On this page
Users trust apps with their money, health data and identity documents, and attackers know a mobile app ships its code to every device that installs it. Anything the app stores, sends or hides can be examined. This checklist is what our testers work through on a mobile app VAPT engagement.
Scoping a mobile app pentest
- Get the builds. The APK or AAB and the IPA for the version you will release, ideally both a debug and a release build.
- List the back-end APIs the app calls, with documentation if it exists. They are part of the test.
- Create test accounts for each role, with at least two users so access between users can be tested.
- Decide on resilience testing. Banking, payments and apps handling high-value data usually need anti-tampering and reverse-engineering checks; many others do not.
- Agree the environment, test payment cards and any third-party services that should not be triggered.
The MASVS checklist
MASVS-STORAGE: data stored on the device
- Look for sensitive data in shared preferences, plists, SQLite databases, files and caches
- Check that tokens and keys use the Android Keystore or iOS Keychain correctly
- Inspect logs, crash reports, screenshots in the app switcher and the clipboard
- Check backups for sensitive data that should not leave the device
MASVS-CRYPTO: cryptography
- Find hardcoded keys, secrets and API credentials in the app package
- Check for weak or deprecated algorithms and modes, and predictable random numbers
- Confirm keys are generated and stored using platform keystores
MASVS-AUTH: authentication and authorization
- Test login, MFA, biometric unlock and session handling, including whether biometrics are tied to a cryptographic key
- Check token lifetime, refresh and revocation on logout
- Confirm authorisation is enforced by the server, not by hidden buttons in the app
MASVS-NETWORK: network communication
- Intercept traffic and confirm TLS is used everywhere with proper certificate validation
- Check certificate pinning where the risk justifies it, and whether it can be trivially bypassed
- Test the APIs the app calls against the OWASP API Top 10 checklist
MASVS-PLATFORM: platform interaction
- Test deep links and app links for unauthorised actions
- Check exported Android components, intents and content providers
- Review WebViews for JavaScript bridges and loading untrusted content
- Check permissions requested against what the app actually needs
MASVS-CODE: code quality
- Look for outdated third-party libraries with known vulnerabilities
- Test input handling for injection in local databases and WebViews
- Check whether the app enforces updates for insecure versions
MASVS-RESILIENCE: resistance to reverse engineering and tampering
- Check obfuscation and whether business logic or secrets are easy to read
- Test root, jailbreak, emulator, debugger and hooking detection, and how easily it is bypassed
- Check integrity checks against repackaged or modified apps
MASVS-PRIVACY: privacy
- Compare data collected and shared with what the privacy policy and store labels say
- Check third-party SDKs for data sent to analytics and advertising services
- Confirm users can control optional data collection
Android vs iOS: what changes
| Area | Android | iOS |
|---|---|---|
| Secure storage | Android Keystore, EncryptedSharedPreferences | Keychain with appropriate accessibility settings |
| Inter-app attack surface | Exported activities, services, receivers and content providers | URL schemes, universal links, app extensions |
| Test device | Rooted device or emulator | Jailbroken device |
| Common finding | Exported components and insecure WebView settings | Sensitive data in plists, caches and logs |
What a useful mobile pentest report includes
Each finding should name the platform and build, show the evidence (screenshots, requests, extracted data), explain the impact in business terms, give a fix for the right platform and map to the MASVS control. The report should separate app-side issues from API issues, because different teams usually fix them, and include a retest section. Read what makes a VAPT report worth paying for.
How Summit tests mobile apps
Summit’s mobile app VAPT covers Android and iOS builds and the APIs behind them, using the OWASP MASVS and MASTG. Our testers work on rooted and jailbroken devices, intercept and manipulate traffic, test authorisation with real accounts, and add source code review where you want deeper assurance. Every finding is verified by hand and retested after you fix it.
Shipping a new app release?
Send us the builds and API documentation and we will scope a mobile test within a day. Get a quote.
Related reading: API penetration testing checklist · Types of penetration testing · VAPT for SaaS startups
Frequently asked questions
What is OWASP MASVS?
The OWASP Mobile Application Security Verification Standard. It defines the security controls a mobile app should meet, grouped into storage, cryptography, authentication and authorization, network communication, platform interaction, code quality, resilience against reverse engineering and privacy. The companion OWASP MASTG explains how to test each one.
What is the difference between MASVS and MASTG?
MASVS says what a secure app should do; the Mobile Application Security Testing Guide (MASTG) describes how to test it on Android and iOS, with tools and techniques for each control.
What does a mobile app penetration test include?
Static analysis of the app package, dynamic testing on rooted or jailbroken devices, traffic interception and testing of the back-end APIs, checks of local data storage, authentication and session handling, platform features such as deep links and permissions, and, where needed, resilience against tampering and reverse engineering.
Do I need to test both Android and iOS?
Yes, if you ship both. The platforms store data, handle permissions and protect binaries differently, and cross-platform frameworks still produce separate native packages. Issues found on one often do not exist on the other, and the reverse.
Is testing the mobile app enough, or do the APIs need testing too?
The APIs need testing too. Most serious mobile findings are in the back end the app talks to, such as other users' data returned by an API. A good mobile test includes the APIs the app calls.
How long does a mobile app penetration test take?
Typically five to ten working days for one app on both platforms with its APIs, plus reporting and a retest. Apps with payments, many roles or strong anti-tampering take longer.
Faisal Khan is a Director at Summit, where he oversees penetration testing, risk assessment and compliance engagements for SaaS and enterprise clients. Case studies are anonymised and published with client permission.
