AndroidAdvanced

Android Application Security

A structured Android internals-to-exploitation course with content, an embedded rooted Android VNC, live logcat, an adb shell, and APK upload built into each lesson. Covers AOSP, Binder IPC, reversing, fuzzing, ARM64 and heap exploitation, and the kernel.

VBD

28 sections165 lessons28 labs95h

Get Access Sign Up Free

Course Curriculum

28 sections · 165 lessons

Android Security Architecture & Threat Model7 lessons

The Android stack: Linux kernel → HAL → ART runtime → framework → apps

PreviewTheory

Lab Setup & The Android Toolkit9 lessons

Your in-browser device and AttackBox: how they connect

Theory

ADB mastery: shell, install, pull, push, logcat, am, pm, run-as

Theory

Filesystem monitoring and the Android sandbox layout from the inside

Theory

The static toolkit: jadx, apktool, MobSF

Theory

The dynamic toolkit: Frida, Objection, Burp

Theory

The native toolkit: Ghidra, LLDB

Theory

Getting apps: pulling APKs, third-party sources, handling split/bundle APKs

Theory

Rooting emulators and physical devices; local setup (Windows/macOS/Kali)

Theory

Lab: Pull a split-APK target off the device, merge it, and open it in jadx

Lab

Build Your First App (The Developer's View)6 lessons

Android Studio project setup and the app layout

Theory

Handling button clicks and app lifecycle basics

Theory

Sending and receiving Intents between apps

Theory

Decompiling your own app: source, Smali, and behavior

Theory

Building a reusable PoC attacker app template

Theory

Lab: Build a clicker app, send it an intent from another app, then decompile it

Lab

APK Deep Dive & Reverse Engineering7 lessons

APK anatomy: AndroidManifest.xml, classes.dex, resources, assets, native libs

Theory

Decompiling to Java/Kotlin with jadx (GUI and CLI); disassembling to Smali with apktool

Theory

Reading Smali bytecode: registers, method calls, control flow

Theory

Resolving string and resource references back to readable values

Theory

Diffing application updates to find newly introduced code and fixes

Theory

Saving jadx projects and scripting the CLI for scale

Theory

Lab: Reverse a target app and recover its hidden logic flow

Lab

Static Analysis & Secret Hunting7 lessons

Manifest analysis: exported components, android:debuggable, allowBackup, custom permissions

Theory

Finding hardcoded secrets, API keys, and endpoints

Theory

Enumerating exposed cloud backends: Firebase databases and AWS S3 buckets

Theory

Automated static analysis with MobSF

Theory

AI/MCP-assisted reverse engineering (jadx-MCP and apktool-MCP workflows)

Theory

Defeating common obfuscation: string/identifier obfuscation, packers (intro)

Theory

Lab: Recover four staged flags (hardcoded string → config → Firebase → bucket)

Lab

Patching, Re-Signing & Smali Debugging6 lessons

apktool decode → edit → rebuild → re-sign workflow

Theory

Patching Smali logic: flipping a check, removing a guard

Theory

Making an app debuggable and abusing run-as

Theory

Live debugging and patching Smali in the jadx-GUI debugger

Theory

Automated patching with Objection (patchapk)

Theory

Lab: Patch a premium locked app to unlock its hidden flag

Lab

Network Interception & SSL Pinning Bypass6 lessons

Android networking and the Network Security Config

Theory

Routing device traffic through Burp; user vs. system CA store (Android 14+ changes)

Theory

Packet logging with tcpdump and analysing captured API traffic

Theory

Defeating SSL pinning: NSC patch, Objection, Frida hooks (OkHttp/SSLContext)

Theory

Intercepting proxy-unaware apps; abusing the VPN API; DNS spoofing and transparent proxying

Theory

Lab: Bypass pinning on a target app and pull the flag from its API call

Lab

Dynamic Instrumentation with Frida7 lessons

Frida architecture and the JavaScript injection model

Theory

Running frida-server; spawning vs. attaching

Theory

The REPL: enumerate classes, instantiate objects, call methods

Theory

Scripts: Java.perform, hooking methods, reading and tampering args and return values

Theory

Tracing with frida-trace including into JNI/native functions; the Frida CodeShare

