ImmuniWeb® MobileSuite

ImmuniWeb® MobileSuite leverages our proprietary Multilayer Application Security Testing technology for rapid, reliable and DevSecOps-enabled mobile penetration testing. It combines our award-winning Machine
Learning and AI technology with scalable and cost-effective manual mobile security testing.

Turnkey Mobile Penetration Testing

Comprehensive Testing

Full coverage of OWASP Testing Guide, including API and business logic testing.

Accurate Reporting

Zero false-positives SLA for every project and actionable remediation guidelines.

DevSecOps Tailored

24/7 technical support, SDLC and CI/CD tools integration, WAF for mobile backend flaws.

How It Works

1 Pick up a mobile
application

2 Customize and
schedule your audit

3 Download your
remediation report

Standards & Methodologies

We leverage in-house application security testing methodologies in combination with:

OWASP Testing Guide
NIST SP 800-115 Technical Guide to Information Security Testing and Assessment
PCI DSS Information Supplement: Penetration Testing Guidance
FedRAMP Penetration Test Guidance
ISACA’s How to Audit GDPR

We follow international standards to report security vulnerabilities:

Common Vulnerabilities and Exposures (CVE) Compatible
Common Weakness Enumeration (CWE) Compatible
Common Vulnerability Scoring System (CVSSv3)

Vulnerability Coverage Datasheet

Mobile Application Penetration Testing

Mobile Backend APIs Penetration Testing

A1: Injection
A6: Security Misconfiguration
A2: Broken Authentication
A7: Cross-Site Scripting (XSS)
A3: Sensitive Data Exposure
A8: Insecure Deserialization
A4: XML External Entities (XXE)
A9: Using Components with Known Vulnerabilities
A5: Broken Access Control
A10: Insufficient Logging & Monitoring

Injection Flaws
Mny other "High" Risk Vulnerabilities
Buffer Overflows
Cross-Site Scripting (XSS)
Insecure Cryptographic Storage
Improper Access Control
Insecure Communications
Cross-Site Request Forgery (CSRF)
Improper Error Handling
Broken Authentication and Session Management

CWE-22: Path Traversal
CWE-89: SQL Injection
CWE-78: Command injection
CWE-89: Blind SQL Injection
CWE-79: Stored XSS
CWE-90: LDAP Injection
CWE-79: Reflected XSS
CWE-91: XML Injection
CWE-79: DOM-Based XSS
CWE-93: CRLF Injection

CWE-345: Insufficient Verification of Data Authenticity
CWE-352: Cross-site request forgery (CSRF)
CWE-384: Session Fixation
CWE-400: Resource Exhaustion
CWE-434: Arbitrary File Upload

CWE-502: Deserialization of Untrusted Data
CWE-521: Weak Password Requirements
CWE-601: Open Redirect
CWE-611: Improper Restriction of XML External Entity Reference (XXE)
CWE-613: Insufficient Session Expiration

CWE-643: XPath Injection
CWE-804: Guessable CAPTCHA
CWE-799: Improper Control of Interaction Frequency
CWE-918: Server-Side Request Forgery (SSRF)
CWE-942: Overly permissive Cross-domain Whitelist

DevSecOps Integration

Developers Environment

Web Application Firewalls

Most Comprehensive Testing with Zero False Positives SLA

Ultimate
Mobile App Testing

Static, dynamic and interactive
security testing with SCA

Intelligent
Behavioral Analysis

Machine learning technology enhanced
with manual security testing

Backend
Security Testing

Manual security testing of
Web Services and APIs

Zero
False-Positives SLA

One single FP? Money back
contractual guarantee

Tailored
Remediation Guidelines

Action-based remediation guidelines
tailored for your infrastructure

Start
in a Few Clicks

No integration or installation costs,
just sign-up to start

ImmuniWeb® MobileSuite Packages

Tailored for various application sizes and complexity, the packages offer an increasing investment of human time and scanning resources.
Please use free Package Selector or Contact Sales for a personalized quote

This package best suits applications of:

Size

Complexity

Criticality

Fixed price: $1,499 Report in 2 days after start All-included, no hidden costs

Equivalent of
2.5 days of traditional
mobile penetration
testing

1 Testing

Mobile app and backend testing
Multilayer Application Security Testing:
- DAST, IAST and SCA elastic scanning
- Machine Learning to accelerate testing
- AI to reduce required human testing time
- Human testing of complicated vulnerabilities
Threat-aware testing scenarios
Full customization of testing
Authenticated testing
2FA & SSO support

2 Reporting

Zero False-Positives SLA
Threat-Aware Risk Scoring
Tailored Remediation Guidelines
Web Interface, PDF and XML Formats
PCI DSS and GDPR compliances
CVE, CWE and CVSSv3 scores

3 DevSecOps

Instant Start
Multirole Dashboard
24/7 Technical Support
Vulnerability Data Export
One-Click Virtual Patching via WAF (backend)

This package best suits applications of:

Size

Complexity

Criticality

Fixed price: $3,990 Report in 4 days after start All-included, no hidden costs

Equivalent of
5 days of traditional
web penetration
testing

1 Testing

Mobile app and backend testing
Multilayer Application Security Testing:
- DAST, IAST and SCA elastic scanning
- Machine Learning to accelerate testing
- AI to reduce required human testing time
- Human testing of complicated vulnerabilities
Full customization of testing
Authenticated testing
2FA & OAuth support

2 Reporting

Zero False-Positives SLA
Threat-Aware Risk Scoring
Tailored Remediation Guidelines
Web Interface, PDF and XML Formats
PCI DSS and GDPR compliances
CVE, CWE and CVSSv3 scores

3 DevSecOps

Instant Start
Multirole Dashboard
24/7 Technical Support
Vulnerability Data Export
One-Click Virtual Patching via WAF (backend)

This package best suits applications of:

Size

Complexity

Criticality

Fixed price: $6,990 Report in 6 days after start All-included, no hidden costs

Equivalent of
10 days of traditional
web penetration
testing

1 Testing

Mobile app and backend testing
Multilayer Application Security Testing:
- DAST, IAST and SCA elastic scanning
- Machine Learning to accelerate testing
- AI to reduce required human testing time
- Human testing of complicated vulnerabilities
Full customization of testing
Authenticated testing
2FA & OAuth support