Mobile Application Penetration Testing
- Course Duration16 HRS
- Course LanguageEnglish
What you'll learn
- Understand Android and iOS platform architecture and their attack surfaces
- Build a complete mobile testing lab with emulators and real devices
- Perform static analysis by decompiling APKs and IPAs
- Perform dynamic analysis with Frida and Objection
- Intercept mobile traffic and bypass SSL pinning on Android & iOS
- Exploit insecure data storage, keychains, and databases
- Attack Android IPC components: activities, content providers, and intents
- Bypass root detection, jailbreak detection, and anti-tampering controls
- Reverse-engineer, patch, and repackage mobile applications
- Exploit the full OWASP Mobile Top 10 following MASVS/MASTG
- Write professional reports and apply secure mobile development practices
Mobile applications now handle our most sensitive data — banking, health, identity, and private communications — making them one of the richest targets in modern security. This course delivers a practical, hands-on approach to mobile application penetration testing across both Android and iOS, taking you from understanding platform internals all the way to discovering, exploiting, and remediating real vulnerabilities.
Using a fully-equipped lab with emulators, rooted and jailbroken devices, and industry tools like Burp Suite, Frida, Objection, MobSF, and jadx, you will learn to perform static and dynamic analysis, bypass SSL pinning and root/jailbreak detection, attack insecure data storage, abuse platform components, and exploit the full OWASP Mobile Top 10. Every attack is aligned with the OWASP MASVS/MASTG standard and paired with its defensive countermeasure.
By the end of this course, you will be able to conduct a complete professional penetration test against any Android or iOS application, reverse-engineer and tamper with mobile binaries, write a structured report of findings and risks, and deliver actionable remediation — leaving you fluent in both offense and defense.
Disclaimer: This course is intended strictly for educational and authorised security testing purposes. All attacks are performed within isolated lab environments. Unauthorised use of any technique taught in this course is illegal and strictly prohibited.
Course content
01Welcome to the Course2 lectures
- Important Before You Start
- Course Roadmap & Objectives
02Mobile Application Fundamentals7 lectures
- Mobile App Architecture Overview
- Native vs Hybrid vs Web Apps
- Android Platform Architecture
- iOS Platform Architecture
- The Mobile Attack Surface
- OWASP Mobile Top 10 Overview
- Introduction to OWASP MASVS & MASTG
03Building Your Mobile Testing Lab8 lectures
- Introduction to Virtualization
- Setting Up Kali Linux
- Installing Android Studio & Emulator
- Setting Up a Rooted Android Device
- Setting Up an iOS Testing Environment
- Installing Burp Suite & Configuring the Proxy
- Installing Frida & Objection
- Very Important
04Android Application Basics5 lectures
- Understanding the APK Structure
- AndroidManifest.xml Explained
- Android Components (Activities, Services, etc.)
- Dalvik & ART Runtime
- Android Permissions Model
05Static Analysis of Android Apps5 lectures
- Decompiling APKs with jadx & apktool
- Reading Smali Code
- Hardcoded Secrets & API Keys
- Analyzing the Manifest for Misconfigurations
- Using MobSF for Automated Analysis
06Dynamic Analysis of Android Apps5 lectures
- Intercepting HTTPS Traffic
- Bypassing SSL Pinning
- Runtime Instrumentation with Frida
- Using Objection for Runtime Exploration
- Logcat & Runtime Monitoring
07Android Data Storage Attacks5 lectures
- Insecure Data Storage (OWASP M9)
- Attacking Shared Preferences
- Attacking SQLite Databases
- Extracting Data from Internal & External Storage
- Analyzing Backup & Cache Data
08Exploiting Android Components (IPC)5 lectures
- Attacking Exported Activities
- Abusing Content Providers
- Exploiting Broadcast Receivers
- Intent Injection & Deep Link Abuse
- Insecure Service Exposure
09Android Authentication & Cryptography Flaws4 lectures
- Weak Authentication & Session Handling
- Insecure Cryptography (OWASP M5)
- Bypassing Root Detection
- Bypassing Biometric Authentication
10iOS Application Basics4 lectures
- Understanding the IPA Structure
- iOS App Sandbox & Security Model
- Info.plist & Entitlements
- Objective-C vs Swift Basics
11Static Analysis of iOS Apps4 lectures
- Extracting & Decrypting IPAs
- Class Dumping & Binary Analysis
- Analyzing Property Lists & Keychain
- Hardcoded Secrets in iOS Apps
12Dynamic Analysis of iOS Apps4 lectures
- Setting Up a Jailbroken Device
- Intercepting iOS Traffic
- Bypassing SSL Pinning on iOS
- Runtime Manipulation with Frida on iOS
13iOS Data Storage & Keychain Attacks4 lectures
- Insecure Data Storage on iOS
- Attacking the iOS Keychain
- Analyzing NSUserDefaults & Core Data
- Extracting Sensitive Files
14Network & API Attacks in Mobile4 lectures
- Analyzing Mobile API Traffic
- Insecure Communication (OWASP M3)
- Attacking Backend APIs
- Man-in-the-Middle Attacks
15Reverse Engineering & Code Tampering4 lectures
- Reverse Engineering Mobile Apps
- Patching & Repackaging APKs
- Bypassing Anti-Tampering Controls
- Code Injection Techniques
16Client-Side Injection & Business Logic3 lectures
- WebView Vulnerabilities
- Client-Side Injection Attacks
- Business Logic Flaws in Mobile Apps
17Automating Mobile Security Testing3 lectures
- Automated Scanning with MobSF
- Frida Scripting for Automation
- Useful Mobile Pentest Tools
18Reporting & Remediation3 lectures
- Writing a Professional Mobile Pentest Report
- Risk Rating & CVSS Scoring
- Remediation Best Practices
19Mobile Security Best Practices (Defense)4 lectures
- Secure Mobile Development Principles
- Secure Data Storage & Cryptography
- Certificate Pinning & Secure Communication
- Hardening Against Reverse Engineering
Requirements
- A computer with at least 16GB RAM and virtualization support (SSD recommended)
- At least 60GB of free disk space for emulators and lab tools
- Basic familiarity with HTTP, Linux, and general security concepts (helpful but not required)
- A stable internet connection to download tools, SDKs, and lab apps
Who this course is for
- Penetration testers and bug bounty hunters who want to specialise in mobile security
- Android and iOS developers who want to build more secure applications
- Cybersecurity professionals expanding into mobile application security
- Students and beginners with basic security knowledge entering mobile pentesting