Android Application Static and Dynamic Security Assessment

Name: Android Application Static and Dynamic Security Assessment
Rating: 4.3 (8 reviews)

Get your hands on Android application security with some dummy applications and real live application.

Created bySiddharth Sangwan

Last updated 3/2024

English

English [Auto],

What you'll learn

Hacking
Android Application Architecture
Android Application Source code Analysis
Android Application Automated Static Analysis
Android Application Component Security Testing
Android Application Traffic Analysis
Android Application Automated Dynamic Analysis
Burp Suite Professional
Burp Suite
Open Source Kali tools
Mobile Hacking

Course content

7 sections • 44 lectures • 5h 13m total length

Install kali Linux in VMware Workstation Professional or Player7:12
Configure WSL Kali Linux in Windows Machine4:45
Configure Kali Linux on Windows using Windows Subsystem for Linux, enabling the feature, installing Kali from the Microsoft Store, and setting the default WSL version.
Genymotion Installation6:42
If Genymotion put extra load on your system, then try installing NOX-Player which has same working functionality but in a much lighter package.
I personally use NOX-Player on daily basis, but Genymotion is the popular one because of its SAAS working model.

Android History5:11
Trace Android history from a 2003 camera project to a Google funded smartphone OS, through the Open Handset Alliance and dessert-named versions up to Android 12.
Android OS Architecture6:40
Explore the Android framework architecture from the Linux kernel through Binder IPC to core libraries, Android runtime, and app framework, covering surface manager and media framework.
Android Boot Sequence4:00
Android Debug Bridge - ADB5:46
Android File Structure13:56
Explore the Android file structure, including APEX modules, the APKs folder, app and data directories, system and vendor folders, with debugging using ADB, bug reports, and storage layouts.
Android Application Architecture19:47
Explore android application architecture, including activities, content providers, services, and broadcast receivers, and understand manifest, dex, resources, and layouts in an apk, plus normal and dangerous permissions and their groups.

Decompiling Android Application with JADX7:33
Lets get stated with android application reverse engineering. Application are available in ZIP file to download
Decompiling Android Application with QARK (Quick Android Review Kit by LinkedIn)6:33
Reading JAR File with JD-GUI2:16
Reading DEx File with ByteCode-Viewer5:17
Decompile Android Application With APKTOOL5:13
Learn how to decompile android applications with apktool, inspect smiley code and Java code, and recompile after changes using Kali Linux commands and standard folder paths.
Reading Small with Android Studio and Convert DEx file into JAR with DEx2JAR5:30
Use Android Studio to perform static analysis by decompiling dex files, converting Dalvik bytecode to a jar, and inspecting the Java code, manifest, and resources.
Extracting Java and Smali Code with MobSF (Mobile Security Framework)5:31
Installing MobSF in Windows OS5:35

Insecure Logging9:48
Hardcoding Issue Part 13:30
Identify a hard coding issue in an Android app by locating a vendor secret key used as a license key, and show access granted when the input matches.
Insecure Data Storage Part 1 || Shared Preferences7:07
Insecure Data Storage Part 2 || SQLite Database6:00
Insecure Data Storage Part 3 || Temp Files5:47
Explores insecure data storage by writing credentials to a temporary file in the app's data directory, exposing plaintext, and suggests encrypting or encoding (base64 or hex) the values.
Insecure Data Storage Part 4 || External Storage7:03
Improper Input Validation || SQL-injection8:48
Improper Input Validation || Web View Methods3:49
Examine improper input validation in web view scenarios and how the file method can access sensitive information or files on Android devices through storage paths.
Access Control Issue Part 16:47
Access Control Issue Part 26:47
Access Control Issue Part 36:51
demonstrates bypassing a four-digit pin to access private notes by exploiting an exported content provider via adb and the content resolver, revealing data stored in shared preferences or databases.
Improper Input Validation Part 24:58
Learn how a vendor key is hardcoded inside the Diva Genie library, and how input is passed to the library via JNI to trigger access.
Improper Input Validation Issue Part 3 || Input Fuzzing2:19
Explore how input fuzzing exposes improper input validation in Android apps by sending long inputs beyond 31 characters, causing app crashes when exception handling is insufficient.

