Web & Mobile Application Penetration Testing

What is Mobile and Web Application Security?

Mobile and web applications are crucial to making data available to employees, customers and partners. But these systems that simplifydata availability within the business are attractive targets for cybercriminals.These highly connected applications draw data numerous internal resources and databases. And if hackers can compromise your applications, they can use this foothold to exploit other network resources, or to steal IP and client data.Identifying and addressing vulnerabilities in your web-enabled applications is essential to raising the standard of security within your operations.

Why Test Mobile and Web Application Security?

Reduce attack potential

Identifying – and resolving – issues with your web applications and mobile apps will strengthen the overall security of your network. Reducing the number of available entry points will make your business much harder to attack.

Identify outdated APIs

Your web applications will use a series of APIs to link disparate services. Outdated APIs can be exploited to gain access to underlying data and credentials. Fidus will analyse the APIs in use, advising where code updates are required to address these vulnerabilities.

Ascertain adherence to OWASP Top 10

Web and Mobile applications will be tested against the OWASP Top 10 methodology to ascertain adherence alongside using Fidus’ own internal methodologies.

Identify insecure services

Third party applications may connect to external data sets to provide additional functionality or context. Each of these services needs to be tested to confirm data is properly secured at every point.

Address unpatched apps, frameworks and mobile operating systems

Third party apps and software also need to be regularly updated to resolve potential exploits. Again, the Fidus mobile and web application testing service will analyse all of your web-enabled assets and mobile apps to identify instances where updates are required.

Our Approach

Environment research

Our security consultants will first inventory all of your applications. They will then research each, to obtain the latest threat intelligence for use in planning our security tests.

Damage modelling

To better understand the severity of the problems identified, our consultants will carry out an extended series of tests. We will (harmlessly!) exploit each vulnerability to assess the degree of risk they present.

Application vulnerability testing

Using a combination of automated tools and our extensive knowledge of cybersecurity, we probe each of your applications for vulnerabilities. We’ll test for common exploits like SQL-injection and cross-site scripting (XSS), as well as more advanced vulnerabilities such as application logic flaws and session management flows.

Plain English reporting

Cybersecurity complicated – but the results of our tests don’t have to be. Our consultants will present the results of our web and mobileapplication tests in easy-to-understand reports. This ensure you can make informed strategic decisions more quickly and easily.

Why Fidus?

Penetration testing reveals your most sensitive network vulnerabilities – so you need a partner you can trust. Fidus Information Security are an NCSC CHECK Green Light and TIGER scheme approved consultancy. Our cyber security experts hold some of the most recognised certifications in the industry, including CREST Certified Tester and Senior Security Tester. Fidus is also a Cyber Essentials verified company. Every assessment we perform is carried out according to UK industry approved methodologies (OWASP, PETS, NIST) along with our own internal testing frameworks.

Remedial Support

More than just identifying security vulnerabilities, our cyber security experts are on hand to help you fix them too.

Certified Security Consultants

Our CREST and TIGER approved team holds a range of industry-leading security certifications including OSCP, CCT, SST and CISSP

Easy to Understand Reports

We’ll ensure that your executives and technical teams properly understand our assessment findings using plain-English reporting.

Fixed Price Proposals

The price you’re quoted is the price you’ll pay. Our quotes are broken down into a detailed costing table so you know exactly what to expect.

The Industry Average

Other approaches we've witnessed have included convoluted steps and commonly ends with incorrect information being handed to the consultant assigned to the engagement.

The Fidus Way

Our approach to security involves a qualified security consultant through the entire process to ensure quality, accuracy and consistency.

Trusted by

From the Blog

All Articles

Research 19 October 2019

ClickToPray eRosary Account Takeover

Exploiting the eRosary Application In this post we’re going to cover a trivial full account takeover vulnerability our team identified within the new eRosary application, whilst placing an order for the watch! The ClickToPray eRosary beads are advertised as ‘an interactive, smart and app-driven device that serves as a tool for learning how to pray […]

Research 10 May 2019

Exploiting 10,000+ devices used by Britain’s most vulnerable

In this post, we’re going to detail some of the issues our team identified with the an extremely common Alarm & GPS device used by vulnerable people around the world (at least 10,000+ in the UK). The device in question is manufactured in China and seems to be purchased in bulk by numerous providers who […]

All Articles

Request a Call Back

Would you like to speak to us over the phone? Just submit your details and we’ll be in touch shortly. You can also email us if you would prefer – [email protected]

I would like to discuss:

“Oysta is very happy with the support, service and dedication of the Fidus team. Working with the Oysta team every step of the way, not only did they check all security on the device, they also provided feedback on the quality of the hardware. I will be working with Fidus again.”

Mario Zuccaro, Founder and CEO, Oysta Technology

June 2019

“We have been really pleased with the service provided by Fidus. We have found them to be extremely easy to work with. We also felt their fee structure was reasonable. We would recommend Fidus to anyone looking for a PCI pen testing partner.”

Andy Phillips, Inspired Outsourcing

May 2019

“Great service. Gave us exactly what we needed, as promised.”

Philip Cunnington, TalkPlus NHS

January 2019

“We were extremely pleased with the service, knowledge and professionalism shown by Fidus. After the remediation phase, we then ran a phishing exercise with them to remind staff of the need to be vigilant with external email communications. I would have no hesitation in using or recommending Fidus in the future due to the quality of work carried out at a great price.”

Graeme Thistlethwaite, ICT, Business Change and Business Support Manager

“Fidus provided a high quality penetration service at a reasonable price … communications were great … the Pen test team flexed around us and our other commitments to get the job done. Thanks!”

Darren Crombie, CEO, Upstream Outcomes

October 2018

Mobile and Web Application Security