Kenya's president has said security forces confronting militants in a Nairobi shopping mall have located the attackers in one part of the building and now have "as good a chance to successfully neutralise the terrorists as we can hope for".

As the standoff with gunmen who killed at least 59 people entered a second day and explosions and gunfire were heard, Uhuru Kenyatta said Kenya would seek to conclusively establish who was responsible for the attack and "swiftly and indeed painfully" punish the masterminds.

The Somali Islamist group al-Shabaab claimed responsibility for the attack on the Kenyan capital's Westgate mall, which is frequented by westerners as well as Kenyans. Several foreigners, including at least three Britons, two French women, a Canadian diplomat and the Ghanaian poet Kofi Awoonor were among the dead.

A rescuer carries a child to safety at the Westgate mall in Nairobi, Kenya, after an attack claimed by al-Shabaab militants. Photograph: Kabir Dhanji/EPA

Kenya's Red Cross said in a statement citing police that 49 people had been reported missing. Officials did not make an explicit link but that number could form the basis of the number of people held hostage. "The priority is to save as many lives as possible," said the interior minister, Joseph Lenku, reassuring the families of the hostages.

Kenyatta, facing his first major security challenge since his election in March, said the dead included his nephew and his nephew's fiancee – "young lovely people I personally knew and loved".

The attack began when heavily armed militants pulled up in several cars and shot their way into the most upmarket shopping centre in Nairobi, ordering Muslims out if they could prove their religion by reciting a prayer or answering a question on Islam. They started killing those who failed the test.

A Kenyan woman is helped to safety. Photograph: Simon Maina/AFP/Getty Images

Shoppers, expatriates and rich Kenyans fled in any direction that might be safe: into back corners of stores, back service hallways and bank vaults. Over the next several hours, pockets of people poured out of the mall as undercover police moved in. Some of the wounded were being transported in shopping trolleys.

The dead included children, and the wounded ranged in age from two to 78. Many victims were at a cooking competition when assailants stormed in with automatic rifles, witnesses said. Blood lay in pools in the mall. Shop windows were shattered.

Following similar methods to the 2008 terror attack in Mumbai, the assailants barricaded themselves in different shops in the multistorey centre. One wounded gunman was arrested, but later died in hospital.

A wounded woman outside the shopping centre in Nairobi. Photograph: Simon Maina/AFP/Getty Images

As shoppers inside the mall made their way to safety, witness accounts of the attack began to emerge. The gunmen carried AK-47s and wore vests with hand grenades on them, said Manish Turohit, 18, who hid in a parking garage for two hours.

"They just came in and threw a grenade. We were running and they opened fire. They were shouting and firing," he said after marching out of the mall in a line of 15 people who all held their hands in the air.

Frank Mugungu, an off-duty army sergeant major, said he saw four male attackers and one female attacker. "One was Somali. The others were black," he said.

"We started by hearing gunshots downstairs and outside. Later we heard them come inside. We took cover. Then we saw two gunmen wearing black turbans. I saw them shoot," said Patrick Kuria, an employee at Artcaffe, a restaurant with shady outdoor seating.

The attack took place in the Westgate shopping centre in Nairobi. Photograph: Observer

Hannah Chisholm, a Briton visiting Nairobi, told the BBC she and dozens of others barricaded themselves into a large storeroom. "We kept running to different places but the shots were getting louder so we barricaded ourselves along with about 60 others into a large storeroom," she said. "There were children with us as well as someone who had been shot. The gunfire was loud and we were scared but at that point we thought the gunmen were thieves so we assumed they wouldn't try to reach the storeroom."

Al-Shabaab claimed responsibility via a Twitter account. The spokesperson claimed the atrocity was in response to the presence of Kenyan troops in Somalia: "The attack at #WestgateMall is just a very tiny fraction of what Muslims in Somalia experience at the hands of Kenyan invaders," the account stated. "For long we have waged war against the Kenyans in our land, now it's time to shift the battleground and take the war to their land." It continued by saying that the Kenyan government was "pleading with our mujahideen inside the mall for negotiations. There will be no negotiations whatsoever."

Civilians who had been hiding walk to safety with their hands up. Photograph: Jonathan Kalan/AP

Kenya has been braced for an attack of this kind since it intervened in the war against al-Shabaab in Somalia by sending an expeditionary force in 2011. Since then Kenyan troops have succeeded in expelling the jihadists from the southern Somali port city of Kismayo and installing a former warlord friendly to the government in Nairobi.

The mall's ownership is Israeli, and security experts have long said the structure would make an attractive terrorist target.

Hospitals in Nairobi were overwhelmed by the number of wounded being brought in following the attack. However, officials said that Kenyans turned out in droves to donate blood and long queues had formed with further volunteers.

The Westgate shopping mall in Nairobi. Photograph: Thomas Mukoya/Reuters

Kenyan authorities said they have thwarted other large-scale attacks targeting public spaces, including, in September 2012, the disruption of a major terrorist attack in its final stages of planning. They arrested two people with explosive devices and a cache of weapons and ammunition.

The anti-terror police unit boss Boniface Mwaniki said vests found were similar to those used in attacks that killed 76 people in Uganda who gathered to watch the soccer World Cup finals on TV in July 2010. Al-Shabaab claimed responsibility for those bombings, saying the attack was in retaliation for Uganda's participation in the African Union's peacekeeping mission in Somalia.