Skip to content

Android app penetration testing

An Android app penetration test checks whether your app protects user data on the device, in transit and in the backend it talks to. Mr Cyber tests storage, authentication, exported app components and the app's API against OWASP MASVS and MASTG, by hand, at a fixed price, with a free retest.

Fixed price from €2,900 · 3 test days · retest included

See my fixed price

Prefer to talk first? Book a call

Admin & Söhne Sign in admin-soehne.apk AndroidManifest.xml classes.dex res/values/strings.xml api_key = AS-7f3c…e91 every request from the app api.admin-soehne.example Authorization: AS-7f3c…e91
Unpacked from the APK: a backend key in plain text, sent with every request.
  • 3–8 test days3 test days in the starting price
  • OWASP MASVS+ 4 more standards
  • Report + debriefwithin 5 business days
  • Free retestwithin 60 days

Who it’s for

  • Companies whose app handles customer, health or payment data
  • B2B apps that enterprise customers roll out on managed devices
  • Teams preparing for ISO 27001, SOC 2, NIS2 or a customer audit
  • Apps before a major release, a new login flow or a new backend

What we test

Data on the device

  • Storage of tokens, credentials and personal data
  • Shared preferences, databases, logs and backups
  • What stays behind after logout

Login & sessions

  • Login, MFA and biometric unlock
  • Session lifetime and token handling
  • SSO and OAuth flows in the app

Network & backend

  • Transport security and certificate validation
  • Authorisation in the backend API
  • Data the app sends to third parties

Platform & app components

  • Activities, services and content providers exposed to other apps
  • Deep links, intents and WebViews
  • Permissions and secrets built into the app

Resilience

  • Root detection and anti-tampering, if you rely on them
  • Protection of business logic in the client
See my fixed price

Prefer to talk first? Book a call

How we test your Android app. Five phases, one tester.

The same senior tester from first scope to retest.

test days in the starting price
3
business days to the report
5
days for the free retest
60

Typically 3–8 testing days, depending on features, roles and whether the backend API is in scope.

  1. Phase 1

    Scope & start date

    Price and start date online, or a call. NDA, signed scope and written authorisation come before any testing.

    You pick the date

  2. Phase 2

    App analysis

    App build, local storage and traffic examined.

    Test day 1

  3. Phase 3

    App + API testing

    The app and its backend tested together.

    From test day 2

  4. Phase 4

    Report & debrief

    Audit-ready report and ticket file, then a call.

    Within 5 business days

  5. Phase 5

    Free retest

    Your fixes tested again and confirmed in writing.

    Within 60 days

Methodology & standards

  • OWASP MASVS
  • OWASP MASTG
  • OWASP Mobile Top 10
  • OWASP API Security Top 10 (2023)
  • CVSS 3.1

How we test Android apps

We start by using the app the way your customers do, then map which data it stores, which components it exposes to other apps, which backend calls it makes and which roles exist. Each area is then checked by hand against the OWASP Mobile Application Security Verification Standard (MASVS), with the MASTG as the test guide.

App and backend together

Most serious mobile findings sit in the API behind the app. If the backend is in scope, we test it with the same accounts, so you see the full picture in one report.

Critical findings don’t wait for the report

If we find something critical during testing, you hear from us the same day, with enough detail for your team to start fixing.

Results mapped to MASVS

Every finding is linked to the MASVS control it affects and scored with CVSS 3.1 (4.0 on request) plus a business-risk rating. Your developers know what to fix first, and your auditors see which controls were checked.

What you get

  • Executive summary for management and auditors
  • Every finding with reproduction steps, evidence and fix guidance
  • Findings mapped to OWASP MASVS controls
  • CVSS 3.1 scoring plus business-risk rating and remediation priorities
  • Debrief call with your app and backend developers
  • Free retest and updated report

Always included

  • Free retest within 60 days
  • Debrief call with your team
  • NDA, DPA and testing authorisation with the offer
  • Critical findings reported the same day
  • Testing stops at any time on your call
  • Audit-ready report (PDF)
  • Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub
  • Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42
See my fixed price See the report
Pentest report · Admin & Söhne GmbH · MC-2026-017
Risk: Medium CVSS 3.1 · 6.8 Open · retest included

App accepts fake security certificates

Admin & Söhne Android app · api.admin-soehne.example

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

When the Android app connects to the shop server, it does not check that the server’s security certificate is genuine. Someone on the same public Wi-Fi, for example in a café or on a train, can pretend to be the shop server. The app then sends them the customer’s password and session, and accepts changed answers.

Steps to reproduce

  1. Connect a test phone with the app to a test Wi-Fi network controlled by the tester.
  2. Present the app with a self-made certificate for api.admin-soehne.example.
  3. The app logs in without any warning, and the login data is visible to the tester.
App connection log (test device)
TLS: certificate issuer "Tester Lab CA" (not trusted) → accepted
POST /v2/login  {"email":"test-a@…","password":"<visible>"}

Business impact

Customers who shop on public Wi-Fi can have their account taken over without noticing. Attackers can then see their orders and saved addresses, or place orders in their name. Every affected account holds a customer’s personal data, so each case is a GDPR-relevant incident.

Remediation

Remove the custom code that skips the certificate check and use Android’s standard secure connection settings. Consider certificate pinning for the shop API. Add a test to the release pipeline that fails if the app accepts an untrusted certificate.

OWASP Mobile Top 10 2024: M5 Insecure Communication · CWE-295 (Improper Certificate Validation) · MITRE ATT&CK T1557 (Adversary-in-the-Middle)

Fixed price from

€2,900

3 test days · report in 5 business days · retest included

Services exclusively for businesses. · What drives the price

See my fixed price

Prefer to talk first? Book a call

Frequently asked questions

How much does an Android app penetration test cost?
Fixed prices start at €2,900 for one app on one platform with one or two user roles. Including the backend API, more roles or the iOS version adds effort. The quote form shows your binding fixed price instantly, and the written offer (PDF) is sent to you by email right after your request.
What do you need from us?
A current build (APK or AAB, or access through a closed test track), test accounts for each role, the API environment the app talks to and a contact for emergencies. Source code is optional.
Do you test iOS at the same time?
Yes, if you have both. Each platform is tested on its own, because storage and platform features differ. The shared backend API is tested once.
Will the test affect our live users?
No. We test with our own test accounts, ideally against a staging backend. If production is in scope, test windows and excluded actions are agreed upfront.
How is this different from an automated app scan?
A scanner checks the app file for known patterns. A tester also checks how the app and backend behave together, for example whether one user can reach another user's data. That is where the serious findings usually are.

Related services

NIS2 & Compliance

Android app pentest: your fixed price in seconds

Pick one to start your request. You get your binding fixed price instantly, and the written offer (PDF) by email right after your request.

See my fixed price

Prefer to talk first? Book a call