Pentesting of iOS and Android mobile applications

It is OWASP's mobile application security verification standard, which defines the requirements and tests for auditing iOS and Android apps.

Yes. We cover both platforms and also the backend APIs that the application consumes, as they are often part of the risk.

Insecure data storage, unencrypted communications, embedded keys, authentication and session failures, and poorly protected APIs, among others.

We can work with or without source code. With access to the code, the analysis is more in-depth, but we also test the compiled app.

Yes. We use static and dynamic analysis along with manual testing on the device to detect faults that the tools don't see.

A report with the vulnerabilities prioritized by risk, evidence and concrete recommendations for iOS, Android and the backend.

Yes. After applying the fixes, we verify with a retest that the vulnerabilities are resolved.

Yes. We work under a confidentiality agreement and treat the app and data with the utmost confidentiality.