Engagement Overview
Applications: 4 mobile applications, each with iOS and Android versions (8 builds total).
Objective: Perform comprehensive security testing to identify vulnerabilities in the mobile applications, associated APIs, authentication mechanisms, and backend interactions.
Approach: Primarily manual penetration testing, supported by automated tooling, aligned with OWASP MASVS/MSTG (MASTG) and industry best practices.
Expected Scope
- Black box testing of the applications.
- Authentication, authorization, and session management testing.
- API and backend communication security, including business logic vulnerabilities.
- Local data storage, encryption, secrets management, and sensitive information exposure.
- Network communications, certificate validation, and TLS implementation.
- Platform-specific security controls for iOS and Android.
- Testing of common mobile vulnerabilities, including those in the OWASP Mobile Top 10.
- Documentation of findings, severity ratings, remediation recommendations, and supporting evidence
Ideal Resource
We re looking for a mobile application penetration tester with:
Demonstrated hands-on experience testing both iOS and Android applications.
Strong understanding of mobile architecture, API security, and common vulnerability classes.
Proficiency with tools such as Burp Suite, Frida, Objection, MobSF, and platform-specific testing utilities.
Ability to perform manual exploitation and business logic testing, not simply run automated scanners.
Experience producing professional, client-ready penetration testing reports with actionable remediation guidance.
Relevant certifications (OSCP, OSWE, OSEP, GMOB, or similar) are a plus, but practical mobile testing experience is more important.
Ideally, we d find one strong resource who can own the engagement end-to-end, although we can provide project oversight, QA, reporting tools, etc.