Request a Demo
MOBILE APPLICATION PENTEST

Secure the apps your customers trust on their devices

Your mobile apps run outside your perimeter and store data where you cannot see it. Cobalt secures iOS and Android apps with platform-specific, human-led pentests on real devices, helping you protect your users, your backend, and your reputation.
THE CHALLENGE

Your app runs where you can't see it

Your mobile apps ship to your customers' devices and run on platforms you don't control. That is exactly where attackers meet them, and where typical web-oriented pentesting comes up short. More than 75% of published apps ship with at least one security vulnerability. 

  • Mobile apps cache sensitive data locally to stay fast. Anything left unencrypted on the device is exposed the moment a phone is compromised.
  • iOS and Android enforce security differently, so a control that holds on one platform can fail on the other. Testing has to account for both platforms.
  • The issues that matter most, from certificate pinning bypass to insecure data storage and snapshots only surface on real jailbroken and rooted devices, not in an emulator.


When a mobile app is compromised, three things are at risk at once: your backend and the web servers, billing systems, and PII behind it; your users and the payment and personal data on their phones; and your reputation as the app's publisher.

 

Source: ASEE, mobile app security statistics.

OUR APPROACH

A mobile-specific methodology, executed by expert pentesters

Cobalt tests mobile applications the way an attacker would, on real devices, against platform-specific controls. We follow our industry-leading methodology informed by OWASP MASVS. Human-led testing goes where automation cannot, while AI accelerates the work so pentesters spend their time on exploitation. 

Read the mobile application pentest methodology
map-light-full

Test on real devices

The Cobalt Core of experts tests on jailbroken iOS and rooted Android devices to surface client-side issues a virtual environment would never reveal.
radar-light-full

Bypass and intercept

Defeat certificate pinning, intercept and analyze web traffic, and probe client-side controls, including how the app handles auto-screenshots and snapshots.
folder-tree-thin-full

Analyze data at rest and in transit

Expert pentesters confirm what is actually exploitable, from injection, cross-site scripting, and IDOR to session attacks, cryptographic failures, and business logic abuse.
network-wired-light-full

Go deep on the code

Run static analysis on the application binary to flag outdated protocols, insecure third-party libraries, and code-level exposure across native, hybrid, and progressive apps.

Find and fix critical mobile application vulnerabilities

Cobalt mobile pentests uncover the vulnerability classes that define the mobile surface, including insecure data storage, snapshots, and inter-process communication, certificate and traffic weaknesses, and shared web and API resources. 
Example Exploit Finding


Mobile Pentesting (iOS and Android)
Mobile pentests assess iOS and Android applications for hardcoded secrets, insecure data storage, authentication weaknesses, and improper use of platform APIs.

HIGH (CVSS 9.3): Hardcoded Third-Party API Key in iOS Application Bundle Enables Unauthorized Access to Support Platform

Severity: High | CVSS: 9.3 | CWE: CWE-798 (Use of Hard-coded Credentials), CWE-200 (Exposure of Sensitive Information) | OWASP: Sensitive Data Exposure > Sensitive Data Hardcoded | Status: Pending Fix

Description

Mobile applications should never embed privileged API credentials within client-side code, as application packages can be extracted and reverse engineered by anyone. Secrets included within mobile application bundles should be considered publicly accessible and must not provide privileged access to backend services.

During testing, the iOS application was found to embed a third-party support platform API key within the React Native JavaScript bundle (main.jsbundle). By extracting the IPA package and inspecting the bundle, the API key was recovered in plaintext without requiring authentication, jailbreaking, or interaction with the production infrastructure.

Further validation confirmed that the exposed API key remained active and granted extensive access to the associated support platform environment. Using the credential, it was possible to enumerate support tickets, retrieve requester information, access ticket conversations, perform targeted ticket lookups using email addresses, and create new support tickets using arbitrary requester identities.

