Skip to content

iOS app penetration testing

An iOS app penetration test checks whether your iPhone or iPad app protects user data on the device, in transit and in the backend it talks to. Mr Cyber tests storage, authentication, the app's API and platform features against OWASP MASVS and MASTG, by hand, at a fixed price, with a free retest.

Fixed price from €2,900 · 3 test days · retest included

See my fixed price

Prefer to talk first? Book a call

Admin & Söhne Sign in AdminSoehne.app Info.plist Assets.car config.json "apiKey": AS-7f3c…e91 every request from the app api.admin-soehne.example X-Api-Key: AS-7f3c…e91
Inside the app bundle: a hard-coded key that also opens the backend.
  • 3–8 test days3 test days in the starting price
  • OWASP MASVS+ 4 more standards
  • Report + debriefwithin 5 business days
  • Free retestwithin 60 days

Who it’s for

  • Companies whose app handles customer, health or payment data
  • B2B apps that enterprise customers roll out to their staff
  • Teams preparing for ISO 27001, SOC 2, NIS2 or a customer audit
  • Apps before a major release, a new login flow or a new backend

What we test

Data on the device

  • Storage of tokens, credentials and personal data
  • Keychain, caches, logs and backups
  • What stays behind after logout

Login & sessions

  • Login, MFA and biometric unlock
  • Session lifetime and token handling
  • SSO and OAuth flows in the app

Network & backend

  • Transport security and certificate validation
  • Authorisation in the backend API
  • Data the app sends to third parties

Platform & app code

  • Deep links, URL schemes and app extensions
  • Permissions and privacy settings
  • Secrets and keys built into the app

Resilience

  • Jailbreak detection and anti-tampering, if you rely on them
  • Protection of business logic in the client
See my fixed price

Prefer to talk first? Book a call

How we test your iOS app. Five phases, one tester.

The same senior tester from first scope to retest.

test days in the starting price
3
business days to the report
5
days for the free retest
60

Typically 3–8 testing days, depending on features, roles and whether the backend API is in scope.

  1. Phase 1

    Scope & start date

    Price and start date online, or a call. NDA, signed scope and written authorisation come before any testing.

    You pick the date

  2. Phase 2

    App analysis

    App build, local storage and traffic examined.

    Test day 1

  3. Phase 3

    App + API testing

    The app and its backend tested together.

    From test day 2

  4. Phase 4

    Report & debrief

    Audit-ready report and ticket file, then a call.

    Within 5 business days

  5. Phase 5

    Free retest

    Your fixes tested again and confirmed in writing.

    Within 60 days

Methodology & standards

  • OWASP MASVS
  • OWASP MASTG
  • OWASP Mobile Top 10
  • OWASP API Security Top 10 (2023)
  • CVSS 3.1

How we test iOS apps

We start by using the app the way your customers do, then map which data it stores, which backend calls it makes and which roles exist. Each area is then checked by hand against the OWASP Mobile Application Security Verification Standard (MASVS), with the MASTG as the test guide.

App and backend together

Most serious mobile findings sit in the API behind the app. If the backend is in scope, we test it with the same accounts, so you see the full picture in one report.

Critical findings don’t wait for the report

If we find something critical during testing, you hear from us the same day, with enough detail for your team to start fixing.

Results mapped to MASVS

Every finding is linked to the MASVS control it affects and scored with CVSS 3.1 (4.0 on request) plus a business-risk rating. Your developers know what to fix first, and your auditors see which controls were checked.

What you get

  • Executive summary for management and auditors
  • Every finding with reproduction steps, evidence and fix guidance
  • Findings mapped to OWASP MASVS controls
  • CVSS 3.1 scoring plus business-risk rating and remediation priorities
  • Debrief call with your app and backend developers
  • Free retest and updated report

Always included

  • Free retest within 60 days
  • Debrief call with your team
  • NDA, DPA and testing authorisation with the offer
  • Critical findings reported the same day
  • Testing stops at any time on your call
  • Audit-ready report (PDF)
  • Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub
  • Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42
See my fixed price See the report
Pentest report · Admin & Söhne GmbH · MC-2026-016
Risk: High CVSS 3.1 · 8.2 Open · retest included

Key inside the app lets anyone send push messages to all customers

Admin & Söhne iOS app · customer messaging service

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Description

The app contains the secret key for the service that sends push messages to customers. Anyone who downloads the app from the App Store can extract it. The key is not limited to the app’s own needs: it can send any message to every customer’s phone and read the customer contact list with names, email addresses and mobile numbers.

Steps to reproduce

  1. Download the public app from the App Store onto a test device.
  2. Inspect the app package: the key for the messaging service is stored in it.
  3. Check the key’s rights with the client’s admin: it can read all customer contacts and send to all devices.
App package: settings file holds the messaging key (shortened)
Key rights: read customer contacts = yes · send to all devices = yes
Customer contacts readable: 48,210 (name, email, mobile)

Business impact

A fake “Your parcel is waiting, please pay 1.99 EUR” message from your own app reaches every customer. Customers lose money and trust, your ratings and support desk take the hit, and the readable contact list is a GDPR breach, reportable within 72 hours.

Remediation

Revoke the key now and issue a new one that stays on the server. Let the app ask your own backend to send messages, never the messaging service directly. Give each key only the rights it needs, and add a check to the build that fails when a secret is found in the app package.

OWASP Mobile Top 10 2024: M1 Improper Credential Usage · CWE-798 (Use of Hard-coded Credentials) · OWASP MASVS-STORAGE

Fixed price from

€2,900

3 test days · report in 5 business days · retest included

Services exclusively for businesses. · What drives the price

See my fixed price

Prefer to talk first? Book a call

Frequently asked questions

How much does an iOS app penetration test cost?
Fixed prices start at €2,900 for one app on one platform with one or two user roles. Including the backend API, more roles or a second platform adds effort. The quote form shows your binding fixed price instantly, and the written offer (PDF) is sent to you by email right after your request.
What do you need from us?
A current build (IPA or a TestFlight invite), test accounts for each role, the API environment the app talks to and a contact for emergencies. Source code is optional.
Do you test Android at the same time?
Yes, if you have both. Each platform is tested on its own, because storage and platform features differ. The shared backend API is tested once.
Will the test affect our live users?
No. We test with our own test accounts, ideally against a staging backend. If production is in scope, test windows and excluded actions are agreed upfront.
How is this different from an automated app scan?
A scanner checks the app file for known patterns. A tester also checks how the app and backend behave together, for example whether one user can reach another user's data. That is where the serious findings usually are.

Related services

NIS2 & Compliance

iOS app pentest: your fixed price in seconds

Pick one to start your request. You get your binding fixed price instantly, and the written offer (PDF) by email right after your request.

See my fixed price

Prefer to talk first? Book a call