Our app penetration tests are conducted from the perspective of an external malicious black-hat hacker. Based on your requirements, we can conduct either black box, grey box or white box test. We methodically follow the following steps:

Scoping — Our testing experts will engage in discovery activities, such as IoT penetration test security needs and requirements, existing SLAs, risks potential vulnerability exposures and defining the scope. Other aspects succh complexity, tailoring possibilities and threat intelligence focus will also analyzed

Reconnaissance — We will conduct mobile app security discovery activities, such as outdated code, insecure data storage and other potential vulnerability exposures.

Exploitation — Using the information from stage one, testing experts combine information obtained during evaluation with any relevant penetration testing methodologies focusing on exploitable vulnerabilities. This focus will assess your IoT products resiliency to attack, the coverage of your security monitoring, and your detection capabilities’ efficacy.

Remediation Verification — Our penetration testers perform a follow-up assessment to ensure that the exploitation phase’s remediation and mitigation steps have been accurately implemented. This also enables the testers to confirm that the customer’s security posture is aligned with industry best practices.

Delivery — Cleanup, document analysis, report creation and report presentation to stakeholders to easily benchmark security level of each process based on the results of penetration tests and implementation of countermeasures if requested by the customer.


Our methodology differs from project to project. We use well-known methods such as OWASP, PTES, ISSAF, and NIST and blend them with Agility, Scrum, and DevOps methodologies to deliver the best results.

Continuous Pentesting methodology is our primary approach. This involves performing integral and incremental pentests at every stage of the development process, allowing us to detect and fix vulnerabilities promptly. Our integral pentest establishes a baseline of current security status, while our incremental pentest verifies security-related changes in line with your development methodology and release cycle.

However, even though penetration testing should be done early, that's not always the case since most companies are not interested in performing a penetration test before it's too late. Yes, we can optimize our methods to test ancient systems. At Vuntie, nothing is impossible!

At Vuntie, we use only the most reliable and practical tools for penetration testing, including Kali Linux, Metasploit, Nmap, Aircrack-ng, Burp Suite, OWASP ZAP, and John the Ripper. Our commitment to using the best tools guarantees accurate and comprehensive results for our clients.

External penetration testing

Vulnerabilities covered in our app penetration test

We provide comprehensive penetration testing services for mobile applications, covering the industry-agreed most critical vulnerabilities. Our tests are designed to identify and address a wide range of security issues, including but not limited to the following: authentication and authorization flaws, insecure data storage, insecure communication, insecure cryptography, and code injection. We also look for vulnerabilities related to the underlying platform, such as insecure APIs, insecure configuration, and insecure coding practices. Our tests are designed to ensure that your mobile applications are secure and compliant with industry standards. We strive to provide the highest level of security and assurance for your mobile applications, so you can rest assured that your data and users are safe.

Improper Platform Usage
Insecure Data Storage
Insecure Communication
Insecure Authentication
Insufficient Cryptography
Poor Client Code Quality
Extraneous Functionality
Elevation of privilege threats
Ecosystem Interfaces
Secure Update Mechanism
Resistance against viruses
Potential backdoors