Mobile Application Penetration Testing

Identifying areas of exploitation in your mobile application.

Key Benefits

01

Scoping

At Samurai Security, we believe that accurate scoping is the foundation of every successful penetration testing project. That’s why we start by gathering as much information as possible about the system in question. If additional information is needed, we will invite you to complete a scoping document or schedule a scoping call to discuss the requirements in more detail.

Our in-depth scoping document helps us accurately scope your penetration testing assessment. It gathers key information regarding the systems in scope of the assessment. If you prefer, we can fill out this document on a scoping meeting instead.

After completing the scoping document, we peer-review it to ensure accuracy and completeness. If additional information is required, we’ll request a scoping meeting.

In this scoping meeting, we’ll request a screenshare demonstration of the systems in scope, discuss any additional testing requirements and expected outcomes, giving both teams the opportunity to ask and answer questions on the scope and testing approach. Once the scoping has been completed, we conduct a final peer-review process and then share the finalised scope of testing with both parties in the form of a proposal.

02

Project Agreement

We will provide you with a formal proposal that will include the scope of works, methodology of testing, project timelines, client requirements and commercials. 

In most cases, project timelines will have been agreed in the proposal. However, if timelines have not yet been agreed, Samurai will provide a number of available dates when testing can be conducted. The client will have an opportunity to agree with the proposed dates, or request different dates.

Based on the availability from both teams, we will then formally book in the project and share the final project timelines with all parties. Once the project timelines are agreed, best efforts must be made by both parties to ensure the timelines are adhered to.

Once the project timelines have been confirmed, both teams will work together to gather the technical requirements for penetration testing, these will be covered in the proposal and typically include:

• Availability of dedicated point of contact

• Written permission to conduct Penetration Testing

• Adding our IP address to allow lists on relevant systems

• Agree on the full technical scope of the assessment

• Ensure necessary backups have been made prior to testing

03

Conducting Penetration Testing

We approach penetration testing projects in line with the industry standards such as the OWASP testing methodology, and combine this with our own testing methodology which has been built up from years of experience conducting penetration tests.

We follow a high-level approach:

• Reconnaissance
• System Mapping
• Vulnerability discovery & potential exploitation

To ensure limited impact to operations and critical systems, we will communicate with the client before conducting any extensive scans or running a malicious exploit. We will not conduct any Denial of Service (DOS) attacks unless requested. All of the tools used by Samurai technical team are tested in the lab environment for accuracy and behaviour before they are used in client engagements.

Throughout the assessment, the client will need to be available in order to answer any technical questions and to enable access to the systems in scope. The technical consultants will contact the client immediately if any Critical or High level vulnerability is found.

At the end of each working day, a summary of the testing findings will be sent to the client. If required, meetings are offered to provide context around these findings on the day. Finally, a full email summary of all the findings from the penetration test is sent on the last day testing.

Get in touch

Let's find a solution