Skip to main content
Mobile applications extend your attack surface onto hardware you do not control. The binary is in the attacker’s hands from the moment it ships. It can be decompiled, instrumented at runtime, and stripped of its client-side protections, and its API calls can be replayed without the app ever running. Controls that appear robust in a code review frequently fail within minutes on a rooted device. A thorough mobile pentest requires rooted or jailbroken devices, instrumentation tooling, and specialists familiar with both platforms. That cost means most apps are assessed once a year at most, while shipping new releases every few weeks. Everything in between goes out untested.

​
How Neo Solves This

Neo tests Android and iOS apps end to end, from the binary to the backend it depends on. Tests run in emulators that Neo operates directly, navigating the app’s interface the way a user would.
  1. Acquires and analyzes the binary: Neo takes the APK or IPA you provide, or fetches it, then decompiles it and maps the attack surface: hardcoded secrets, exported components, deep links, embedded API endpoints, and third-party SDKs.
  2. Patches and instruments the app: On Android, Neo patches the APK to strip certificate pinning and enable debugging where a test needs it. On both platforms it attaches Frida to hook methods at runtime, bypass client-side protections, and observe what the app actually does rather than what the code suggests it does.
  3. Maps the API surface: Neo operates the app in an emulator, working through its screens and flows as a user would, and captures every request it makes. From that traffic it builds an inventory of the backend API the app relies on, including endpoints the interface never exposes directly.
  4. Fuzzes exposed IPC entry points: Android apps communicate with each other and with system services through Intents carried over the Binder driver, so an app’s inter-process attack surface is the set of components it exports: activities, services, broadcast receivers, and content providers, including any exported implicitly by an intent filter. Neo sends those components malformed and unexpected Intents and content URIs. On iOS, it exercises the custom URL schemes and universal links the app registers. In both cases it looks for injection, functionality reachable by other apps that should be internal, and data leaking across the sandbox boundary.
  5. Tests authorization and session lifecycle: Neo exercises the backend API across user roles and accounts to find broken object-level and function-level authorization, and checks how sessions behave on logout, token expiry, refresh, and device change.
  6. Captures runtime evidence for every finding: Each confirmed issue arrives with the proof gathered on the device: the Frida trace, the intercepted request and response, the screenshot, or the extracted artifact.

​
What This Looks Like in Practice

You attach the APK for a customer-facing Android application and define the scope:
Neo decompiles the APK and identifies certificate pinning and a root-detection check. It patches both, installs the application in a rooted emulator, and attaches Frida to confirm the bypass. Using both test accounts, it exercises the application’s primary flows and maps 43 API endpoints. It then requests the first account’s resources while authenticated as the second account and finds that the transaction history endpoint returns data for any account ID with no ownership check. Testing the session lifecycle, it finds that logging out clears the local token while the refresh token remains valid server-side, so a captured token continues to work after the user has signed out. Finally, an exported content provider exposes cached account statements to any application on the device that queries it. Neo reports three confirmed findings, each supported by the request and response that demonstrates it, the Frida trace documenting the bypass, and a screenshot of the exposed data.

​
What You Get

  • Binary-to-backend coverage: static analysis of the app, dynamic testing on a device, and testing of the API it talks to, in one engagement.
  • Hands-on testing in an emulator: Neo installs the app in a rooted or jailbroken emulator and operates it directly, so findings reflect the app’s actual runtime behaviour rather than static analysis alone.
  • A map of the API surface: every endpoint the app calls, including the ones the interface hides, ready for follow-up API testing.
  • Authorization and session findings: cross-account access and session weaknesses confirmed against the live API, not inferred from code.
  • IPC and deep-link findings: weaknesses in how the app exposes itself to other apps on the device, including exported components that accept untrusted input, deep links that bypass authentication or intended flows, and data that leaks across application boundaries.
  • Runtime evidence for every finding: traces, intercepted traffic, screenshots, and extracted artifacts attached to each issue.

​
Setup

  1. Attach the APK or IPA file to your task, or provide a link from which Neo can download it.
  2. Store test credentials in Settings → Secrets. Two accounts at the same privilege level let Neo test cross-account access; accounts at different levels let it test privilege boundaries.
  3. Tests run in emulators that Neo provisions, so no device setup is required on your side.
  4. Describe the scope and focus in your prompt, then run the task. To test every release, set it up as an automation triggered on your release cadence.