Mobile App Penetration Test – Fintech | Use Case

Client Overview

A mobile payments app (iOS and Android) needed a security assessment before public launch. The client required reverse engineering, API security, and data storage testing to ensure sensitive payment and PII handling was secure.

Industry: Fintech
Challenge: Validate app and backend API security; ensure no sensitive data exposure on device or in transit
Engagement: 2 weeks (scoping, testing, report, remediation support)

Scoping & Requirements

Scope: iOS and Android app binaries (production build); backend APIs used by the app; certificate pinning and TLS. Success criteria: OWASP Mobile Top 10 covered; critical/high remediated before launch. Rules of engagement: testing on provided devices/builds; no distribution of modified apps.

Methodology & Test Cases

Static and dynamic analysis, reverse engineering (e.g. Frida, objection), and API testing. Test cases included:

Category	Test Cases Performed
Data storage	Keychain/Keystore, shared prefs, DB, logs; sensitive data in backups
Communication	TLS validation, certificate pinning bypass, API auth and authorization
Code	Reverse engineering, hardcoded secrets, debug flags, root/jailbreak detection
API	IDOR, broken auth, injection, rate limiting, token handling

Tools: Burp, Frida, objection, MobSF, dex2jar/jadx. Standards: OWASP Mobile Top 10.

Findings & Vulnerabilities

14 findings (2 critical, 5 high, 5 medium, 2 low). Critical:

Critical: API key and auth token stored in plaintext in app bundle (recoverable via reverse engineering). Affected: Android release build.

High: Certificate pinning could be bypassed on rooted device; API traffic interceptable. Mitigation: implement robust pinning and attestation.

Remediation support included secure storage patterns, backend token handling, and pinning implementation guidance. All critical and high were fixed before launch.

Results & Impact

            Critical: 2 → 0; High: 5 → 0 after remediation.
App launched with no critical/high open findings.
Client adopted secure storage and pinning best practices for future releases.

        

"They found issues our internal team missed. Essential before going to market."

— Head of Engineering, Mobile Payments

Key Takeaways

Testing on production-equivalent builds and on both platforms caught platform-specific issues. For similar organizations: include API and backend in scope; test certificate pinning and secure storage early; plan retest after fixes.

Mobile App Penetration Test – Fintech