Mobile Application Security
iOS. Android. Hybrid. We analyze your mobile app against the OWASP Mobile Top 10, decompile the binary, instrument the runtime with Frida and uncover vulnerabilities that no automated scanner finds.
Organizations that trust AWARE7
iOS & Android
iOS and Android differ fundamentally in architecture, sandbox model and attack vectors. We know both in depth.
iOS
Objective-C / Swift
Jailbreak-based analysis
- Bypass of jailbreak detection via Frida/Objection, sandbox integrity checks, dylib injection simulation on physical devices.
Keychain dumping
- Extraction of keychain entries on jailbroken devices, checking accessibility flags (kSecAttrAccessibleAlways), Secure Enclave binding.
Binary analysis (otool, class-dump)
- Disassembly of ARM64 binaries, reconstructing method signatures via class-dump, extracting hardcoded strings and keys.
IPA reverse engineering
- Unpacking and analyzing IPA archives, plist configurations, examining embedded frameworks and third-party SDKs.
App Transport Security
- Reviewing ATS exceptions in Info.plist, NSAllowsArbitraryLoads, domain-specific exceptions and minimum TLS version auditing.
Certificate pinning bypass
- SSL Kill Switch, Frida scripts and objection pinning disable for traffic interception even with pinning implemented.
Common with iOS: API communication analysis, local data storage, session management
Android
Java / Kotlin / APK
Root-based analysis
- Magisk root, su binary checks, RootBeer detection bypasses via Frida simulation and validation of protection measures.
APK decompilation (jadx)
- JADX and Apktool for source code reconstruction, restoring Java/Kotlin classes, extracting resources and assets.
Smali patching
- Direct manipulation of Smali code to disable anti-tamper checks, bypass license checks or set debug flags.
Intent / content provider abuse
- Testing exported activities, services and broadcast receivers for unintended accessibility, intent injection and data exfiltration.
Certificate pinning bypass
- Frida scripts, TrustManager hooking and Magisk modules for interception of pinned traffic.
WebView vulnerabilities
- JavaScript interface injection, addJavascriptInterface, shouldOverrideUrlLoading, file access and universal XSS in embedded WebViews.
Common with Android: API communication analysis, local data storage, session management
We also fully test hybrid apps (React Native, Flutter, Xamarin). For React Native we analyze JavaScript bundles for hardcoded secrets and assess code obfuscation. Flutter apps are tested via Dart decompilation and native binary analysis. Xamarin apps receive a combined .NET and platform-native test. In all cases we conduct full OWASP MASVS-compliant testing.
OWASP Mobile Top 10:2024
The OWASP Mobile Top 10 is the international reference framework for mobile app security. Every finding in our report is mapped to one of these categories.
Description
Hardcoded API keys, passwords and certificates in the binary and configuration files. We systematically extract all secrets from the app bundle - strings, embedded resources, configuration files and compiled code.
Description
Vulnerable third-party libraries, insecure SDK integrations and compromised build pipelines. We inventory all dependencies and check them against known CVEs.
Description
Weak authentication logic, missing biometric protection, client-side authorization checks and bypassable login flows. We test all auth mechanisms for circumventability via Frida and manipulated requests.
Description
Missing validation of user inputs and API responses leads to injection attacks in SQLite databases, WebView XSS and content provider injections. Every input channel is tested for injection vectors.
Description
Missing certificate pinning, insecure TLS configurations, mixed HTTP/HTTPS connections and excessive data sharing with third-party SDKs. We intercept all network traffic.
Description
Excessive permission requests, unjustified collection of sensitive data (location, contacts, microphone) and flawed GDPR privacy implementations. We audit the permission model and data flows.
Description
Missing code obfuscation, disabled ASLR/PIE, missing stack canary, no tamper detection. We check all binary protections and test their actual effectiveness against Frida hooking.
Description
Debug flags in production, excessive logging output, exported Android components without protection, flawed AndroidManifest configurations and insecure backup settings.
Description
Auth tokens, personal data and payment information stored in cleartext in SharedPreferences, plist files, SQLite databases and app backups. We check all storage locations for encryption and access control.
Description
Outdated cryptographic algorithms (MD5, SHA-1, DES), self-implemented cryptography, insecure key management and predictable IV/nonce generation. We audit all cryptographic operations.
API & Backend
Most critical vulnerabilities in mobile apps lie not in the app itself, but in the backend. We test both - and the interaction between app and server.
REST & GraphQL API testing
Full mapping of all API endpoints directly from app analysis. We test for missing authorization, BOLA/IDOR vulnerabilities and excessive data exposure.
Authentication token security
JWT vulnerabilities (alg:none, weak secrets), OAuth flows, session invalidation, token lifetime and refresh token security in the mobile context.
Rate limiting & business logic
Brute-force protection on login and payment endpoints, quantity manipulation, price manipulation and race conditions in time-sensitive API operations.
Server-side injection
SQL injection, NoSQL injection, SSRF and XXE via mobile API parameters - particularly relevant for APIs developed primarily for mobile clients.
API Endpoint Discovery - Example
Automatically mapped from app traffic, manually verified.
Methodology
OWASP MASVS and OWASP MASTG-compliant methodology - transparently documented, every step traceable.
Reverse engineering of the app binary or APK without execution. We reconstruct the source code, analyze configuration files, search for hardcoded secrets and audit embedded third-party libraries for known CVEs. Obfuscation is addressed through deobfuscation techniques.
JADX · Apktool · MobSF · Hopper · Ghidra · strings
The app is run on real jailbroken/rooted devices. We instrument the process with Frida at runtime, hook authentication functions, read memory regions and bypass anti-tamper mechanisms. SSL pinning bypasses enable full traffic interception.