Installing Burp Suite Professional in Windows for free.8:03
Installing Burp Suite Professional in Kali Linux Machine for Free.4:00
Getting Started with Burp Suite Professional.24:57
SSL Pinning Bypass and Capture Application Traffic with Burp Suite Professional10:00
Follow Below Commands
# Create Certificate
1 - Download Burp certificate to .DER e.g cacert.der
2 - openssl x509 -inform DER -in cacert.der -out cacert.pem // Convert .DER (Distinguished Encoding Rule) encoded file into .PEM (Privacy Enhanced Mail) encoded file.
3 - openssl x509 -subject_hash_old -in cacert.pem |head -1 // Calculate MD5 hash for cacert.pem file and **head -1** will only print 1st list
4 - mv cacert.pem {hash}.0 // rename file with hash output of last command

# Setup Certificate
1 - adb root // Get Root access with ADB. Don't need to execute this command if ADB is configured to Root by-default
2 - adb remount // Remount partitions to Read-Write. if a reboot is required, -R will will automatically reboot the device.
3 - adb push {cert}.0 /system/etc/security/cacerts/ // Upload Certificate file to Android Certificate Store Directory.
4 - adb shell chmod 644 /system/etc/security/cacerts/{cert}.0 // Grant Read-Write Permission to Root Owner and Read Permission to other users and groups.
5 - adb reboot // Reboot Android Device to update Certificate Store.
Analysing Android Application with Mob-SF12:28
Analyse Application Source code with AndroBug Framework.7:05
Clone and run the AndroBug framework for static analysis of an Android app, generate a report, and identify issues in the manifest, webview, JavaScript execution, and adb backup exposure.
Installing Drozer for Dynamic Analysis5:05
Working with Drozer11:03

Requirements

Java
Android
Linux OS

Description

This whole course is divided into 6 Sections which covers different necessary portions for Android Application Security and they goes like this :-:

Lab Setup
Introduction to Android
Static Analysis tools for Android Applications
Getting Started with DIVA-Beta Application
Pentester Lab Applications
Dynamic and Automated Analysis
Dynamic Instrumentation with Frida and Objection

This course require few things from learner, such as :-:

Some hands on experience with any linux operating system, best for Kali Linux users.
Basic code level understanding of JAVA language.

Minimum System requirements for this course :-:

CPU -- i5 7th Gen
RAM -- 12 GB
Storage -- 250 GB SSD

Who this course is for:

All web application security analyst.
All those security enthusiast.
All those newbies into hacking.
All those API security analyst.
A total beginner, with a curious mind and wants to be an app developer
Anyone who wants to become an Android Developer
Penetration testers who want to do a Penetration Testing against Android mobile phones.
Application developers who want to write secure mobile applications.
Anyone who want to protect themselves against mobile attacks.
Programmers who are interested in building Android apps
Technical or non-technical entrepreneurs who want to start mobile app business
Anyone who wants to create Android Applications
Those who want to develop an Android Hacking

This course will give you a beginner to intermediate level knowledge in android application security. Audio and Video quality might not be the best, but these are the thing you need to know to get started in Android application security.

Who this course is for:

Security Analysts
Android Application Developers
Cyber Security Students
Ethical Hackers
Android Application Pentesters

Android Application Static and Dynamic Security Assessment

What you'll learn

Explore related topics

Course content

Lab Configuration3 lectures • 19min

Introduction to Android6 lectures • 55min

Static Analysis Tools for Android Applications8 lectures • 43min

Getting Started with DIVA-Beta Application13 lectures • 1hr 20min

Pentester Lab Applications5 lectures • 28min

Dynamic and Automated Analysis8 lectures • 1hr 23min

Dynamic Instrumentation Tools1 lecture • 6min

Requirements

Description

Who this course is for: