06Android Application Penetration Testing

Break Android apps the professional way: OWASP Mobile Top 10, static and dynamic analysis, SSL pinning bypass, validation, retesting and report writing.

  • 16 live classes
  • Taught in Telugu
  • 1 hour each
  • Certificate
Book a free demo See the syllabus Android App Pentesting syllabus (PDF) or download the full syllabus (all 8 courses)
Outcomes

After this course, you can…

01

Decompile and analyse any APK

02

Find insecure storage, deep links, logging and network flaws

03

Bypass SSL pinning with Frida and write a full VAPT report

Syllabus

Every topic you'll cover.

9 modules · 45 topics.

01Introduction to Android VAPT6 topics
  • What is Android application penetration testing
  • Vulnerability assessment vs penetration testing
  • Mobile bug hunting methodology
  • Native app vs web app
  • Android app architecture: APK, DEX, Manifest
  • App components
02Lab Setup6 topics
  • Android Studio + emulator (AOSP API 29)
  • JADX-GUI
  • MobSF
  • Burp Suite
  • Frida + Objection
  • Build and install the ACEP Tech Academy app
03OWASP Mobile Top 10 (2024)10 topics
  • M1 Improper Credential Usage
  • M2 Inadequate Supply Chain Security
  • M3 Insecure Authentication/Authorization
  • M4 Insufficient Input/Output Validation
  • M5 Insecure Communication
  • M6 Inadequate Privacy Controls
  • M7 Insufficient Binary Protections
  • M8 Security Misconfiguration
  • M9 Insecure Data Storage
  • M10 Insufficient Cryptography
04Static Analysis5 topics
  • Decompiling the APK with JADX
  • Reading AndroidManifest.xml
  • Automated scanning with MobSF
  • Hardcoded credentials
  • Hardcoded API keys
05Dynamic Analysis (ADB)4 topics
  • SQL injection login bypass
  • Insecure deep links
  • Sensitive data in Logcat
  • Unauthenticated debug mode
06Local Storage Attacks3 topics
  • Plaintext password storage
  • World-readable external storage
  • Unprotected certificate export
07Manifest & Configuration4 topics
  • Exported broadcast receivers
  • allowBackup
  • Cleartext traffic
  • Debuggable build + unencrypted database
08Network Security Testing4 topics
  • Burp Suite interception
  • Insecure WebView SSL bypass
  • SSL/TLS certificate pinning
  • Bypassing SSL pinning with Frida & Objection
09Reporting3 topics
  • Vulnerability validation and retesting
  • Remediation guidance
  • Writing a full VAPT report
Free live demo

See it live before you join.

Saturday 6–7 PM · Sunday 11 AM–12 PM · Sunday 7–8 PM (IST). Fees and batch dates are shared in the demo.

Book on WhatsApp +91 81250 59380