About Course
Android Pentesting Course: Hack Android Apps for Bug Bounty
This Android pentesting course from TMG Security teaches you how to find security bugs in Android apps, from the basics to real bug bounty hunting. You set up a full testing lab, learn Android architecture, run static and dynamic analysis with MobSF, Burp Suite, Frida and Objection, and bypass SSL pinning. In addition, you learn to exploit activities, services, providers and insecure data storage.
- OWASP Mobile Top 10
- Static + dynamic analysis
- SSL pinning bypass
- Frida & Objection
- Bug bounty hunting
Requirements:
-
The course starts from basics, however, it is good to have basic knowledge of web applications & API pen-testing.
Topics:
- Introduction to Android Architecture
- Concept of Android Terminologies
- Android Signing Process
- Android Pentesting Setup
- Static Analysis
- Dynamic Analysis
- SSL Pinning Bypass
- OWASP Mobile TOP 10
Android Pentesting Setup
Introduction to Android Pentesting:
- Pentesting Process / Stages
- How android Pentesting works
Introduction to Android Architecture
- Android Security Architecture
- Role of Services, Activities, Permissions, etc…
- Application Security and Signing Process
Android Pentesting Setup
We will see How you can set up an Android Pentesting Lab with so many tools and their alternatives
Android Static Analysis
- Pull APK From Play Store
- How to find Hardcoded Strings
- How to find sensitive information (API-Keys, Credentials etc..)
- How to enumerate Firebase Databases
- Android Backup Exploit
- Task Hijacking
- How to Exploit Activities, Services, Providers & Broadcast Receivers.
- Insecure Platform Usage
- Insecure Data Storage
- Improper Transport Usage (Logcat)
- Automated Static Analysis MobSF
Dynamic Analysis of Android Apps
- What is SSL Pinning
- How to Bypass SSL Pinning Through various ways
- Dynamic Analysis using MobSF
- Introduction to Burp Suite / Installation
- Introduction about Frida / Objection
- Vulnerability Testing
Android Bug Bounty Hunting
- Live Android App Hunting
Benefits :
- Get ISO Certified Certification
Why choose this Android pentesting course?
Complete lab setup
First, build an Android pentesting lab with the right tools and alternatives, so you can practise on any machine.
Understand the platform
Learn Android security architecture, permissions, components and the app signing process before you attack.
Static analysis
Pull APKs, find hardcoded secrets and API keys, enumerate Firebase databases and automate checks with MobSF.
Dynamic analysis
Next, intercept traffic with Burp Suite and bypass SSL pinning in several ways using Frida and Objection.
Component exploits
Exploit activities, services, content providers, broadcast receivers, backups and task hijacking.
Mapped to OWASP
Finally, test against the OWASP Mobile Top 10 and hunt real Android bugs for bounties.
Who should take this Android hacking course?
- Bug bounty hunters who want to add Android apps to their scope.
- Web and API pentesters moving into mobile security.
- Beginners, since the course starts from the basics of Android.
- Android developers who want to build more secure apps.
Testing iPhone apps too? Take our iOS Pentesting course. For the web side, start with WAPT, or browse all TMG Security cybersecurity courses.
Android pentesting course FAQ
Is this Android pentesting course good for beginners?
Yes. The course starts from the basics. However, some knowledge of web application and API pentesting will help you progress faster.
Which tools will I use?
You will use MobSF, Burp Suite, Frida and Objection, along with other tools and alternatives for your Android lab.
Does the course cover SSL pinning bypass?
It does. You learn what SSL pinning is and how to bypass it in several different ways.
Can I use this Android pentesting course for bug bounty?
Absolutely. The final section is dedicated to Android bug bounty hunting on real applications.
Do I get a certificate?
Yes. You receive an ISO certified certificate after completing the Android pentesting course.
Course Content
Introduction to Android Penetration Testing
-
Join WhatsApp Group
