Home/Services/Mobile Application Penetration Testing
SERVICE · KIGALI, RWANDA

Mobile app penetration testing for banks, mobile money, and fintech

We test Android and iOS applications by hand against OWASP MASVS, using MASTG test cases, together with the backend APIs and USSD rails the app depends on. Your app runs on devices you do not control, over networks you do not trust, in front of attackers who can decompile every release. Testing is led by an OSCP-credentialled practitioner, and every finding ships with proof-of-concept evidence your engineers can replay.

Methodology: OWASP MASVS / MASTG | Android + iOS + backend APIs | OSCP-credentialled practitioner | Evidence-led reporting
Book a Free Call

What we test

01

Android

Decompilation and static review of the APK, insecure local storage, exported components and IPC, and runtime instrumentation on real devices.

02

iOS

Binary analysis of the IPA, Keychain and data-protection usage, transport security, and jailbreak-detection and pinning bypass under instrumentation.

03

Backend APIs

The server side the app trusts: authentication and session handling, authorisation and IDOR, and the business logic that moves money.

04

USSD and adjacent channels

The *XXX# rails most African customers actually use: session handling, PIN policy, and the gateway integration that shares your app's backend.

What this is

A manual penetration test of your mobile application and the systems behind it. We reverse-engineer the released binary, instrument the app at runtime, intercept and tamper with its traffic, and attack the backend APIs the way a motivated adversary would: not a scanner pass over the APK. For banking and mobile money apps, the channel-specific risks are concrete: credential and token theft from the device, pinning bypass on hostile networks, and server-side authorisation flaws reachable only through the mobile API. We cover what that looks like in practice in our guide to mobile banking security assessment.

Methodology: OWASP MASVS and MASTG

We test against the OWASP Mobile Application Security Verification Standard (MASVS), the industry baseline for mobile app security, executed through the test cases in the Mobile Application Security Testing Guide (MASTG). The MASVS control groups structure the work: storage, cryptography, authentication, network communication, platform interaction, code quality, and resilience. At scoping we agree the verification target: MAS-L1 as the floor for any app, MAS-L2 plus the resilience controls for apps that hold credentials or move funds. Resilience controls (root and jailbreak detection, anti-tampering, obfuscation) get tested honestly: they slow an attacker down, and we demonstrate where the server still trusts a client it should not.

Who this is for

Institutions whose mobile channel is a production payment system, in Rwanda, East Africa, and across the continent:

If your customers reach you through *XXX# as well as the app store, scope both: our guide to USSD security testing explains why the legacy channel deserves the same scrutiny as the app.

Deliverables

Engagements are scoped individually: request a scoped quote with the platforms, API surface, and deadline you are working to. Mobile testing is one discipline within our manual VAPT practice across web, API, network, and cloud; see the full penetration testing service for the wider scope.

Frequently asked questions

What standard do you test mobile apps against?
The OWASP Mobile Application Security Verification Standard (MASVS), executed through the test cases in the OWASP Mobile Application Security Testing Guide (MASTG). We agree the verification target with you at scoping: MAS-L1 for every app, MAS-L2 plus the resilience controls for apps that move money.
Do you test both Android and iOS?
Yes. Both platforms are tested by hand: static analysis of the decompiled or extracted binary, runtime instrumentation on real devices, and interception of all traffic between the app and its backend. Findings are reported per platform, since storage, IPC, and platform-API issues rarely mirror each other.
Do you test the backend APIs behind the app?
Yes, and we recommend it in every scope. The app is only the client: the authorisation flaws, object-reference issues, and business-logic abuse that cause real losses live server-side. We test the APIs the app talks to as part of the same engagement.
Does BNR Regulation N°50/2022 cover our mobile banking app?
If the National Bank of Rwanda licenses or supervises you, the regulation requires a penetration test at least annually and vulnerability assessments at least twice a year across your systems, and customer-facing channels such as mobile banking sit squarely in that scope. The regulation also lists OSCP among the credentials a qualifying tester may hold, and our testing is led by an OSCP-credentialled practitioner. See our BNR-compliant penetration testing service for the full obligations.
Do you need our source code to test?
No. We test from the compiled APK or IPA the way an attacker would, and we can work fully black-box. Source-assisted (grey-box) testing finds more in the same time, so we recommend sharing code where your policy allows, but it is not a requirement.
Can you test our USSD service alongside the app?
Yes. For most banks and mobile money operators in Africa, the USSD channel reaches more customers than the app and shares the same backend. We test USSD session handling, PIN policy, and the gateway integration in the same engagement so one report covers both channels. Our USSD security testing guide covers the common failure modes.
How much does a mobile app penetration test cost?
Every engagement is scoped individually: number of platforms, size of the API surface, verification level (MAS-L1 or MAS-L2 plus resilience), and whether USSD is in scope. Tell us about the app and your deadline, and we reply within 24 hours, and a scoped proposal follows within 48 hours of the scoping call.

Shipping a release or facing an audit?

Tell us the platforms, the API surface, and the date you are working to. We reply within 24 hours, and a scoped proposal follows within 48 hours of the scoping call.

Book a Free Call WhatsApp us
Chat on WhatsApp Chat with us