Skip to content
HackIndex
Menu

Your app is on thousands of phones. Including an attacker's.

A pentest of your iOS and Android app and the API behind it. Anyone can download your app and look at what is inside. With this test you know before an attacker does.

Request a pentest What does it cost?
  • iOS and Android
  • API included
  • Extra knowledge of React Native

When

Sound familiar?

  • The app goes into the store for the first time.

    A flaw found before the release never lands on thousands of phones.

  • It handles payments or health data.

    The more sensitive the data, the more it matters that app and API hold up.

  • The app is built with React Native.

    Whatever is inside the app can be read by anyone. Including keys that do not belong there.

  • The API only exists for the app.

    An attacker does not use your app, but talks to the API directly.

Scope

From phone to server

A mobile pentest looks at four layers. The API is always included, because that is where the most serious flaws tend to be.

Phone

App

Connection

Server

What the test answers

Storage on the phone

What is left behind on the device?

  • Login details and personal data stored without protection
  • Data that stays after logging out
  • Sensitive screens in the app switcher

What the test answers

The app itself

What do you find when you look inside the app?

  • Keys and passwords shipped with the app
  • Hidden test and debug features
  • How well the app protects itself against changes

What the test answers

Links to the app

Can a link make the app do something?

  • Actions that start from a link without confirmation
  • Web pages inside the app that are allowed too much

What the test answers

The connection

Can someone listen in on the same wifi?

  • Whether every connection is encrypted
  • Data that is sent but not needed
  • Third-party services in the app that read along

What the test answers

The API

What happens when you skip the app?

  • Requesting data of other users
  • Checks that only exist in the app and not on the server
  • Old API versions that still work

What the test answers

Login

How long does someone stay logged in?

  • Sessions that never expire
  • Logging out that does not really log out
  • Codes by text or email that can be guessed

From a report

What a finding looks like

For each finding what is wrong, the evidence, what it means and how to fix it.

Reference
HI-OP-2026-R7KD-01
Severity
Critical
CVSS
4.0 9.3 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
3.1 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Where
iOS and Android app
Who can do this
Anyone, no account needed
Retest
Fixed

The secret key of the payment provider is inside the app

The app talks to the payment provider itself, with a key that belongs on the server only.

Evidence

  1. Download the app from the store, without an account.
  2. The secret key of the payment provider is inside the app.
  3. With that key a refund can be made outside the app.

Impact

Anyone can refund money to themselves and view customer data at the payment provider. The key has to be revoked and the app released again.

Fix

src/api/payments.ts

Removed: await paymentProvider(SECRET_KEY).refund(paymentId);
Added: await api.post(`/orders/${orderId}/refund`);

A made-up example. Real findings stay confidential.

View the sample report

Clear up front

What is and is not included

IN Part of the job

  • The iOS and Android version of your app
  • The API the app uses
  • Storage on the phone and the connection to the server
  • A report and a debrief

OUT Not included

  • Your website or web app, available as a web and API pentest
  • Infrastructure, such as servers and hosting. Available on request, priced separately
  • The App Store and Play Store, and their review
  • Services of others, beyond how your app uses them

Price

What does it cost?

After the intake you get a fixed price. These points decide the size.

from, excl. VAT

€2,250

Fixed price, no extra charges afterwards

  • Platforms One platform or both. With React Native or Flutter shared code saves time.
  • The API behind it How many features and roles the API has.
  • Sensitive parts Payments or health data need more depth.

Preparation

What you provide

The better this is ready, the more time goes into the testing itself.

  • Needed Test builds A TestFlight invitation for iOS and an install file for Android.
  • Needed A test account per role With test payments where relevant.
  • Optional A test environment of the API Separate from real users. No test environment? HackIndex sets up a copy of the API, at no extra cost for common setups. Protection that blocks test traffic is switched off for HackIndex.

Combine

More coverage in one job

This service

Mobile pentest

from €2,250

Your app and the API behind it.

On top

Web and API pentest

from €1,950

Do you also have a web application on the same API? Testing them together saves time, the API only needs to be explored once.

More about Web and API pentest

Frequently asked questions

Does the app need to be in the store?

No. Test builds are enough, and actually better: the test happens before users have the app.

Why is the API always included?

An attacker does not talk to your app but to the API directly. That is where the most serious flaws tend to be.

The app has extra protection. Is that enough?

It makes attacks harder, but can usually be bypassed. The test shows what can still be reached after that.

What if something critical is found?

You hear about it right away. A leaked key can be revoked immediately.

Get your app tested.

Tell which platforms and what the app does. You'll receive a proposal with a fixed price.

Request a pentest

Other services