Web Application Testing
Reproducible offensive testing of the web applications behind your products.
Learn moreHands-on security testing of your iOS and Android applications, aligned to the OWASP Mobile Application Security Verification Standard and Testing Guide. We probe insecure data storage, weak cryptography, platform misuse, network communications, and reverse-engineering resistance, then hand you findings your developers can act on.
A mobile application penetration test is a structured, hands-on assessment of an iOS or Android app and its supporting services, carried out by experienced testers who think like an attacker. Rather than scanning code in isolation, we examine the application as it actually behaves on a device: how it stores data, how it protects secrets, how it talks to your back end, and how it resists tampering and reverse engineering.
Our work is aligned to the OWASP Mobile Application Security Verification Standard (MASVS) and follows the techniques of the Mobile Application Security Testing Guide (MASTG). We cover the categories that matter most on mobile: insecure local storage, weak or misused cryptography, misuse of platform features and permissions, insecure network communications, and the resilience of the app against runtime manipulation and reverse engineering.
Every engagement follows the Cyber Shields rhythm: Assess, Protect, Monitor. For a mobile application penetration test, that translates into the following steps.
Testing and findings are anchored to recognized mobile security frameworks so they are defensible and cross-mappable.
The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.
Every engagement is scoped individually. Pricing depends on the size and complexity of your environment, the systems or controls in scope, and the timeline you need to work to. Rather than publish figures that rarely fit a specific situation, we prepare a written proposal with a clear fee and schedule once your scope is understood.
Tell us about your organization and the deadline you are working toward, and we will return a tailored proposal within five business days, following a signed Non-Disclosure Agreement.
We test both iOS and Android applications. An engagement can cover one platform or both, and we tailor the test approach to each platform's specific storage, cryptography, and runtime characteristics. We confirm the platforms and builds in scope during scoping.
No, source code is not required. We can perform a black-box test against the compiled application. That said, providing source code and design documents enables a deeper, white-box assessment and often surfaces issues faster, so we recommend it where you are able to share it under the NDA.
For a thorough assessment we typically test on jailbroken iOS or rooted Android devices, as this allows us to inspect local storage, instrument the app at runtime, and evaluate anti-tampering controls. We also validate behaviour on standard devices so the findings reflect the real-world risk to your users.
Yes. A re-test of the reported findings is included so we can confirm that your remediation is effective and that no new issues were introduced. We agree the re-test window in the proposal.
Yes. The report, the executive summary, and the readout session are available in both Arabic and English at no additional cost.
Reproducible offensive testing of the web applications behind your products.
Learn moreTest the APIs your mobile app depends on for broken authorization and data exposure.
Learn moreBroad, prioritized identification of weaknesses across your environment.
Learn moreTell us about your app and platforms and we will return a written proposal within five business days. NDA first, always.