Lab Setup
  • Installing Python and Android Studio
  • Setting up Decompilation Tools
  • Setting up the Insecure Bank App
  • Creating a Rooted Emulator
Information Gathering
  • Setting up Burp Suite for Android
  • Analyzing Server Interaction with Burp Suite
  • Pulling Apk Files from Android Devices
  • Decompiling APKs with Apktool and Dex2Jar
  • Installing Drozer and Scanning Attack Surfaces
APK modification exploits
  • Modifying Resource Files to Gain Escalated Privileges
  • Modifying Smali Code to Bypass Root Detection
Insecure Authentication Exploits
  • Login Backdoors
  • Exploting Unprotected Activities
Insecure Storage Exploits
  • Exploiting Poorly Implemented Cryptography
  • Analyzing SQLite Storage
  • Analyzing Logcat for Information Disclosures
Broadcast and Content Provider Exploits
  • Exploiting Broadcast Receivers
  • Exploiting Content Providers
General Bug Bounty Tips
  • CVSS Scoring and Report Tips
Bonus Resources
  • Bonus Resources
  • Learn More For Free!