Mobile application penetration testing

Identify your mobile application vulnerabilities such as authentication and authorization errors, data leakage and improper session handling.

Talk with Expert

two workers discussing about programming code

Assess your mobile app security vulnerability

In the present day, Mobile applications is a critical component to any business and is at the core for customers interacting with the brand, and associated services and products. Consumers spend most of their digital time on their smartphones, while trusting applications with their sensitive and personal information.

AXO’s penetration testing team are trained to conduct a range of mobile application assessments across Android, iOS, Windows, BlackBerry and other common mobile operating systems.

The top threats to your mobile security

Whether your organisation is a developer of mobile apps or a business that relies on the use of mobile applications or devices to perform critical functions across the workplace, AXO help you to identify and remediate vulnerabilities that could lead to assets and valuable data from being compromised. Common mobile security risks include:

Weak server side controls

Insecure Data Storage

Insufficient Transport Layer Protection

Unintended Data Leakage

Poor Authorisation and Authentication

Broken Cryptography

Client Side Injection

Security Decisions Via Untrusted Inputs

Improper Session Handling

Lack of Binary Protections

API Vulnerabilities

Hybrid Approach

Combine automated tools and manual vulnerability assessments to produce a comprehensive code review methodology. Manual code review reaches the spaces an automated tool cannot analyze and verifies findings to reduce the number of false positives.

Our approach to infrastructure penetration testing

AXO penetration testing network assessment follows a tried and tested methodology to identify, exploit and help address vulnerabilities:

Reconnaissance & intelligence gathering

AXO will gather information. This information will include the in-scope application binaries, any applicable IP addresses and URLs for in-scope API servers, authentication credentials, and a list of any sensitive or restricted portions of the application that shouldn’t be scanned or exploited.

Reconnaissance

Open-source intelligence gathering, which includes a review of publicly available information and resources. The goal of this phase is to identify any sensitive information that may help during the following phases of testing, which could include email addresses, usernames, software information, user manuals, forum posts, etc.

Threat Modeling

Evaluate the types of threats that may affect the targets. The types of attacks and likelihood of these threats materializing will serve to inform risk rankings/priorities that are assigned to vulnerabilities throughout the assessment. The perspective of the testing (external, internal, authenticated, unauthenticated, etc.) will also be identified to ensure the validity of vulnerabilities discovered.

Vulnerability Analysis

Using a combination of manual and automated tools, our mobile app testers conduct a full assessment of in-scope applications to identify security vulnerabilities such as SQL injection and cross-site scripting problems plus flaws in application logic and session management flows.

Exploitation

Taking all potential vulnerabilities identified in the previous phases of the assessment and attempting to exploit them as an attacker would. If successful exploitation of an in-scope application, database, or API server is achieved, analysis will continue, including infrastructure analysis, pivoting, sensitive data identification, data exfiltration, and identification of high-value targets/data. We’ll use the information collected here in the prioritization and criticality ranking of identified vulnerabilities.

Reporting and debrief

Once a mobile application security test is complete, we deliver a formal report and debrief outlining key findings, supplementary technical information, and a prioritised list of remedial actions to help address any identified risks and exposures.

Mobile application penetration testing

Assess your mobile app security vulnerability

The top threats to your mobile security

Hybrid Approach

Our approach to infrastructure penetration testing

Reconnaissance & intelligence gathering

Reconnaissance

Threat Modeling

Vulnerability Analysis

Exploitation

Reporting and debrief

Secure your mobile application

Address

Telephone

Email

Services

Product

Company