01
Set the scope and test access
List the approved app, build, environment, accounts, roles, workflows, backend services, and prohibited actions. Confirm native and device coverage separately.
Solutions / What we cover
Test the mobile workflow and the services behind it.
Casco uses the approved iOS or Android app and test accounts, records the backend calls made by the workflows in scope, and tests the authorization and business rules behind those calls. Native binary and device-level testing must be confirmed for the specific engagement.
Testing workflowApproved scope only
- 01Approved app scopeBuilds, roles, workflows, and services
- 02Use the appFollow workflows and record backend requests
- 03Backend security testsAuthorization, sessions, and logic
- 04Report and retestAffected resource, impact, fix, and retest
App flows, accounts, APIs, and resultsApproved scope only
What is mobile application pentesting?
Mobile application pentesting checks the approved app workflows and the services they call. Casco can test logged-in behavior, backend APIs, roles, tenant boundaries, data access, and business rules. Native binaries, local storage, deep links, and device controls are included only when the build, device setup, and scope support them.
How Casco tests
How Casco tests a mobile application.
Scroll through the four parts of the test. The diagram shows what Casco has at each point, what it checks next, and what it records.
Test stagesScroll through test
Test contextStep 01 / 04
Application
Environment
Test roles
Backend
StageScope
Mobile scope recorded
Test contextStep 01 / 04
Application
Environment
Test roles
Backend
StageScope
Mobile scope recorded
02
Use the app and record its requests
Casco follows the approved workflows and records the endpoints, accounts, objects, and state changes visible with the access provided.
03
Test the backend rules
Casco changes object references, roles, tenants, inputs, and request order to check authorization, session handling, data exposure, and business logic.
04
Write and retest findings
Each confirmed issue identifies the affected app or backend resource, impact, fix guidance, and steps to reproduce it.
Pentest deliverables
What the mobile report contains.
The report lists the workflows, accounts, services, builds, and device-level checks that were included so there is no ambiguity about coverage.
- Approved application, environments, test roles, workflows, and exclusions
- Prioritized findings with affected client or backend resources and impact
- Reproduction steps for confirmed mobile-to-service issues
- Remediation guidance and finding status for retesting
Learn more
Web application testing
See how Casco tests logged-in workflows, roles, tenant boundaries, and business logic.
Read the sourceAPI testing
See how Casco tests API endpoints, identities, objects, and request sequences.
Read the sourcePentest methodology
Compare fixed scanner checks with tests that use the application and its API.
Read the sourceChecks included when applicable
What Casco checks for.
The findings depend on the accounts, backend services, builds, devices, and native coverage in the scope. Not every check below applies to every mobile test.
Authentication and session failures
Backend API authorization flaws
Cross-user or cross-tenant exposure
Mobile workflow and business logic abuse
Sensitive data exposure in tested flows
Native or device trust issues when explicitly scoped
Related testing
Other systems Casco can test
Frequently asked questions
Mobile application pentesting questions, answered.
What is AI mobile application pentesting?+
AI mobile application pentesting uses software agents to operate the approved app, inspect its backend requests, and choose the next security test from the response. Casco reports vulnerabilities it can reproduce.
Does mobile pentesting include the backend API?+
Yes, when the backend endpoints, test accounts, and mobile workflows are included in the scope.
Can Casco test both iOS and Android applications?+
Yes, if the specific iOS or Android app, build, environment, and test method are agreed during scoping. Backend workflow testing does not automatically include native binary or device-level checks.
Does Casco test the native mobile binary?+
Only when it is included in the engagement. Native analysis may require an installable build, test device, source or symbols, and platform-specific tooling.
Does Casco test local storage, deep links, and platform controls?+
Only when native and device-level coverage is in scope. Otherwise, Casco tests the app workflows and backend services it can reach with the provided access.
What access does Casco need for mobile pentesting?+
Casco needs the approved app and environment, rules of engagement, and test accounts. Backend testing needs access to the relevant API. Native testing may also need an installable build, devices, source or symbols, and platform-specific setup.
What comes with a confirmed mobile finding?+
A finding can include severity, the affected app or backend resource, impact, fix guidance, reproduction steps, execution output, and captured requests when request tracking is available.
Does Casco retest mobile findings?+
Yes. Casco records the original result, the retest, and the current finding status.