--- title: "iOS App Penetration Testing to OWASP MASVS | Mr Cyber" url: https://mr-cyber.com/services/ios-app-penetration-testing language: en description: "Manual iOS app pentests to OWASP MASVS. Data on the device, login, backend API and privacy. Fixed price from €2,900, report in 5 business days." --- # iOS app penetration testing An iOS app penetration test checks whether your iPhone or iPad app protects user data on the device, in transit and in the backend it talks to. Mr Cyber tests storage, authentication, the app's API and platform features against OWASP MASVS and MASTG, by hand, at a fixed price, with a free retest. Fixed price **from €2,900** · 3 test days · retest included [See my fixed price](https://mr-cyber.com/quote?service=ios) Prefer to talk first? [Book a call](https://mr-cyber.com/contact#book) Inside the app bundle: a hard-coded key that also opens the backend. - **3–8 test days**3 test days in the starting price - **OWASP MASVS**\+ 4 more standards - **Report + debrief**within 5 business days - **Free retest**within 60 days ## Who it’s for - Companies whose app handles customer, health or payment data - B2B apps that enterprise customers roll out to their staff - Teams preparing for ISO 27001, SOC 2, NIS2 or a customer audit - Apps before a major release, a new login flow or a new backend ## What we test ### Data on the device - Storage of tokens, credentials and personal data - Keychain, caches, logs and backups - What stays behind after logout ### Login & sessions - Login, MFA and biometric unlock - Session lifetime and token handling - SSO and OAuth flows in the app ### Network & backend - Transport security and certificate validation - Authorisation in the backend API - Data the app sends to third parties ### Platform & app code - Deep links, URL schemes and app extensions - Permissions and privacy settings - Secrets and keys built into the app ### Resilience - Jailbreak detection and anti-tampering, if you rely on them - Protection of business logic in the client ## How we test your iOS app. Five phases, one tester. The same senior tester from first scope to retest. test days in the starting price 3 business days to the report 5 days for the free retest 60 Typically 3–8 testing days, depending on features, roles and whether the backend API is in scope. 1. Phase 1 ### Scope & start date Price and start date online, or a call. NDA, signed scope and written authorisation come before any testing. You pick the date 2. Phase 2 ### App analysis App build, local storage and traffic examined. Test day 1 3. Phase 3 ### App + API testing The app and its backend tested together. From test day 2 4. Phase 4 ### Report & debrief Audit-ready report and ticket file, then a call. Within 5 business days 5. Phase 5 ### Free retest Your fixes tested again and confirmed in writing. Within 60 days ## Methodology & standards - OWASP MASVS - OWASP MASTG - OWASP Mobile Top 10 - OWASP API Security Top 10 (2023) - CVSS 3.1 ## How we test iOS apps We start by using the app the way your customers do, then map which data it stores, which backend calls it makes and which roles exist. Each area is then checked by hand against the [OWASP Mobile Application Security Verification Standard (MASVS)](https://mas.owasp.org/MASVS/), with the MASTG as the test guide. ### App and backend together Most serious mobile findings sit in the API behind the app. If the backend is in scope, we test it with the same accounts, so you see the full picture in one report. ### Critical findings don’t wait for the report If we find something critical during testing, you hear from us the same day, with enough detail for your team to start fixing. ### Results mapped to MASVS Every finding is linked to the MASVS control it affects and scored with **CVSS 3.1** (4.0 on request) plus a business-risk rating. Your developers know what to fix first, and your auditors see which controls were checked. ## What you get - Executive summary for management and auditors - Every finding with reproduction steps, evidence and fix guidance - Findings mapped to OWASP MASVS controls - CVSS 3.1 scoring plus business-risk rating and remediation priorities - Debrief call with your app and backend developers - Free retest and updated report ### Always included - Free retest within 60 days - Debrief call with your team - NDA, DPA and testing authorisation with the offer - Critical findings reported the same day - Testing stops at any time on your call - Audit-ready report (PDF) - Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub - Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42 Pentest report · Admin & Söhne GmbH · MC-2026-016 Risk: High CVSS 3.1 · 8.2 Open · retest included ### Key inside the app lets anyone send push messages to all customers Admin & Söhne iOS app · customer messaging service CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N #### Description The app contains the secret key for the service that sends push messages to customers. Anyone who downloads the app from the App Store can extract it. The key is not limited to the app’s own needs: it can send any message to every customer’s phone and read the customer contact list with names, email addresses and mobile numbers. #### Steps to reproduce 1. Download the public app from the App Store onto a test device. 2. Inspect the app package: the key for the messaging service is stored in it. 3. Check the key’s rights with the client’s admin: it can read all customer contacts and send to all devices. ``` App package: settings file holds the messaging key (shortened) Key rights: read customer contacts = yes · send to all devices = yes Customer contacts readable: 48,210 (name, email, mobile) ``` #### Business impact A fake “Your parcel is waiting, please pay 1.99 EUR” message from your own app reaches every customer. Customers lose money and trust, your ratings and support desk take the hit, and the readable contact list is a GDPR breach, reportable within 72 hours. #### Remediation Revoke the key now and issue a new one that stays on the server. Let the app ask your own backend to send messages, never the messaging service directly. Give each key only the rights it needs, and add a check to the build that fails when a secret is found in the app package. OWASP Mobile Top 10 2024: M1 Improper Credential Usage · CWE-798 (Use of Hard-coded Credentials) · OWASP MASVS-STORAGE ## Fixed price from [€2,900](https://mr-cyber.com/quote?service=ios) 3 test days · report in 5 business days · retest included Services exclusively for businesses. · [What drives the price](https://mr-cyber.com/pricing) ## Frequently asked questions How much does an iOS app penetration test cost? Fixed prices start at €2,900 for one app on one platform with one or two user roles. Including the backend API, more roles or a second platform adds effort. The quote form shows your binding fixed price instantly, and the written offer (PDF) is sent to you by email right after your request. What do you need from us? A current build (IPA or a TestFlight invite), test accounts for each role, the API environment the app talks to and a contact for emergencies. Source code is optional. Do you test Android at the same time? Yes, if you have both. Each platform is tested on its own, because storage and platform features differ. The shared backend API is tested once. Will the test affect our live users? No. We test with our own test accounts, ideally against a staging backend. If production is in scope, test windows and excluded actions are agreed upfront. How is this different from an automated app scan? A scanner checks the app file for known patterns. A tester also checks how the app and backend behave together, for example whether one user can reach another user's data. That is where the serious findings usually are.