Mobile Application Penetration Testing
Intrix provides CREST-certified mobile application penetration testing for iOS and Android apps across Australia, identifying vulnerabilities in code, APIs, data storage, and communication channels. All testing is aligned to the OWASP Mobile Top 10 and conducted under a signed Statement of Work.
What Is Mobile App Penetration Testing?
Mobile application penetration testing evaluates the security of your iOS and Android applications by simulating attacks against the app, its backend APIs, data storage, and communication channels. Our testers assess your mobile app from the perspective of a malicious user or attacker who has downloaded it from the app store.
Improper Credential Usage
Inadequate Supply Chain Security
Insecure Authentication
Insufficient Input/Output Validation
Insecure Communication
OWASP Mobile Top 10 Alignment
Inadequate Privacy Controls
Insufficient Binary Protections
Security Misconfiguration
Insecure Data Storage
Insufficient Cryptography
What We Test
Client-Side Security
Local data storage, hardcoded credentials, certificate pinning, reverse engineering protections.
Authentication & Session Management
Login flows, token handling, session timeout, biometric
bypass.
Data in Transit
SSL/TLS implementation, certificate validation, man in-the-middle resistance.
API Security
Backend API endpoints, authorisation flaws, injection
vulnerabilities, rate limiting.
Data at Rest
Sensitive data stored on device, keychain/keystore
usage, clipboard exposure.
Platform-Specific Risks
iOS: entitlements, ATS configuration, jailbreak detection. Android: intent handling, content providers, root detection.
Our Methodology
1
Static Analysis
2
Dynamic Analysis
3
API Testing
4
Platform Testing
5
Analysis
6
Reporting
Frequently Asked Questions
Intrix provides CREST-certified mobile application penetration testing for iOS and Android apps across Australia, aligned to the OWASP Mobile Top 10. Testing covers client-side security, API security, authentication, data storage, and communication channels. Contact Intrix on 1300 931 727 to scope your engagement.
Do you test both iOS and Android?
Yes, when authorised. We operate under a signed Statement of Work with clear rules of engagement, authorised scope, and emergency contacts. Our testers carry authorisation letters at all times.
Do you need the source code to test our app?
Source code is not always required. We can perform mobile application testing using the installed application (black-box testing). However, having access to the source code can allow for deeper analysis and more thorough security testing.
How long does mobile app testing take?
The testing duration depends on the complexity and size of the application. Small apps may take a few days to test, while larger or more complex applications may require one to two weeks or more for a complete assessment.
Can you test apps not yet published to the app store?
Yes, we can test applications that are still in development or not yet published. Testing during the development phase helps identify and fix security vulnerabilities before the app is released to the public.
Will testing affect our production environment?
Our testing methods are designed to minimize disruption. When testing production systems, we coordinate closely with your team and follow controlled procedures to ensure the stability and availability of your application while the assessment is performed.
Protect Your Mobile Applications
Book a mobile application penetration test with Intrix. Call 1300 931 727.