Mobile Application Penetration Testing
OWASP MASVS-based security testing for your Android and iOS apps and their backend services.
Services
Web Application Penetration Testing
Your web application is your shop window and often the easiest way in. We test it along the paths an attacker would take, but in a controlled and authorised way.
Automated scanners catch known patterns, but they miss business logic flaws, such as a user being able to view another customer's order or redeem a discount code without limit. That is why our testing is predominantly manual.
We test as an unauthenticated visitor and with user roles at different privilege levels. You see what an external attacker could do as well as what a malicious user could do.
What we test
- Authentication, password reset, multi-factor authentication and session management
- Access control flaws (IDOR, horizontal and vertical privilege escalation)
- SQL, NoSQL, command and template injection; XSS and CSRF
- Business logic: payment, basket, coupon and order flows
- File uploads, SSRF, XXE and insecure deserialisation
- Security headers, TLS configuration and sensitive data exposure
How we work
Reconnaissance
We map the application and identify roles, endpoints and the technologies in use.
Analysis
We tailor OWASP WSTG test cases to your application and combine automated and manual testing.
Controlled exploitation
We demonstrate the real impact of findings without harming data or availability.
Reporting and retest
We prioritise remediation advice and retest once fixes are in place.
What you receive
- Executive summary and risk overview
- Technical findings with screenshots and reproduction steps
- CVSS v4.0 scores and OWASP mapping
- Developer-oriented remediation guidance
A good fit for
- E-commerce sites and booking systems
- SaaS products and customer portals
- New releases before go-live
Frequently asked questions
Will testing affect our live system?
We test within an agreed time window and never run denial-of-service attacks. Where possible, we recommend a staging environment that mirrors production.
Do you need our source code?
No. Our default approach is grey-box testing, so test accounts are enough. If you share source code, some findings can be confirmed faster and in more depth.
How long does it take?
It depends on the size of the application and the number of roles. A small site may take a few days, a large platform a few weeks. We confirm the duration in the proposal.
Related services
API Penetration Testing
Testing for your REST and GraphQL APIs, focused on authorisation, business logic and data exposure.
External Network Penetration Testing
An attacker's view of your internet-facing servers, services and remote access points.
See your weaknesses before attackers do.
Let's define the scope together. You'll receive a written proposal with the right type of test and a clear timeline.