the endpoints the app calls PERIMETER: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. CLOUD TENANCY: NOT IN SCOPE HERE Covered by cloud security assessment. Click to open that service. EMAIL: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. OFFICE NETWORK: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. WORKSTATION: NOT IN SCOPE HERE Covered by essential Eight assessment. Click to open that service. IDENTITY: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. WIRELESS: NOT IN SCOPE HERE Covered by wireless penetration testing. Click to open that service. CROWN JEWELS: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. SERVERS: NOT IN SCOPE HERE Covered by configuration review and benchmarking. Click to open that service. Internet Web application Perimeter API Email Cloud tenancy Office network Workstation Wireless Identity Crown jewels Servers INTERNET: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. WEB APPLICATION: NOT IN SCOPE HERE Covered by web application penetration testing. Click to open that service. PERIMETER: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. API: CHECKS INCLUDE The back-end API the app depends on, against the OWASP API Security Top 10 Token issuance, storage and replay between the app and the API Data exposure through the endpoints the app calls EMAIL: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. CLOUD TENANCY: NOT IN SCOPE HERE Covered by cloud security assessment. Click to open that service. OFFICE NETWORK: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. WORKSTATION: NOT IN SCOPE HERE Covered by essential Eight assessment. Click to open that service. WIRELESS: NOT IN SCOPE HERE Covered by wireless penetration testing. Click to open that service. IDENTITY: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. CROWN JEWELS: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. SERVERS: NOT IN SCOPE HERE Covered by configuration review and benchmarking. Click to open that service.

We test the app against the OWASP Mobile Application Security Verification Standard, on a real device, covering the client, its storage and the API behind it.

  • Local data storage, including databases, preferences, caches and logs
  • Transport security and certificate pinning, and whether it can be bypassed
  • Authentication, session handling and token storage on the device
  • Reverse engineering resistance and the secrets recoverable from the binary
  • Platform interaction, including inter-process communication and deep links
  • Client-side controls that can be bypassed once the app runs on a rooted or jailbroken device
  • The back-end API the app depends on, tested against the OWASP API Security Top 10
  • Third-party libraries and their known weaknesses

How we test it

A mobile application runs on hardware you do not own, often on a device that is already rooted, shared or compromised. That changes what testing has to check: not only whether the server can be attacked, but what the app leaves on the device, what an attacker recovers from the binary, and which of the app’s own protections can be switched off once it runs outside your control. Aurian tests against the OWASP Mobile Application Security Verification Standard and its testing guide, on real iOS and Android devices, by a senior consultant.

The work runs in two halves. Static analysis takes the app apart, decompiling the binary to look for hard-coded secrets, weak cryptography and the logic meant to guard sensitive functions. Dynamic analysis runs the app on an instrumented device, intercepting its traffic, defeating certificate pinning, and inspecting everything it writes to storage, from databases and preferences to caches and logs. Client-side controls that assume a trustworthy device are tested from the attacker’s position, on a device that is anything but.

Because most of a mobile app’s real risk sits in the interface behind it, we test the back-end API in the same engagement, against the OWASP API Security Top 10, so authorisation and data-exposure flaws are caught on the server rather than assumed away. Findings arrive with evidence captured from the device, and we retest the findings rated high or above once your team has remediated.

Standards OWASP MASVS, OWASP MASTG, OWASP API Security Top 10

  1. 01 Setup

    We install the app on instrumented iOS and Android devices, so we can observe storage, traffic and behaviour as a determined attacker would.

  2. 02 Static analysis

    We decompile and inspect the binary for hard-coded secrets, weak cryptography and the logic that guards sensitive functions.

  3. 03 Dynamic analysis

    We run the app, intercept its traffic, bypass client-side controls and pinning, and test what it stores and how it behaves under attack.

  4. 04 Reporting and retest

    You receive findings ranked by severity with device evidence. Once you have remediated, a retest of the findings rated high or above confirms what is closed and the report is updated. Retesting is quoted with the test or booked afterwards.

What you receive

Every finding in an Aurian report looks like this: what we found, the evidence, what it means for you, and what to change.

High AUR-2026-014 Sample finding, fictional environment

Session token stored in world-readable preferences survives logout

Affected asset
SharedPreferences file auth.xml in the Android package
Rating
High Possible 3 × Severe 5 = 15

Description

The app writes the session token to an unencrypted preferences file and does not clear it on logout. On a rooted device, or through a backup, the token can be recovered and replayed to impersonate the user, even after they believe they have signed out.

