sales-inquiry@itecsonline.com|(214) 444-7884
Talk to ITECS

Mobile app penetration testing in Dallas

Manual testing of your iOS or Android app and its backend API to the OWASP MASVS, at a flat fee. Every test includes a readout call and one retest within 90 days of the report.

Scope your testSee how the flat fee works

App and backend together

What a mobile app penetration test covers

We test your iOS or Android app against the OWASP Mobile Application Security Verification Standard (MASVS). That covers what the app keeps on the phone and how it signs users in.

The test includes the backend API the app talks to, up to 25 endpoints. We test the app and its backend together, so a weakness that starts on the phone and ends on the server shows up in one report.

Apps with more than 25 backend endpoints get a fixed-fee quote, or you can scope the backend on its own with our API penetration test. Running a web app as well? See web application penetration testing.

  • What the app stores on the device
  • Sign-in and session handling
  • Traffic between the app and your servers
  • The backend API, up to 25 endpoints
Illustration of a mobile app and its backend API under test. Not a client app.

Mapped to OWASP

What we test

We test to the OWASP MASVS, which groups mobile app security into eight control areas. Seven are part of every test. Resilience against tampering and reverse engineering is the quoted Complex tier.

OWASP MASVS control groups and what the mobile app test checks for each
OWASP MASVS groupWhat we test
MASVS-STORAGEStorageWhat the app keeps on the device, and whether sensitive data ends up in files, logs or backups where it can leak.
MASVS-CRYPTOCryptographyHow the app uses encryption and where it keeps its keys.
MASVS-AUTHAuthentication and AuthorizationSign-in, session and biometric flows, and whether the backend enforces them instead of trusting the app.
MASVS-NETWORKNetwork CommunicationWhether traffic between the app and your servers is encrypted, and whether the app checks who it’s talking to.
MASVS-PLATFORMPlatform InteractionHow the app uses deep links, web views, permissions and data it shares with other apps.
MASVS-CODECode QualityOutdated components and how the app handles input it shouldn’t trust. Source code review isn’t included.
MASVS-PRIVACYPrivacyWhether the app collects or shares more personal data than it needs.
MASVS-RESILIENCEResilience Against Reverse Engineering and TamperingAnti-tampering, jailbreak and root detection, and other reverse-engineering defenses. This is the quoted Complex tier.

Included in every test

What you get

Leadership gets an executive summary. Your app and backend developers get every finding with its risk rating and evidence, plus the steps to fix it. We walk your team through the results on a readout call, and after your fixes are in, we retest the reported findings once.

Not included

  • Source code review
  • Fixing the findings (you get the fix steps)
  • More retest rounds, or a retest after 90 days. We quote these as a fixed fee.

  • Scoping call and rules of engagement

    We agree on the scope and the environment, then write both into rules of engagement before testing starts.

  • Executive summary

    A short read for leadership: what we tested, what we found and which risks matter most.

  • Risk-rated findings

    Every finding with its risk rating, the evidence behind it and the steps your developers need to fix it.

  • Readout call

    We walk your team through the results and answer questions about each finding.

  • Letter of attestation

    For your SOC 2 auditor or a customer’s security questionnaire.

  • One retest

    After your fixes, we retest the reported findings once, within 90 days of the report.

ITECS

Letter of attestation

Date:

To whom it may concern,

ITECS performed a mobile app penetration test of for between and . Testing was manual and covered the scope set out in the written rules of engagement, measured against the OWASP MASVS.

We reported findings: high, medium and low. A retest on confirmed the status of each reported finding, as listed in the retest summary.


ITECS

Redacted sample. Your letter names your application, test dates and results. Your auditor decides what evidence it accepts.

Flat fee

How the flat fee works

Testing one platform is one flat fee, starting at $8,790. Testing the iOS and Android versions of the same app together is a second, larger flat fee. Both include the backend API up to 25 endpoints.

Apps with more than 25 backend endpoints, or that need anti-tampering and resilience testing, get a fixed-fee quote after scoping. You know the price before testing starts.

