Mobile app pentesting runs an AI pentest on your Android app from its APK. Escape runs the app on an Android emulator, signs in as each of your test users, uses the app screen by screen, and attacks the backend APIs it calls. This page covers how to prepare your build, set up a mobile pentest, and read the results, plus what Beta doesn't cover yet. > [!WARNING] > > **Beta** > > Mobile app pentesting is in Beta. It supports Android apps uploaded as an APK. iOS isn't supported yet. ## How It Works Escape tests your mobile app as an attacker would: it uses the app, watches what it sends, and goes after the APIs behind it. You provide the APK and test accounts. 1. **Installs the app.** Escape installs your APK on an Android 14 emulator and launches it. 2. **Signs in each user.** An agent signs in every user you configure, in the app, from their sign-in instructions. 3. **Maps the app.** An agent goes through every screen and flow for each user, including WebViews, while Escape captures the app's HTTPS traffic. Every backend call it sees becomes an endpoint to test. 4. **Attacks the backend.** [Cascade]() agents attack those endpoints for the same vulnerability classes as a web pentest: BOLA and IDOR, privilege escalation, injection, SSRF, JWT flaws, mass assignment, and more. 5. **Replays known issues.** Open issues from earlier assessments on the profile are replayed against the app. ### What's in Scope Scope comes from the app's own traffic: a host is in scope only when your app calls it during the run. You don't list target URLs. Third-party services the app calls are out of scope: analytics, crash reporting, ads, push notifications, CDNs, identity providers, and payment providers. Firebase Firestore and Storage calls count as your app's data and are tested. The agents that map the app never delete the account and never change its password or MFA settings. ## Prepare Your APK Escape intercepts the app's HTTPS traffic to find the backend calls to test. Protections built to stop that also stop the pentest. Upload a build with: - **Certificate pinning turned off.** Escape doesn't bypass pinning. A pinned app's traffic isn't captured, so there's nothing to attack. - **Root and emulator detection turned off.** The app runs on an emulator with root access, which these checks flag. - **Play Integrity and other attestation checks turned off**, or set to pass on emulators. The file must be a valid APK: a zip archive that contains `AndroidManifest.xml`. The emulator is 64-bit, so the app must ship 64-bit native libraries if it has any. > [!TIP] > > **Keep your release build protected** > > Many teams already give manual pentesters an unprotected copy of the build. Use that copy here. ## Prerequisites - **Beta access.** If **Mobile Applications** is grayed out, click **Join the Beta** on its card and the Escape team turns it on for your organization. - Permission to edit assets. - Test accounts for the app, ideally two or more with different roles or tenants. ## Set Up a Mobile Pentest 1. Open **AI Pentesting \> [Profiles]()** and click **New Profile**. 2. Under **Pentest type**, select **Mobile Applications**. 3. Under **Upload APK**, upload your build. 4. Under **Authentication**, add each test user with a name and sign-in instructions. Write the instructions as you'd explain them to a tester: the credentials, which screens to go through, and any MFA step. TOTP-based MFA is supported. Leave the list empty only if the app has no sign-in. 5. Under **Options**, optionally add **Context** (business context, sensitive flows, areas to avoid) and set the **Duration**. 6. Under **Review & launch**, click **Validate Configuration**. Escape installs the app, launches it, and signs in each user. Launch unlocks once the review passes. 7. Launch the assessment. For more on writing sign-in instructions and why a second user matters, see the [Quickstart](). ### From the Public API Upload the APK as an asset with `POST /v3/assets/apk`. This route is tagged Beta. See the [Public API](). ## Read the Results Mobile pentests show up in the profile's assessment history as **Mobile Pentest**, with the same results view as web and API pentests. - **Scope Exercised** lists the APK and the backend APIs discovered from its traffic. - **Issues** are filed on the backend endpoints, API routes, or web pages where they were found, each with its [Proof of Exploit](). - **Screenshots** show the app launching and each action the agents took in the app. - **Exports**: download the assessment as a PDF report. ## Limits - **Android only, APK only.** iOS, AAB, split APKs, and store URLs aren't supported. - **No source code.** Whitebox configuration isn't available on mobile profiles. See [Whitebox Agent](). - **Point-in-time only.** Continuous pentesting doesn't support mobile profiles. - **No certificate pinning bypass.** Upload a build with pinning turned off. - **No custom scope.** Allowlists, blocklists, and off-limits areas aren't available. Scope follows the app's traffic. - **Escape-hosted only.** Mobile pentests don't run from a [Private Location](), so the backend the app calls must be reachable from the internet. ## FAQ **Do I need my source code?** No. The APK and test accounts are enough. **Does it test the app or only the API?** Both, through the app. Agents use the app on an Android emulator to find every backend call it makes, then attack those calls. Issues land on the endpoints, because that's where the fix goes. **Which build should I upload?** A build with certificate pinning, root and emulator detection, and Play Integrity checks turned off. See [Prepare Your APK](<#prepare-your-apk>). **Does it support iOS?** Not yet. Beta supports Android APKs only. **My app uses MFA. Will sign-in work?** TOTP-based MFA is supported: include it in the user's sign-in instructions. Validation tells you before launch whether each user signed in. ## Related - [Quickstart]() - [How It Works]() - [The Cascade Engine]() - [Proof of Exploit]() - [Guardrails]()