--- title: "Android App Penetration Testing to OWASP MASVS | Mr Cyber" url: https://mr-cyber.com/services/android-app-penetration-testing language: en description: "Manual Android app pentests to OWASP MASVS. Device data, login, backend API and app components. Fixed price from €2,900, report in 5 business days." --- # Android app penetration testing An Android app penetration test checks whether your app protects user data on the device, in transit and in the backend it talks to. Mr Cyber tests storage, authentication, exported app components and the app's API against OWASP MASVS and MASTG, by hand, at a fixed price, with a free retest. Fixed price **from €2,900** · 3 test days · retest included [See my fixed price](https://mr-cyber.com/quote?service=android) Prefer to talk first? [Book a call](https://mr-cyber.com/contact#book) Unpacked from the APK: a backend key in plain text, sent with every request. - **3–8 test days**3 test days in the starting price - **OWASP MASVS**\+ 4 more standards - **Report + debrief**within 5 business days - **Free retest**within 60 days ## Who it’s for - Companies whose app handles customer, health or payment data - B2B apps that enterprise customers roll out on managed devices - Teams preparing for ISO 27001, SOC 2, NIS2 or a customer audit - Apps before a major release, a new login flow or a new backend ## What we test ### Data on the device - Storage of tokens, credentials and personal data - Shared preferences, databases, logs and backups - What stays behind after logout ### Login & sessions - Login, MFA and biometric unlock - Session lifetime and token handling - SSO and OAuth flows in the app ### Network & backend - Transport security and certificate validation - Authorisation in the backend API - Data the app sends to third parties ### Platform & app components - Activities, services and content providers exposed to other apps - Deep links, intents and WebViews - Permissions and secrets built into the app ### Resilience - Root detection and anti-tampering, if you rely on them - Protection of business logic in the client ## How we test your Android app. Five phases, one tester. The same senior tester from first scope to retest. test days in the starting price 3 business days to the report 5 days for the free retest 60 Typically 3–8 testing days, depending on features, roles and whether the backend API is in scope. 1. Phase 1 ### Scope & start date Price and start date online, or a call. NDA, signed scope and written authorisation come before any testing. You pick the date 2. Phase 2 ### App analysis App build, local storage and traffic examined. Test day 1 3. Phase 3 ### App + API testing The app and its backend tested together. From test day 2 4. Phase 4 ### Report & debrief Audit-ready report and ticket file, then a call. Within 5 business days 5. Phase 5 ### Free retest Your fixes tested again and confirmed in writing. Within 60 days ## Methodology & standards - OWASP MASVS - OWASP MASTG - OWASP Mobile Top 10 - OWASP API Security Top 10 (2023) - CVSS 3.1 ## How we test Android apps We start by using the app the way your customers do, then map which data it stores, which components it exposes to other apps, which backend calls it makes and which roles exist. Each area is then checked by hand against the [OWASP Mobile Application Security Verification Standard (MASVS)](https://mas.owasp.org/MASVS/), with the MASTG as the test guide. ### App and backend together Most serious mobile findings sit in the API behind the app. If the backend is in scope, we test it with the same accounts, so you see the full picture in one report. ### Critical findings don’t wait for the report If we find something critical during testing, you hear from us the same day, with enough detail for your team to start fixing. ### Results mapped to MASVS Every finding is linked to the MASVS control it affects and scored with **CVSS 3.1** (4.0 on request) plus a business-risk rating. Your developers know what to fix first, and your auditors see which controls were checked. ## What you get - Executive summary for management and auditors - Every finding with reproduction steps, evidence and fix guidance - Findings mapped to OWASP MASVS controls - CVSS 3.1 scoring plus business-risk rating and remediation priorities - Debrief call with your app and backend developers - Free retest and updated report ### Always included - Free retest within 60 days - Debrief call with your team - NDA, DPA and testing authorisation with the offer - Critical findings reported the same day - Testing stops at any time on your call - Audit-ready report (PDF) - Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub - Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42 Pentest report · Admin & Söhne GmbH · MC-2026-017 Risk: Medium CVSS 3.1 · 6.8 Open · retest included ### App accepts fake security certificates Admin & Söhne Android app · api.admin-soehne.example CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N #### Description When the Android app connects to the shop server, it does not check that the server’s security certificate is genuine. Someone on the same public Wi-Fi, for example in a café or on a train, can pretend to be the shop server. The app then sends them the customer’s password and session, and accepts changed answers. #### Steps to reproduce 1. Connect a test phone with the app to a test Wi-Fi network controlled by the tester. 2. Present the app with a self-made certificate for api.admin-soehne.example. 3. The app logs in without any warning, and the login data is visible to the tester. ``` App connection log (test device) TLS: certificate issuer "Tester Lab CA" (not trusted) → accepted POST /v2/login {"email":"test-a@…","password":""} ``` #### Business impact Customers who shop on public Wi-Fi can have their account taken over without noticing. Attackers can then see their orders and saved addresses, or place orders in their name. Every affected account holds a customer’s personal data, so each case is a GDPR-relevant incident. #### Remediation Remove the custom code that skips the certificate check and use Android’s standard secure connection settings. Consider certificate pinning for the shop API. Add a test to the release pipeline that fails if the app accepts an untrusted certificate. OWASP Mobile Top 10 2024: M5 Insecure Communication · CWE-295 (Improper Certificate Validation) · MITRE ATT&CK T1557 (Adversary-in-the-Middle) ## Fixed price from [€2,900](https://mr-cyber.com/quote?service=android) 3 test days · report in 5 business days · retest included Services exclusively for businesses. · [What drives the price](https://mr-cyber.com/pricing) ## Frequently asked questions How much does an Android app penetration test cost? Fixed prices start at €2,900 for one app on one platform with one or two user roles. Including the backend API, more roles or the iOS version adds effort. The quote form shows your binding fixed price instantly, and the written offer (PDF) is sent to you by email right after your request. What do you need from us? A current build (APK or AAB, or access through a closed test track), test accounts for each role, the API environment the app talks to and a contact for emergencies. Source code is optional. Do you test iOS at the same time? Yes, if you have both. Each platform is tested on its own, because storage and platform features differ. The shared backend API is tested once. Will the test affect our live users? No. We test with our own test accounts, ideally against a staging backend. If production is in scope, test windows and excluded actions are agreed upfront. How is this different from an automated app scan? A scanner checks the app file for known patterns. A tester also checks how the app and backend behave together, for example whether one user can reach another user's data. That is where the serious findings usually are.