Skip to content
HackIT
Talk to a tester

Mobile Application Penetration Testing

Manual testing of your mobile application, from what it keeps on the device to how it talks to your backend, by a senior tester. Every finding comes with evidence and reproduction steps, and a retest once your fixes ship.

Talk to a testerSee what we test
>_ finding HK-03Report
HighCVSS 7.5CWE-798

Hardcoded API key exposes customer records

com.example.app

>_ evidenceHTTP
GET /v2/customers?limit=100 HTTP/1.1Host: api.example.comX-Api-Key: ak_7c1e…9d20HTTP/1.1 200 OK{"count":100,"data":[…]}# same key ships in every install
Impact
The key ships inside every copy of the app. Anyone who unpacks it can read customer records through the API, and it cannot be rotated without updating every install.
Fix
Remove the key from the app. Authenticate each user with short-lived tokens, and limit what the API accepts from the mobile client.
StatusClosed on retest
Every finding in your report is written up like this, with evidence attached, and retested once your fix ships.

Why Test Your Mobile Application

Your app runs on devices you don’t control, and anyone can install it, unpack it and read what’s inside.

  • What Ships in the App Is Public

    Hardcoded keys, debug code and local storage are readable by anyone with the file. Testing finds them first.

  • The Backend Can’t Trust the App

    Requests can be replayed, edited or forged from outside it. We test whether your server checks what the app only assumes.

  • Data Lives on the Device

    Tokens, caches, backups and logs stay on a phone that can be lost or compromised. We check what is stored and who can read it.

When to Test

  • Before a launch or major release

  • After significant changes, such as new login, payments or integrations

  • On a regular cycle, at least yearly

  • Before an audit or a customer’s security review

Not sure which applies?That’s what the scope call is for

What We Test

Compliance audits cover the control groups of the OWASP Mobile Application Security Verification Standard (MASVS) 2.1 that apply to your app. Which controls apply, resilience and privacy in particular, is agreed when we scope the work. Attack simulations draw on the same groups but follow impact, not the checklist.

Tested against

OWASP MASVS 2.1Mobile applications

8 control groups

  • StorageMASVS-STORAGE
  • CryptographyMASVS-CRYPTO
  • Authentication and authorizationMASVS-AUTH
  • Network communicationMASVS-NETWORK
  • Platform interactionMASVS-PLATFORM
  • Code qualityMASVS-CODE
  • Resilience against reverse engineering and tamperingMASVS-RESILIENCE
  • PrivacyMASVS-PRIVACY

Two Ways to Test. Your Call.

Both are manual, senior-only and include a retest. Pick the one that matches why you are testing.

Compliance Audit

Full MASVS coverage

A complete, documentation-grade penetration test mapped to OWASP MASVS 2.1, the standard built for testing mobile applications. PCI DSS requires penetration testing, and SOC 2 and ISO 27001 audits accept it as evidence that your controls work. This engagement gives you that evidence, ready to present to your auditor.

Tested against

  • OWASP MASVS 2.1Mobile applications

Supports audit evidence for

  • SOC 2
  • ISO 27001
  • PCI DSS

Best for

Audits and certifications (SOC 2, ISO 27001, PCI DSS), or a complete security baseline of an app.

Scope a compliance audit

Real-World Attack Simulation

Impact-first. No noise.

Skip the documentation theatre. We focus on what an actual attacker would exploit: high-impact vulnerabilities with real, demonstrable consequences. No findings padding, no minor informational items. If it can be weaponised, we find it and prove it.

Tested against

  • OWASP MASVS 2.1Mobile applications
  • Manual only
  • Impact-first
  • No noise

Best for

Teams that want to know what an attacker could actually do, rather than tick every control.

Scope an attack simulation

What You Receive

Both engagements end with the same deliverable: a PDF written for two audiences, plus a conversation.

Showing the Executive Summary page of a sample report.

How an Engagement Runs

The same five steps for both engagements, and you deal with the tester at every one.

  1. 01

    Inquiry

    You send a message, by the form or by email. It goes straight to the tester, not to a sales team.

  2. 02

    Scope Call

    A call with the tester to agree targets, timelines and rules of engagement.

  3. 03

    Test

    Manual, senior-only testing: full MASVS coverage, or real attack paths.

  4. 04

    Report and Debrief

    Evidence, reproduction steps, severity and fixes per finding. We walk you through every one.

  5. 05

    Retest

    Included, not upsold. Once fixes ship, we verify each finding is actually closed.

How Pricing Works

  • Scoped, Not Sold by the HourEvery engagement is priced after a scoping conversation, for exactly what you need tested. Nothing padded.
  • Retest IncludedVerifying your fixes is part of every engagement, never a paid add-on.
  • Retainer DiscountsRepeat clients get better rates. Security is ongoing, and we price accordingly.
  • No Overhead to FundNo sales team or account managers, so senior testing comes in at roughly 40% below typical market rates.

Ready to Test What Actually Matters?

Tell us what you want tested. No sales call: your message goes to the tester, who replies to scope the work with you.

Prefer email?
contact@hackit.ee
Engagement (optional)

How we handle this: privacy policy