Android Application

Security Testing Course

APK to API Security Testing - Practical Course Outline

Bug Bounty | VAPT | Mobile Security

Practical Android App Security Testing

Static Analysis | Dynamic Analysis | API Testing | Frida Basics

Android Application Security Testing Course

Android Application Security Testing

Course

Prerequisites
- Basic Linux commands
- Basic Burp Suite knowledge
- Basic HTTP request/response understanding
- Android phone ya emulator
- Laptop with minimum 8 GB RAM

Module 1: Android Security Fundamentals

Topics
- Android architecture overview
- APK structure: [Link] , [Link], resources, native libs
- Android app components:

- Activity
- Service
- Broadcast Receiver
- Content Provider
- Android permissions
- Sandbox concept
- Debuggable apps
- Exported components
- Threat model of mobile applications
- OWASP MASVS and MASTG overview

Practical
- APK install and uninstall using ADB
- APK pull from device
- Basic package information using ADB
- AndroidManifest review
- Identifying permissions and exported components

Module 2: Lab Setup for Android Pentesting

Page 2
Android Application Security Testing Course

Tools Covered
- Android Studio Emulator
- Genymotion / Physical Android device
- ADB
- Burp Suite
- JADX-GUI
- APKTool
- MobSF
- Frida
- Objection
- apk-mitm
- apksigner / zipalign
- HTTP Toolkit optional
- Nuclei for API recon optional

Practical Setup
- Emulator setup
- Burp CA certificate install
- Proxy setup
- Rooted emulator setup
- Frida server setup
- APK decompile and recompile
- Basic MobSF scan
- Traffic interception testing

Module 3: Static Analysis of APK

Topics
- APK decompilation
- Source code review basics
- Manifest analysis
- Hardcoded secrets
- API keys
- Firebase URLs
- AWS keys
- JWT tokens
- Basic auth tokens
- Staging / dev endpoints
- Insecure permissions

Page 3
Android Application Security Testing Course

- Backup allowed issue

- Debuggable APK issue
- Cleartext traffic enabled
- Insecure WebView configuration
- Deep link declaration review

Practical
- JADX se APK source review
- APKTool se manifest review
- grep commands for secrets
- Firebase endpoint check
- Hardcoded endpoint mapping
- Insecure flags identify karna

Common Findings
- Hardcoded API key
- Exposed Firebase database/storage
- Debuggable enabled
- Backup enabled
- Cleartext traffic allowed
- Sensitive endpoint disclosure
- Insecure WebView settings

Module 4: Dynamic Analysis and Runtime Testing

Topics
- App runtime behavior
- ADB logcat analysis
- Runtime permissions
- Activity launch testing
- Exported activity testing
- Intent testing
- Sensitive data in logs
- Clipboard leakage
- Screenshot allowed on sensitive screen
- Root detection basics
- Emulator detection basics

Practical

Page 4
Android Application Security Testing Course

- adb logcat se sensitive data check

- Exported activity launch
- Deep link trigger
- Runtime error observation
- Sensitive screen screenshot check
- App data folder analysis on rooted device

Common Findings
- OTP/token in logs
- Sensitive user data in logs
- Exported activity access
- Unauthorized screen opening
- Sensitive data visible in clipboard
- Insecure local files

Module 5: Local Storage Testing

Topics
- SharedPreferences
- SQLite database
- Room database
- Realm database
- Internal storage
- External storage
- Cache files
- EncryptedSharedPreferences overview
- Android Keystore overview
- Token storage mistakes
- Sensitive PII storage

Practical
- Rooted device par app data check
- SharedPreferences read
- SQLite database dump
- Cache folder review
- Token/session check
- Local storage report evidence collect karna

Common Findings

Page 5
Android Application Security Testing Course

- Plaintext access token

- Plaintext refresh token
- User email/mobile/address stored insecurely
- Card/payment related data stored locally
- Session not cleared after logout
- Sensitive cache not deleted

Module 6: Network Traffic Testing with Burp Suite

Topics
- HTTP/HTTPS interception
- Certificate pinning concept
- API request mapping
- Token-based authentication
- Authorization headers
- Replay attack
- Rate limit testing
- Parameter tampering
- IDOR/BOLA in mobile APIs
- Mass assignment
- API version testing
- Hidden endpoints from mobile app

Practical
- Burp proxy setup
- Mobile traffic capture
- API endpoint mapping
- Token replay
- User ID tampering
- Order ID / booking ID / profile ID testing
- Rate limit testing on OTP/login
- Request modification
- Response comparison

Common Findings
- Broken Object Level Authorization
- Broken Function Level Authorization
- OTP brute force
- No rate limit
- Price/quantity tampering

Page 6
Android Application Security Testing Course

- Coupon abuse
- Wallet/payment logic flaw
- Sensitive data in API response

Module 7: Deep Link and Intent Security Testing

Topics
- Android deep links
- App links
- Custom URL schemes
- Intent filters
- BROWSABLE category
- OAuth callback deep links
- Open redirect via deep link
- Account takeover via insecure callback
- Sensitive action via exported intent
- Intent spoofing
- PendingIntent basics

