(929) 590-5818 [email protected]
en
en

Pentesting of Mobile App and Internal Network

Client:
The private investor in Ukraine’s energy sector
 
Industry:
Energy
Focus:
Security assessment of mobile applications and network infrastructure as part of the annual audit
 
Main challenge:
Identifying potential vulnerabilities that could lead to data leakage
Market:
Local (Ukraine)
Services provided:
Mobile app pentesting, infrastructure pentesting
 
Key Takeaways
  • Critical, medium, and low vulnerabilities were identified
  • Risks were demonstrated through public Wi-Fi access
  • Gray-box and white-box penetration tests were conducted using both automated and manual methods
  • A report was prepared with recommendations to strengthen cybersecurity
    • 2
    strategies used for penetration testing
    < 5
    weeks total testing time
    A report
    with recommendations was prepared
    Pentesting of Mobile App and Internal Network
    Mar 7, 2025
    How can you be sure your critical infrastructure is truly secure? Penetration testing is one of the most effective ways to verify it in practice. During a scheduled security assessment, Datami specialists discovered several vulnerabilities in the client company’s mobile applications and internal infrastructure. Thanks to the penetration test, a potential data breach was prevented.

    A major energy corporation in Ukraine operates across the full energy cycle: generating electricity from solar, wind, and thermal power plants; extracting coal and gas; engaging in energy trading; distributing electricity; and developing a nationwide network of charging stations.

    The company operates in the field of critical infrastructure, processes confidential personal and corporate data, and complies with regulatory requirements, making information security a strategic priority.

    Tasks and challenges
    Datami was engaged to conduct a scheduled penetration test of mobile applications and internal infrastructure as part of an annual security assessment. The objective was to identify potential threats to digital assets that process confidential information and to provide technical recommendations for strengthening the protection of critical infrastructure.
    • Conduct gray-box penetration testing of mobile applications for clients and employees
    • Test the internal network (white-box), including Wi-Fi, with a focus on access policies
    • Provide a technical report with findings and recommendations to mitigate risks
       
    icon
    Web pentest + mobile pentest
    Gray-box testing with user and administrator accounts
    icon
    Infrastructure pentest
    Review of network restrictions, access controls, and security configurations
    icon
    Report and recommendations
    Document with identified risks and recommendations for mitigation
    Datami Methodology: Security Assessment of Critical Infrastructure
    Our approach

    A combined penetration test was conducted using both gray-box and white-box approaches. We applied both static and dynamic analysis, combining manual and automated methods. Constant communication with the client was maintained, as unstable application performance complicated the testing process.

    During testing, the team managed to bypass corporate network restrictions and discovered Wi-Fi access through an unprotected device. This made it possible to demonstrate real attack vectors.

    White-box
    White-box
    Internal infrastructure testing with access to network configurations and policies
     
    Gray-box
    Gray-box
    Mobile application testing using administrator and user accounts, without full access to the source code
     
    Key work stages and solutions

    The Datami team first conducted static and dynamic testing of the mobile applications, followed by an assessment of the company’s internal infrastructure, with particular focus on the Wi-Fi network and access policies. During the process, the team had to adapt to technical issues with the applications and clarify testing scenarios.

    • Preparation
      Analysis of initial data, access levels, and testing scenarios; selection of tools for mobile and network testing
       
    • Security testing
      Gray-box testing of mobile applications and white-box assessment of Wi-Fi and internal network; network restriction bypass; detection of configuration vulnerabilities
       
    • Analysis and reporting
      Preparation of a technical report detailing critical and medium vulnerabilities, along with recommendations for mitigation
       
    Cybersecurity starts with action
    How we can help you?

    Every cybersecurity case study we solve involves deep analysis, tailored solutions, and measurable results.
    Datami has already helped over 600 companies strengthen their digital defenses — and we can do the same for your business.
    Ready to take action?

    Let’s start with a free consultation!
    Results and recommendations
    Fewer critical risks — more confidence
    Results and recommendations

    During the security assessment at , the Datami team identified several critical, as well as a number of medium and low vulnerabilities in mobile applications and internal infrastructure. Some of the risks were related to network access and security policy configurations. During the testing process, our penetration testers also noted issues in application functionality.