Theory

Objection for rapid scripted assessment

Theory

Lab: Beat the Dice Game / 2048 — hook the app to force a winning value

Lab

Android Permissions In Depth6 lessons

Exported vs. non-exported components

Theory

Normal, dangerous, signature, and custom permissions

Theory

The real security boundary of a permission

Theory

Protecting components and broadcasts with permissions

Theory

Using permissions to identify high-value attack targets

Theory

Lab: Use a custom-permission misconfiguration to reach a protected component's flag

Lab

Exploiting Activities & Intents6 lessons

Intents, the Binder, and how an Intent travels between apps

Theory

Exported vs. non-exported activities; unauthorized access to internal screens

Theory

Intent spoofing and data leakage via activity results

Theory

Implicit Intent hijacking and Pending Intent delegation abuse

Theory

Mitigations and how to verify them

Theory

Lab: Launch a protected activity directly via adb am start to capture its flag

Lab

Deep Links & App Links5 lessons

Custom schemes, intent: URIs, and the browser-to-app surface

Theory

Discovering deep links from the manifest

Theory

Hijacking deep-link intents and scheme collisions

Theory

Verified App Links and Digital Asset Links

Theory

Lab: Craft a malicious deep link that drives the app to leak a flag

Lab

Content & File Providers6 lessons

ContentProvider internals and query() mechanics

Theory

SQL injection in content providers

Theory

Hijacking provider access and GRANT_READ_URI_PERMISSION abuse

Theory

AndroidX FileProvider: insecure root-path configs, path/ZIP traversal, write access

Theory

FileProvider receiver exploitation (real 0day patterns, e.g. Flipper Zero)

Theory

Lab: Exploit a vulnerable provider to read another app's private database

Lab

Broadcast Receivers5 lessons

The broadcast threat surface: static vs. dynamic receivers

Theory

Sending broadcasts to exported receivers

Theory

Intercepting and redirecting broadcasts

Theory

Abusing system-event and protected broadcasts; app widgets and notifications

Theory

Lab: Trigger an exported receiver to perform a privileged action and reveal the flag

Lab

Android Services & AIDL6 lessons

Identifying exposed, bindable, and non-bindable services

Theory

Message Handler services

Theory

Recognising and reversing .aidl definitions

Theory

Auditing exposed AIDL functionality for dangerous methods

Theory

Binding to an AIDL service (with .aidl file and via ClassLoader)

Theory

Lab: Build a malicious client that binds to a target AIDL service and invokes a hidden method

Lab

UI-Level Attacks: Tapjacking, Overlays & Task Hijacking5 lessons

Tapjacking and overlay attacks (SYSTEM_ALERT_WINDOW)

Theory

Accessibility-service abuse for UI control and input capture

Theory

Task hijacking and StrandHogg (taskAffinity abuse)

Theory

Screen-capture, screenshot, and FLAG_SECURE bypass considerations

Theory

Lab: Build an overlay that captures a victim app's input to recover the flag

Lab

Insecure Data Storage6 lessons

Storage overview: internal vs. external vs. scoped storage

Theory

SharedPreferences, the cache, and the ./files directory

Theory

Internal SQLite databases (and SQLCipher)

Theory

External and Manage External Storage risks

Theory

Backup-flag extraction and restoring app data

Theory

Lab: Browse a target app's sandbox over ADB and exfiltrate its stored secret

Lab

Insecure Cryptography4 lessons

Common crypto failures: ECB, static IVs, hardcoded keys, weak KDFs

Theory

The Android Keystore and hardware-backed keys

Theory

Recovering keys and plaintext with Frida hooks on crypto APIs

Theory

Lab: Hook the app's decryption routine to recover an encrypted flag

Lab

Authentication, Biometrics & Cloud Auth4 lessons

Biometric authentication implementation and runtime bypass

Theory

Insecure local authentication and broken access-control patterns

Theory

Cloud authentication attacks (e.g. Amazon Cognito misconfigurations)

Theory

Lab: Bypass a biometric/local-auth gate with Frida to reach a protected screen flag

Lab

Mobile Fraud, Privacy & Side-Channel Attacks6 lessons

Sensitive data leakage via device logs and app backgrounding

Theory

Clipboard, keyboard-cache, and screenshot leakage

Theory

OTP-interception scams and how to mitigate them in code

Theory

Device-reset attacks and protections

Theory

Location tracking and runtime location-spoofing bypass

Theory

Lab: Chain a logging + backgrounding side channel to capture leaked data

Lab

WebViews & CustomTabs6 lessons

WebViews vs. CustomTabs vs. Trusted Web Activities

Theory

@JavascriptInterface: the JS-to-Java bridge as an attack surface

Theory

Local file access and stealing app-internal files (file://, SOP settings)