Mobile app penetration testing scopes
ScopeWhat it covers
One platformiOS or Android
Both platformsThe iOS and Android versions of the same app
ComplexMore than 25 backend endpoints, or anti-tampering and resilience testing. Quoted after scoping.

How the test runs

How the test runs

The same six steps for every application test. Nothing gets tested until the scope is in writing, and nothing in the report goes unexplained.

  1. 01

    Scoping call

    We confirm the platforms and the backend endpoints in scope, then your tier and the flat fee, before any testing starts.

  2. 02

    Rules of engagement

    Scope and test window go into written rules of engagement. We test only what they cover.

  3. 03

    Manual testing

    We test the app on each platform in scope to the OWASP MASVS, along with the backend API it calls, signed-in and signed-out.

  4. 04

    Report

    An executive summary for leadership, and every finding with its risk rating, evidence and fix steps for your developers. It arrives on the date set in your rules of engagement.

  5. 05

    Readout call

    We walk your app and backend teams through the results and answer questions about each finding.

  6. 06

    Retest

    After your fixes are in, we retest the reported findings once, within 90 days of the report.

From the report

What a finding looks like

Every finding follows the same format: what we found, the evidence, what it means for the business and how to fix it.

All penetration testing servicesVulnerability assessments for your wider systems
MOB-02MASVS-STORAGE
Medium risk

Session token stored unencrypted on the device

Affected
The Android build of the demo app
What we found
After sign-in, the app saves the user’s session token in a plain settings file instead of the platform’s secure storage, and the backend keeps accepting it for 30 days.
Evidence
A file listing and a redacted copy of the stored token, plus a request log showing the backend API accepting the copied token.
Business impact
A lost phone or a careless backup could hand someone access to the account without a password.
How to fix it
  1. Store tokens in the platform’s secure storage instead of app settings.
  2. Shorten the token lifetime and revoke tokens on sign-out and password change.
  3. Exclude files with sensitive data from device backups.
Retest
After the fix, the token sits in secure storage and no longer appears in app files or backups. Closed.
Sample finding written against an intentionally vulnerable demo app. It is not from a client test.

Mobile app penetration testing questions

Platforms, backend coverage, pricing and what the Complex tier adds.

Yes. Testing one platform is one flat fee. Testing the iOS and Android versions of the same app together is a second, larger flat fee.

Yes, up to 25 endpoints. Apps with more than 25 backend endpoints get a fixed-fee quote after scoping, or you can scope the backend on its own with our API penetration test.

No. Source code review isn’t part of this test. We test the app and its backend API as they run, the way an attacker with the app installed or a signed-in user would see them.

That’s the Complex tier. Anti-tampering and resilience testing, including jailbreak and root detection, gets a fixed-fee quote after scoping.

It’s a flat fee, starting at $8,790 for one platform. Testing the iOS and Android versions of the same app is a second, larger flat fee. Both include the backend API up to 25 endpoints. Larger backends and resilience testing are quoted after scoping, so you know the price before testing starts.

The OWASP Mobile Application Security Verification Standard (MASVS). Seven of its eight control groups are part of every test. The resilience group, which covers anti-tampering, is the quoted Complex tier.

The test doesn’t include remediation. Your developers get fix steps for every finding, and we retest the reported findings once within 90 days of the report. More retest rounds are quoted as a fixed fee.

Related testing

Testing a web app, an API or a network?

  • Web application penetration testing

    A flat-fee manual test of one web application and its own API against the OWASP Top 10.

    Web application testing

  • API penetration testing

    For APIs without a user interface, priced by endpoint count and tested against the OWASP API Security Top 10.

    API testing

  • All penetration testing

    Network, cloud, wireless, social engineering and red team testing, plus continuous testing between engagements.

    Penetration testing services

  • Vulnerability assessment

    A ranked list of known weaknesses across your systems and a plan to fix them, without proving attack paths.

    Vulnerability assessments

Scope your mobile app test

Tell us which platforms you ship and roughly how big the backend is. We’ll confirm the scope and the flat fee on a scoping call.

Scope your testAll penetration testing