Offensive security
Android Application Testing
Static and dynamic testing against the OWASP MASVS, on real devices, not just emulators.
Security testing
In plain terms Testing
What this is
Static and dynamic testing against the OWASP MASVS, on real devices, not just emulators.
Why it can hurt you
Insecure local storage and weak certificate pinning leak session tokens long before the backend is touched.
Security testing
Why it matters to you Testing
The problem
Insecure local storage and weak certificate pinning leak session tokens long before the backend is touched.
Play Store confidence
Reduce risk of takedown or user-data incidents post-launch.
Root/jailbreak resilience
App holds up against the devices your users actually run.
Security testing
How we do it Testing
Static analysis
Decompiled APK review for hardcoded secrets, insecure crypto, debug flags.
Dynamic instrumentation
Frida/Objection-based runtime hooking to bypass root detection and pinning.
Backend interaction testing
API calls the app makes, tested for the same flaws as a web API.
Security testing
What we typically find Testing
Insecure storage
Tokens or PII stored unencrypted in shared prefs or SQLite.
Weak cert pinning
Pinning absent or trivially bypassed, enabling MITM.
Reverse-engineerable logic
Business logic or license checks exposed in decompiled code.
No scanner dump. A fixed problem.
Every finding is reproduced by hand and comes with a working proof of concept.
Security testing
What lands on your desk Testing
MASVS checklist
Coverage mapped against every applicable control.
Reproduction videos
Screen-recorded exploit chains for dev handoff.
Security testing
What you get out of it Testing
Play Store confidence
Reduce risk of takedown or user-data incidents post-launch.
Root/jailbreak resilience
App holds up against the devices your users actually run.
Security testing
Step by step Testing
1. Static analysis
Decompiled APK review for hardcoded secrets, insecure crypto, debug flags.
2. Dynamic instrumentation
Frida/Objection-based runtime hooking to bypass root detection and pinning.
3. Backend interaction testing
API calls the app makes, tested for the same flaws as a web API.
Find out what we would find.
A scoping call is thirty minutes, costs nothing, and ends with a fixed price and a date. If we are not the right people for the job, we will tell you that too.