Theory

Cross-site scripting in WebViews (real Acode 0day pattern)

Theory

WebView Intent handling and Digital Asset Link verified origins

Theory

Lab: Exploit a vulnerable WebView to exfiltrate an app-private file flag

Lab

Cross-Platform Apps: Flutter & React Native5 lessons

Why Flutter/RN defeat standard proxying (no system proxy, custom TLS)

Theory

Flutter traffic interception and manual TLS bypass; Frida and reFlutter

Theory

Reverse engineering Dart snapshots

Theory

React Native: unpacking and reading the JS bundle (index.android.bundle)

Theory

Lab: Intercept a Flutter app's traffic and recover its hidden API flag

Lab

Bluetooth / BLE & IoT App Reverse Engineering6 lessons

BLE basics: GATT, services, and characteristics

Theory

Enabling the HCI snoop log and loading it in Wireshark

Theory

Reversing the app's BLE connection and login code

Theory

Finding and decrypting the BLE traffic/protocol

Theory

Building a BLE attack app (e.g. unlocking a smart lock)

Theory

Lab: Reverse a BLE app's protocol and recover the unlock secret

Lab

Native Code & Advanced Reverse Engineering6 lessons

JNI: how Java calls native code, and where to hook it

Theory

Reversing native libraries with Ghidra; cross-compiling native code for Android

Theory

Debugging native code on Android with LLDB; tracing native library calls

Theory

Defeating native-layer obfuscation

Theory

Reverse-engineering and fuzzing third-party native libraries

Theory

Lab: Hook a JNI function to recover a flag computed in native code

Lab

Anti-Reversing Defenses: Root Detection, RASP & Play Integrity6 lessons

Root, emulator, and debugger detection (and bypasses)

Theory

VPN/proxy detection bypass

Theory

RASP bypass with Frida, reFlutter, and renef-style Java hooking

Theory

Google Play Integrity API: verdicts, implementation, and limitations

Theory

Hardware-assisted memory safety (MTE) detection

Theory

Lab: Defeat a layered root-detection + RASP gate to run the app on the rooted device

Lab

Android Malware Analysis & Red Teaming6 lessons

Anatomy of Android malware; safe analysis and where to source samples

Theory

Accessibility-service malware and on-device fraud techniques

Theory

Backdooring legitimate APKs (msfvenom/Metasploit payload injection)

Theory

Generating and deploying a payload APK; post-exploitation with the Ghost Framework

Theory

Triaging and reversing obfuscated malware (manual + AI-assisted)

Theory

Lab: Backdoor a benign APK, deploy it to the device, and catch the callback

Lab

OWASP MASVS, MASTG & the Mobile Top 105 lessons

The OWASP Mobile Top 10 (M1–M10), mapped to this path's modules

Theory

OWASP MASVS: the mobile app security verification standard

Theory

OWASP MASTG: structured testing procedures and the test checklist

Theory

Producing a standards-aligned assessment

Theory

Lab: Run a MASTG checklist pass against a target app

Lab

Bug Bounty Methodology & Reporting6 lessons

Google's Android and Mobile VRP (scope and differences)

Theory

Breadth-first hunting: gathering in-scope apps and fast threat-surface triage

Theory

Depth-first hunting: deep-diving an app, update-diffing, and variant analysis

Theory

Scaling with Oversecured-style scanning

Theory

Building a clean PoC app and writing reports that get paid

Theory

Lab: Run a structured breadth-first triage on a set of apps and log findings

Lab

Capstone: Full Android App Assessment5 lessons

Brief: one target app, one objective, no walkthrough

Theory

Static recon → component mapping → dynamic attack

Theory

Defeat pinning/root-detection → exploit the chain → exfiltrate

Theory

Document the full kill chain in a MASTG-aligned professional report

Theory

Lab: Complete the capstone and submit your assessment report

Lab

Full access requires enrollment

Labs, theory lessons, videos, and progress tracking are available after getting access.

Get Access Create Free Account