Introduction - the basics
  • About the Author
  • What to expect from this course
  • Join Our Online Classroom!
Android Development Tools
  • Android Studio
  • AVD Manager is missing? ADB Connection and Monitor in Android Studio 3.5/newer
  • Android Debug Bridge (ADB)
Environment Setup
  • Android emulator or Android Device?
  • Android rooting
  • Setting up a Proxy for Android
  • Installing CA Certificate
  • Virtual Machine Download
  • Android Vulnerable Application Setup
Android Application Review. Reverse Engineering and App Analysis
  • APK file Structure. AndroidManifest XML file
  • Reversing to get Source code of the Application - decompiling with dex2jar
  • Reversing and Re-compiling With APKTool
  • APK Teardown in a Nutshell using Dexplorer on your Android Device
  • Static vs Dynamic Analysis
  • Static Analysis of Android Application using QARK
  • Dynamic Analysis of Android Application using Inspeckage and Xposed
  • MobSF - Mobile-Security-Framework. Malware analysis
  • Automated Security Assessments with Drozer
  • Intercept traffic using Wireshark and tcpdump
  • Intent Sniffing
  • Fuzzing using Burp - Password Brute-Force. Username enumeration
Bypass Certificate Pinning
  • General Description
  • Automatic bypass of certificate pinning
  • Manual bypass of certificate pinning
Next Steps and Conclusions
  • Bonus - Take control over an Android phone using metasploit
  • Penetration Testing Cheat Sheet
  • OWASP Top 10 Mobile Vulnerabilities and Attacks
  • Further research - Automatic and Manual Scanning for Vulnerabilities
  • For Developers - Android Security Guidlines
  • Bonus - Easily download any APK file from Google Play directly on your PC
  • Final Words
(Bonus) Web Penetration Testing
  • Further information
  • Core Problems - Why Web Security
  • Spider and Analyze a Website using Burp
  • Brute-frocing Web Resources using Dirb and Dirbuster
  • SQL injection
  • Exploiting SQLi using Sqlmap and Getting Remote Shell
  • Upload and Remote File Execution
(Bonus) Learn Burp for advanced mobile and web pentesting
  • Alternative setup - Download Burp. Free vs Paid
  • Proxy - General Concept
  • Target Module
  • Proxy Module - part 1
  • Proxy Module - part 2