The assessment was limited to read-only operations and the creation of a single authorized test ticket. No production tickets were modified or deleted. Embedding a privileged API credential within a publicly distributed application exposes sensitive customer information and significantly increases the risk of unauthorized access to the organization's support infrastructure.

Affected Resources

  • [App Store URL] — publicly distributed iOS application
  • /api/v2/tickets, /api/v2/search/tickets, /api/v2/tickets/{id}/conversations, /api/v2/tickets?email={victim_email} — support platform API endpoints
  • Payload/[application].app/main.jsbundle — React Native bundle containing the hardcoded credential

Proof of Concept

Step 1: Extract the API Key

Extract the IPA file and navigate to Payload/[application].app/main.jsbundle. Open the bundle using a text editor and search for the support platform API key embedded within the JavaScript bundle.

Step 2: Verify Unauthorized Read Access

Use the extracted API key to query the support platform Search API:

  1. curl -s -u "<REDACTED_API_KEY>:X" -G \
  2. --data-urlencode "query=\"created_at>'2020-01-01'\"" \
  3. "https://[support-platform-domain]/api/v2/search/tickets" | jq '.total'

The API returns the total number of accessible support tickets, confirming unauthorized access to the support environment.

Step 3: Verify Access to Customer Information

Retrieve ticket data and requester information:

  1. curl -s -u "<REDACTED_API_KEY>:X" \
  2. "https://[support-platform-domain]/api/v2/tickets?per_page=20&include=requester"

Perform targeted lookups by requester email:

  1. curl -s -u "<REDACTED_API_KEY>:X" \
  2. "https://[support-platform-domain]/api/v2/tickets?email=<REDACTED_EMAIL>"

The API returns customer names, email addresses, phone numbers, ticket history, and associated conversations.

Step 4: Verify Unauthorized Write Access

Create an authorized test ticket using the exposed API key:

  1. curl -X POST -u "<REDACTED_API_KEY>:X" \
  2. -H "Content-Type: application/json" \
  3. -d '{
  4. "description": "Authorized pentest ticket - please delete",
  5. "subject": "Pentest - DO NOT ACTION",
  6. "email": "<TESTER_EMAIL>",
  7. "priority": 1,
  8. "status": 2
  9. }' \
  10. "https://[support-platform-domain]/api/v2/tickets"

The API returns HTTP 201 Created. The test ticket appears within the support portal, confirming unauthorized write access.

Impact

An attacker can extract the embedded API key from the publicly distributed iOS application and authenticate directly to the support platform API. Successful exploitation allows an attacker to read support tickets, retrieve requester names and contact information, access ticket conversations and support history, perform targeted searches for customer records, create fraudulent support tickets, abuse trusted support workflows, and conduct phishing or social engineering campaigns.

Because the exposed credential provides both read and write access, compromise of the API key poses significant risk to the confidentiality and integrity of the support platform.

Suggested Fix

  • Treat the exposed API credential as compromised and rotate it immediately.
  • Remove privileged credentials from the mobile application bundle.
  • Proxy support platform requests through a secure backend service that holds the API key server-side.
  • Apply the principle of least privilege by limiting API permissions to only what the mobile application requires.
  • Implement automated secret scanning during the development process (e.g., GitHub secret scanning, truffleHog).
  • Review the application bundle for any additional embedded credentials.
BENEFITS

Why teams choose Cobalt for mobile application pentest services

A Cobalt mobile app pentest closes the visibility gap with more than a methodology. You get elite specialists, an AI-powered platform, and findings that move straight into your workflow, all delivered through the Cobalt Offensive Security Platform.

Explore Platform Benefits

Specialized talent

The Cobalt Core of 500+ vetted pentesters have an average of 11 years of experience. You get specialists who know how iOS and Android actually break, not a generalist running a checklist.

Exploitable findings, not scanner noise

Human judgment, accelerated by AI and informed by the industry's largest offensive security dataset, determines what is truly exploitable. Every finding is an exploitable vulnerability with reproduction steps and remediation guidance.