Evidence

$ adb shell run-as au.com.example.app \
    cat shared_prefs/auth.xml
<map>
  <string name="session_token">eyJhbGciOiJIUzI1NiIs...</string>
  <long name="issued_at">1757030400000</long>
</map>
# file persists after the user taps Log out

The session token was readable in plain text and remained on the device after the user had logged out.

Impact

Anyone with access to the device, physically or through malware, can recover a valid session and act as the user. Because the token is not cleared on logout, a shared or resold device leaks the previous user's session to the next person to hold it.

Remediation

Store tokens in the platform keystore, the Android Keystore or the iOS Keychain, not in preferences or files. Clear all credentials and tokens on logout, set a server-side session lifetime, and exclude sensitive data from device backups.

References

  • OWASP MASVS, data storage and privacy requirements
  • OWASP MASTG, testing data storage
  • Executive summary written for the board and the insurer, in plain language
  • Technical findings ranked by severity, each with evidence from the device
  • Coverage of both the app and the API it depends on, in one report
  • Remediation guidance your developers can act on without calling us

Common findings

What this kind of engagement typically surfaces, so you can recognise your own environment.

  • Sensitive data in local storage

    Tokens, personal data and cached responses written to unencrypted files, databases or logs on the device.

  • Certificate pinning absent or bypassable

    Traffic that can be intercepted because pinning is missing, or pinning that a rooted device defeats without much effort.

  • Hard-coded secrets in the binary

    API keys, credentials and endpoints recoverable by decompiling the app, handing an attacker the server side.

  • Weak session handling

    Tokens that persist after logout, sessions that never expire server-side, and biometric prompts that guard nothing.

  • Insecure deep links and exported components

    Activities, intents and URL handlers that other apps can call to reach protected functions.

  • Back-end API flaws

    The same authorisation and data-exposure issues found in any API, reached through the mobile client.

Frequently asked questions

Do you test on real devices or emulators?

On real devices, including rooted and jailbroken ones, because that is the environment an attacker uses and where client-side controls are defeated. We use emulators only to widen coverage across versions.

Do you test the back-end as well?

We do, and we recommend it. Most of a mobile app's real risk sits in the API it calls. We can test the API in the same engagement against the OWASP API Security Top 10.

What do you need from us?

The app builds for iOS and Android, ideally a version we can instrument, test accounts, and details of the back-end in scope. If the app is in a closed testing track, we help you add our test devices.

Do we need to give you the source code?

No. We test as an attacker would, from the compiled app. Source code speeds up the static analysis and makes the review more complete, so we welcome it where you can share it, but it is not required.

How long does it take?

It depends on the size of the app and whether the API is in scope: typically five to ten days of testing with the API included, and the report following. We confirm the timeframe after scoping.

Related services

API penetration testing

API penetration testing for REST, GraphQL and SOAP against the OWASP API Security Top 10: authorisation, rate limiting and undocumented endpoints.

Web application penetration testing

Web application penetration testing against the OWASP Testing Guide: authentication, access control, injection and business logic, tested by hand.

Cloud security assessment

Cloud security assessment for AWS, Azure, Microsoft 365 and Google Cloud: CIS Benchmark review and attack-path testing of identity, exposure and logging.

Penetration testing services

Scope a test with a senior consultant

Tell us what you need to know about your environment. We reply within one business day.

Scope a test Call 1300 AURIAN

Aurian Security is an Australian penetration testing and security assurance firm. Senior consultants perform every engagement, for clients across the country.

Penetration testing

  • External network penetration testing
  • Internal network penetration testing
  • Web application penetration testing
  • API penetration testing
  • Mobile application penetration testing
  • Wireless penetration testing
  • Cloud security assessment
  • Social engineering and phishing simulation

Assurance and managed

  • Security assurance
  • Essential Eight assessment
  • Configuration review and benchmarking
  • Remediation support and retesting
  • Managed security
  • Vulnerability management
  • Continuous application scanning
  • SIEM monitoring
  • EDR monitoring

Company

  • About Aurian
  • How we work
  • Industries
  • Blog
  • Contact
  • Privacy policy
526/368 Sussex St, Sydney NSW 2000 1300 AURIAN (1300 287 426) sales@aurian.com.au

© 2026 Aurian Security Pty Ltd. ACN 639 930 528.

This site is static, loads no third-party trackers, and publishes a security.txt.