Practical
- Deep link enumerate karna
- ADB se deep link trigger karna
- OAuth callback testing
- Malicious URL injection
- Parameter tampering in deep link
- Exported activity abuse
- Browser-to-app attack flow banana

Common Findings
- Deep link opens sensitive screen without auth
- OAuth code/token accepted from custom scheme
- Open redirect through app link
- Intent spoofing
- Unauthorized activity access
- Token leakage in URL

Module 8: WebView Security Testing

Page 7
Android Application Security Testing Course

Topics
- WebView attack surface
- JavaScript enabled risk
- File access risk
- Universal access from file URLs
- JavaScript interface abuse
- Mixed content
- Insecure external URL loading
- Open redirect to WebView
- XSS impact inside mobile app
- Deep link to WebView chain

Practical
- WebView URL parameter identify karna
- External URL load test
- JavaScript execution test
- File access misconfiguration review
- Open redirect + WebView chain
- XSS inside WebView impact analysis

Common Findings
- Arbitrary URL loading in WebView
- XSS in WebView
- JavaScript bridge exposure
- Local file access
- Token leakage through WebView
- Phishing risk inside trusted app

Module 9: Frida and Objection Basics

Topics
- Frida introduction
- Objection introduction
- Runtime method hooking
- SSL pinning bypass basics
- Root detection bypass basics
- Emulator detection bypass basics
- Runtime secret extraction
- Method tracing basics

Page 8
Android Application Security Testing Course

Practical
- Frida server run karna
- App attach karna
- Objection explore command
- SSL pinning bypass attempt
- Root detection bypass attempt
- Runtime class/method observe karna
- Basic custom Frida script

Common Use Cases

- Certificate pinning bypass
- Root detection bypass
- Runtime token observation
- Hidden method behavior check
- Security control validation

Module 10: Authentication and Session Testing

Topics
- Login flow testing
- Signup flow testing
- OTP testing
- Password reset testing
- OAuth login testing
- Session invalidation
- Logout testing
- Device binding
- Token expiry
- Refresh token rotation
- MFA/2FA bypass testing

Practical
- OTP reuse check
- OTP brute force rate limit check
- Password reset token reuse
- Old token after password change
- Logout ke baad token valid hai ya nahi
- Same token multiple devices par test
- OAuth callback manipulation

Page 9
Android Application Security Testing Course

- Email/phone verification bypass

Common Findings
- OTP reuse
- No OTP rate limit
- Reset token reuse
- Session not invalidated after password change
- Deleted account token still active
- OAuth login bypasses 2FA
- Weak device binding

Module 11: Firebase, Cloud and Third-Party SDK

Testing

Topics
- Firebase Realtime Database
- Firebase Storage
- Firestore
- Google API keys
- AWS S3 from mobile apps
- Analytics SDK exposure
- Crash reporting logs
- [Link] / AppsFlyer / Adjust links
- Misconfigured cloud endpoints
- Public buckets

Practical
- Firebase URL extraction
- Firebase database access check
- Firebase storage bucket check
- API key restriction check
- Third-party SDK endpoints mapping
- Cloud bucket exposure validation

Common Findings
- Public Firebase database
- Public Firebase storage
- Exposed API keys without restriction
- Sensitive files in cloud storage

Page 10
Android Application Security Testing Course

- Misconfigured staging environment

- Internal endpoints exposed in production APK

Module 12: Android API Testing Methodology

Topics
- API recon from APK
- Endpoint grouping
- Authentication mapping
- Role-based testing
- Object ID testing
- Rate limit testing
- Business logic testing
- Payment/wallet testing
- Order/cart testing
- File upload testing
- GraphQL API testing if present

Practical
- API collection banana
- Burp Repeater testing
- Postman collection banana
- IDOR testing
- Cart/price/quantity tampering
- Coupon abuse
- Unauthorized endpoint access
- File upload validation
- Sensitive data exposure

Module 13: Reverse Engineering Basics

Topics
- APK signing
- APK patching basics
- Smali basics
- Recompile APK
- Anti-tamper overview
- Obfuscation overview
- ProGuard/R8 overview

Page 11
Android Application Security Testing Course

- Native library overview

- Basic strings analysis
- Secret extraction limitations

Practical
- APKTool decompile
- Manifest modification
- Recompile APK
- APK signing
- Basic smali string review
- Obfuscated code review strategy

Module 14: Vulnerability Reporting and Bug Bounty

Writing

Topics
- Report title writing
- Clear impact writing
- Steps to reproduce
- Evidence screenshots
- Video PoC structure
- Expected vs actual result
- Business impact
- CVSS basics
- CWE mapping
- Remediation writing
- Duplicate avoid karna
- Low impact ko high impact chain banana

Report Format
1. Title
2. Summary
3. Affected endpoint/component
4. Steps to reproduce
5. Proof of Concept
6. Impact
7. Business risk
8. Remediation
9. Supporting evidence

Page 12
Android Application Security Testing Course

10. Environment details

Practical
- Insecure local storage
- Deep link unauthorized access
- OTP rate limit missing
- IDOR in mobile API
- Sensitive data in logs

Page 13