    As a result, the client received a detailed technical report and a recommended action plan, including:

    1. Remediation of vulnerabilities in mobile applications
    2. Restriction of Wi-Fi access and protection of public devices
    3. Review and update of network access policies
    4. Strengthening control over internal privileges

    After implementing the recommendations, a reduction in the risk of data leakage and unauthorized access is expected.

    Our certificates
    Key project results

     

    As a result of the collaboration with Datami, the organization received a detailed technical report, an assessment of the security level of its mobile applications and network infrastructure, and recommendations for vulnerability remediation.

    The testing was completed within the planned timeframe — 4–5 weeks.

    This case study confirms the importance of regular penetration testing for critical infrastructure companies — both for security control and regulatory compliance.

    Direction
    Before the project
    After implementation
    Security status
    Limited visibility into mobile applications and the network
    A number of critical, medium, and low vulnerabilities identified; remediation plan developed
    Critical vulnerabilities
    Not previously detected or considered
    Identified during the penetration test
    Wi-Fi access
    Public devices could store confidential passwords
    Recommended to restrict access and review interaction points
    Security compliance
    Partial compliance with expectations
    Improved transparency and access control
    Timeline
    Planned — 4–5 weeks
    Completed on time, including additional checks
    More success stories with Datami
    Browse other project case studies
    Pentest and Protection of Platform from DDoS

    Pentest and Protection of Platform from DDoS

    • Discovered 30 vulnerabilities in two web applications
    • Implemented DataGuard and Cloudflare for DDoS protection
    Services:
    Black-box web app pentesting, implementation of Dataguard
    Jul 8, 2025
    P2P Platform Case Study: Comprehensive Security and GDPR Compliance Audit

    P2P Platform Case Study: Comprehensive Security and GDPR Compliance Audit

    • Identified 10 vulnerabilities, including 3 critical ones
    • Improved GDPR compliance and avoided potential financial losses of up to $300,000
    Services:
    Penetration testing, smart contract audit, code security review, testing for SQLi, XSS, and RCE vulnerabilities, OSINT analysis, and cloud infrastructure security assessment
    Jun 27, 2025
    Case Study: Consulting Company – Security Testing of Web Resources and Infrastructure

    Case Study: Consulting Company – Security Testing of Web Resources and Infrastructure

    • Conducted black-box pentest of two web resources and infrastructure components
    • Identified 19 vulnerabilities: 1 critical, 8 medium, 7 low, and 3 informational
    Services:
    Black-box pentest of two web resources with different domain zones (UA and UK), and assessment of related infrastructure components
    Jun 6, 2025
    Back to home page
    Security image
    Ready to assess your project's security?
    Contact Datami — we’ll help you identify risks, strengthen your cybersecurity, and confidently pass certification.
    Datami articles
    The Enemy Within: Top 5 Insider Cyber Threats for Companies in 2025 Datami Newsroom
    Datami Newsroom

    The Enemy Within: Top 5 Insider Cyber Threats for Companies in 2025

    Company leaders often greatly underestimate insider cyber threats - yet it is employee actions, even unintentional ones, that can lead to catastrophic consequences.

    Jul 8, 2025 3 min
    Top 5 Companies That Refused to Pay Hackers a Ransom Datami Newsroom
    Datami Newsroom

    Top 5 Companies That Refused to Pay Hackers a Ransom

    In May 2025, hackers breached Coinbase, stole data, and demanded a ransom. But the crypto exchange turned to law enforcement for help. This is just one example of how companies are standing up to cyber extortion.

    Jul 4, 2025 3 min
    Top 5 Cybersecurity Trends in 2025: What Should You Be Ready For? Datami Newsroom
    Datami Newsroom

    Top 5 Cybersecurity Trends in 2025: What Should You Be Ready For?

    Cybersecurity faces the challenge of rapidly advancing tech. To stay ahead, it’s not enough to follow innovations – we must anticipate them. Forecasting 2025 trends gives a glimpse into the digital future and helps prepare for what’s ahead.

    Jul 2, 2025 3 min
    Show all articles
    Order a free consultation
    By submitting this form, I confirm that I have read and agree to the Privacy policy
    We value your privacy
    We use cookies to enhance your browsing experience, serve personalized ads or content, and analyze our traffic. By clicking "Accept All", you consent to our use of cookies. Cookie policy