Mobile App Penetration Testing
Budget: $250 – $750 USD
I need an experienced ethical hacker to run a full-scope penetration test on our production mobile app, which is released on both iOS and Android. The engagement should mimic real-world attack techniques, covering client-side and back-end interactions, with a clear focus on the OWASP Mobile Top 10 and any platform-specific abuses you typically see on Apple and Google ecosystems.
Please perform static and dynamic analysis, investigate authentication flows, data storage, transport encryption, third-party SDK exposure, and any jailbreak/root bypasses that could threaten user data or server resources. Throughout the test, keep detailed notes; I will ask for a concise executive summary followed by a technical report that includes:
• A prioritized list of discovered vulnerabilities with CVSS (or comparable) severity ratings
• Proof-of-concept steps or scripts to reproduce each finding
• Practical remediation guidance that our development team can act on quickly
All testing must remain within the agreed scope and comply with platform terms so our store listings stay unaffected. Let me know the estimated duration and the tools you prefer—Burp Suite, MobSF, Frida, or your own setup—so I can arrange the necessary test accounts and API keys before you begin.
Please perform static and dynamic analysis, investigate authentication flows, data storage, transport encryption, third-party SDK exposure, and any jailbreak/root bypasses that could threaten user data or server resources. Throughout the test, keep detailed notes; I will ask for a concise executive summary followed by a technical report that includes:
• A prioritized list of discovered vulnerabilities with CVSS (or comparable) severity ratings
• Proof-of-concept steps or scripts to reproduce each finding
• Practical remediation guidance that our development team can act on quickly
All testing must remain within the agreed scope and comply with platform terms so our store listings stay unaffected. Let me know the estimated duration and the tools you prefer—Burp Suite, MobSF, Frida, or your own setup—so I can arrange the necessary test accounts and API keys before you begin.