Frida · Objection · Burp Suite · Cycript · mitmproxy
The app backend is tested both separately and in conjunction with the app. We map all API endpoints from app traffic, check authorization at endpoint and resource level, search for IDOR/BOLA vulnerabilities and test for injection attacks and business logic flaws.
Burp Suite Pro · Postman · SQLMap · OWASP ZAP
Pricing & Packages
No hourly rate risk. No surprise costs. Binding fixed-price quote within 24 business hours after the free initial consultation.
Single Platform
iOS or Android
from 6,000 EUR
excl. VAT
5-8 business days
Recommended · Dual Platform
iOS + Android
from 10,000 EUR
excl. VAT
8-12 business days
Enterprise
App + API + Backend
from 15,000 EUR
excl. VAT
12-18 business days
Included in every package
All prices are indicative. The binding fixed-price quote is provided after the free initial consultation - within 24 business hours.
Compliance & Standards
Mobile apps face growing regulatory pressure. Our pentest report is designed as evidence for audits, supervisory authorities and certifications.
App Store Security
Apple App Store Review Guidelines and Google Play Protect check for privacy and security violations. Our pentest proactively identifies store-relevant vulnerabilities before submission, reducing the risk of rejections or bans.
GDPR Art. 25
GDPR Article 25 requires data protection by design. Mobile apps process highly sensitive data - location, contacts, biometrics. Our report documents technical safeguards as evidence of appropriate technical measures for data protection audits and supervisory authorities.
ISO 27001
ISO 27001:2022 Control A.8.8 requires active management of technical vulnerabilities. Our mobile app pentest provides structured, CVSS-rated findings that directly support vulnerability management and demonstrate compliance to certification auditors.
PSD2
PSD2 requires strong customer authentication (SCA) and dynamic linking for financial apps. We test PSD2-relevant controls: biometric security, transaction binding, app integrity and anti-fraud mechanisms - following EBA guidelines on mobile security.
Why AWARE7 for your mobile app pentest
Pure awareness platforms don't test systems. Pure consulting firms are too far removed. AWARE7 combines both: we hack your infrastructure and train your employees: tailored to mid-sized companies, personal, without enterprise overhead.
Around 20% of our revenue comes from research projects for the BSI and the BMBF. Our studies, published at ACM and Springer conferences, analyse millions of websites and tens of thousands of phishing emails. Three of our executives are professors at German universities at the same time.
From first contact to final report, your data is stored on our own servers in Germany - no US cloud providers, no third-country transfers. Our AI also runs on our own hardware in Germany - with locally operated open-source models. Client and project data never reach external AI services. All staff are permanently employed, covered by social insurance and bound by uniform legal obligations.
More on digital sovereigntyWithin 24 hours you receive a binding fixed-price quote without hourly rate risk. A well-practised team and standardised processes ensure a clear schedule with a defined start and end date.
A personal project manager accompanies you from the first meeting to the retest. You book appointments directly with your contact person and keep the same contact throughout the project.
Peer-reviewed publications
Different Seas, Different Phishes - Large-Scale Analysis of Phishing Simulations
ACM AsiaCCS 2025
Oskar Braun, Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
A Platform for Physiological and Behavioral Security
NSPW 2025
Jan Hörnemann
Privacy from 5 PM to 6 AM: Tracking and Transparency in the HbbTV Ecosystem
IEEE/IFIP DSN 2025
Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
Understanding Regional Filter Lists: Efficacy and Impact
PoPETS 2025
Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
Who is AWARE7 the right partner for?
Mid-sized companies with 50-2,000 employees
Companies that need real security, without paying for a DAX-corporation provider. Fixed price, clear scope, one point of contact.
IT managers & CISOs
Who have to argue convincingly in-house and need a report in boardroom language for that, not just technical findings.
Regulated industries
Critical infrastructure, healthcare, financial services: NIS-2, ISO 27001, DORA. We know the requirements and deliver evidence that auditors accept.
References
These case studies are available in German.
How it works
Three steps. No hidden effort. No surprises.
In a 30-minute call we clarify your specific use case: platforms, app complexity, special requirements (e.g. compliance, CI/CD integration). You receive a binding fixed-price quote within 24 business hours.
Duration: 30 minutes
After contract signing and kick-off our team starts immediately. You provide build artifacts and test accounts. We test in an isolated environment and report critical findings proactively - without waiting for the final report.
Duration: 5-18 business days per package
You receive the complete final report with management summary, technical findings and remediation roadmap. After fixing vulnerabilities we conduct the retest and issue a verification addendum - as evidence for auditors.
Including retest certificate
FAQ
Aus dem Blog
Firefox Focus für iOS blockt nicht nur Werbung, sondern auch Analyse und soziale Tracker. So bleibt eure Privatsphäre erhalten und deine Daten deine!
Chris Wojzechowski 
Wer gerne anonym im Internet unterwegs ist oder das Darknet verwenden möchte, kommt am Tor Browser nicht vorbei. Aber gibt es den Tor Browser auch für iOS?
Vincent Heinen 
Mobile Security: MDM mit Intune/Jamf, OWASP MASVS, mobile Angriffe (Pegasus, Evil Twin) und sichere BYOD-Richtlinien für Unternehmen.
Vincent Heinen We analyze your iOS or Android app and deliver clear, reproducible findings. Fixed-price quote within 24 business hours after the initial consultation.
Free · 30 minutes · No obligation
Certifications & Standards
OWASP Mobile Top 10 · OWASP MASVS · OWASP MASTG · OSCP-Certified · ISO 27001 · CVSS 4.0
Arturs Nikitins
Initial consultation & needs analysis
Looking for personal advice?
No obligation · Reply within 24h on business days