Built into your find-to-fix workflow

Collaborate with pentesters in real time via Slack, Microsoft Teams, or in-platform chat, and route findings into Jira, GitHub, and Azure DevOps with 50+ integrations. Findings are reported in real time and available for unlimited retesting within a 7-day SLA.

Audit-ready proof on demand

Some of the issues that come back are phenomenal, things I'd never think of. We're talking chained exploits and complex business logic issues that we could never find internally ourselves. The Cobalt pentesters go deep and find vulnerabilities that a real hacker in the wild could exploit.
RELATED SERVICES

Mobile security does not stop at the app

Mobile apps share APIs, authentication flows, and infrastructure with the rest of your environment. Test them together to close the gaps attackers exploit between systems.

CUSTOMER TESTIMONIALS

Trusted by security leaders

insurity-logo-1
Cobalt’s pentesters give us specialized talent, delivering exceptional value compared to maintaining the same talent in-house. And we don't just get one person, we get a team. We're ecstatic that we can have these highly talented pentesters with diverse skills and perspectives working on our applications.

Adam Davis

Director of Application Security, Insurity
heyjobs-logo-color
Cobalt provides a genuinely collaborative pentesting experience. Our team deeply appreciates the direct access to pentesters and the constant communication via Slack. This setup enables us to learn so much, as the pentesters clearly explain their findings and guide us on remediation.

Rodrigo Oliveira

Platform Engineering Lead, HeyJobs
FAQ

Frequently asked questions about mobile application pentesting

What is mobile application penetration testing?
Mobile application penetration testing is a controlled, authorized assessment of an iOS or Android app to find and confirm exploitable vulnerabilities before real attackers do. Unlike web testing, it evaluates the app on real devices and focuses on mobile-specific risks such as insecure local data storage, certificate pinning, inter-process communication, and platform controls. Cobalt delivers testing through elite Cobalt Core pentesters.
How is mobile app pentesting different from web app pentesting?
Mobile apps run on the device, outside your perimeter, and store data locally to stay fast. That creates risks web testing does not cover: insecure data storage on the file system, insecure snapshots, certificate pinning that must be bypassed, and platform-specific controls that differ between iOS and Android. Mobile testing also requires real jailbroken and rooted devices rather than emulators. Mobile apps still share APIs and authentication with your backend, so Cobalt tests those shared surfaces as well.
What methodology does Cobalt use for mobile pentesting?
Cobalt uses an industry-leading methodology informed by OWASP MASVS (Mobile Application Security Verification Standard), combined with the expertise of the Cobalt Core. Testing covers platform-specific controls on iOS and Android, real-device testing, certificate pinning bypass, web traffic interception, data storage analysis, static analysis of the application binary, and awareness of native, hybrid, and progressive app architectures.
Do you test both iOS and Android?
Yes. iOS and Android are built differently, with different security mechanisms and implementations. Cobalt tests both with platform-specific expertise, using jailbroken iOS and rooted Android devices so client-side behavior is tested the way an attacker would encounter it.
What kinds of vulnerabilities does a mobile pentest find?
Common findings include insecure data storage with sensitive information or secrets in plaintext, insecure snapshots that expose data such as unmasked payment details, insecure inter-process communication, certificate and traffic weaknesses, insecure use of platform APIs and SDKs, and the web and API vulnerabilities shared with the app's backend.
What does mobile app pentesting work well with?
Mobile pentesting pairs naturally with Web Application Pentest and API Pentest to cover shared APIs and authentication flows, and with Network or Cloud Pentest to secure the environment hosting the app. Many teams combine these into a continuous Offensive Security Program on the Cobalt Platform.
RESOURCES

The latest from Cobalt

GET STARTED

Make sure your customers' devices can't be turned against them

Secure your iOS and Android apps with platform-specific, human-led pentesting from the Cobalt Core.

product-screenshot-FPO2