2025 ANDROID Hacking MASTERCLASS & Bug-Bounty Hunting

Name: 2025 ANDROID Hacking MASTERCLASS & Bug-Bounty Hunting
Rating: 3.4 (35 reviews)

Most Comprehensive Hands-On Practical Approach towards Hunting Bugs in Android Applications and Earn Money Ethically.

Created byMainak Sadhukhan

Last updated 10/2025

English

English [Auto],

What you'll learn

Free Licence to BURPSUITE PROFESSIONAL
Android App Penetration Testing
Android Bug Bounty Hunting
Earn Money by Hunting bugs in Android Applications
Ethical Hacking
Penetration Testing

Course content

10 sections • 63 lectures • 4h 46m total length

Why this Course ?1:04
Introduction to Course3:40

Android Debug Bridge [ADB]6:44
Explore Android Debug Bridge (ADB) and how it enables a development machine to communicate with Android devices through setup, connections, shell access, and basic ADB commands.
Adding ADB to Windows Path0:39
APK-tool6:01
· Download Android SDK from : http://developer.android.com/sdk/index.html.
Download the latest version of apktool from : http://ibotpeaches.github.io/Apktool/.
DEX-2-JAR1:51
Download latest version of dex2jar from : https://bitbucket.org/pxb1988/dex2jar/downloads
JD-GUI1:27

What is BURP Proxy ?7:49
Burp proxy acts as a man-in-the-middle to intercept and modify requests and responses between an app and its server, with a Firefox setup using 127.0.0.1.
BURP : Interceptor2:44
Learn to use burp interceptor by configuring proxy listeners, routing mobile traffic through a local proxy, installing the burp certificate, and recording and editing http requests and responses.
BURP : Repeater1:37
BURP : Intruder3:20
Configuring Android Emulator/Device to let BURP Intercept Traffic1:48
Configure the Android emulator or device to intercept traffic with Burp by setting the correct port number, IP address, and listening on the appropriate interfaces.
Installing BURP CA certificate in Android Emulator/Device4:55
Install the Burp CA certificate on an Android emulator or device to intercept traffic, navigate downloads, adjust security settings, and resolve certificate installation issues.
BONUS : BURP PROFESSIONAL Licence for FREE7:36
Learn to use Burp professional by obtaining a free license and setting up Burp Suite Pro, including JDK download, firewall and antivirus adjustments, and offline activation.

M1 : Improper Platform Usage5:14
Explore the OWASP top 10 mobile vulnerabilities and learn practical hunting for improper platform usage in Android, focusing on platform features, permissions, and secure server-side controls.
M1 - Practical2:50
M1 - Practical2:43
M1 - Some more Practical2:58
M2 : Insecure Data Storage3:50
M2 - Practical5:26
M2 - Some more Practical6:29
Examine insecure data storage in the rebate app, showing credentials stored as strings in a local database and exposed in the my user table with plaintext secrets.
M2 - Even more Practicals3:13
Investigate insecure data storage by tracing how credentials are saved to a temporary plaintext file and exposed in storage.
M2 - I am crazy for Practicals5:45
M3 : Insecure Communication6:08
M3 - Practical9:25
M4 : Insecure Authentication5:29
M4 - Practical5:13
M5 : Insufficient Cryptography1:50
M5 - Practical5:02
Examine weak cryptographic vulnerabilities in Android apps by analyzing encryption methods, aliases, and how credentials and encrypted passwords are stored in shared preferences.
M6 : Insecure Authorization4:41
Identify insecure authorization flaws that allow bypassing authentication and accessing admin functions. Learn how server-side validation, proper permissions, and back-end data controls prevent unauthorized access.
M6 - Practical7:25
Explore how honesty and different problem shape Android bug bounty and practical penetration testing. People say they seem to get past that problem.
M6 -More Practical3:41
M7 : Client Code Quality3:05
M7 - Practical2:39
M7 : More Practical6:10
M7 - Even more Practical4:35
M8 : Code Tampering5:46
M8 - Practical9:16
Learn practical techniques to bypass Android protection checks by analyzing app code, modifying and rebuilding an APK, signing and deploying to an emulator for security testing.
M9 : Reverse Engineering2:41
M9 - Practical2:39
M9 - More Practical6:10
M10 : Extraneous Functionality3:16
M10 - Practical5:52
---------- M10 : Extraneous Functionality ----------------

The Insecure Bank v2 apk file has a customer login page
This is the customer login page
We will try to find out any hidden admin login pages left behind by the Developers.

Step 1 : We will decompile the .apk file using "apktool" [Command : java -jar d InsecureBankv2.apk]

Step 2 : Navigate to the folder ~/apktool/InsecureBankv2/res/values and open the file "strings.xml" for editing.

Step 3 : We find a flag “is_admin”. [Our piece of interest]

Step 4 : We will change the flag from 'no' to 'yes' and save the "Strings.xml" file.

Step 5 : We will now recompile the application.
[ Command :java -jar apktool.jar b InsecureBankv2 -o InsecureBankv2.apk]

Step 6 : Copy the InsecureBankv2.apk file generated above into the “dist” folder of "SignApk" and enter the below command to sign the apk file

[Command : java -jar sign.jar InsecureBankv2.apk]

Step 7 : A new sign apk file called InsecureBankv2.s.apk is generated in the same “dist” folder.

Step 8 : Install the new InsecureBankv2.s.apk onto the emulator.

We can now see the "Create user" option which directs the user to the User Creation Module which should have been accessed only by the admins.

Note : Shift + R-Click for Open Powershell here

Alternative to Playstore1:46
SSL Pinning6:21
Demonstrate how ssl pinning prevents interception by validating server certificates against embedded client certificates, explain public key pinning with hashed keys, and outline bypass approaches for modern apps.
SSL Unpinning - DEMO9:14
Learn to set up SSL pinning bypass on Android by using exposed installer and SSL unpinning tools to intercept traffic with a proxy on a rooted emulator.

Requirements

Basic Internet and Computer Usage Knowledge
MAC/ Windows/ Linux PC or laptop
A strong will to learn

Description

Learn to Hack Android Apps with Practical & Hands-on Lessons on Bug Bounty Hunting in this Masterclass

[ DISCOUNT CODE: "HACKOCT" for flat @ 499/- INR / $6.55 USD ]

OFFER : Get Free Licence to BURPSUITE PROFESSIONAL with this course

This is the most comprehensive Course to begin your Bug Bounty career in Android PenTesting.

Most Penetration testers target Web Applications for finding Bugs but most of them do not test the Android Apps which are a goldmine of vulnerabilities. This course will take you from the basics of Android Architecture to the advanced level of hunting vulnerabilities in the apps. No other course may provide with such a structured lesson and there are numerous Practical lesson with hands on hacking real and Live Android Applications.

Practicals for finding vulnerabilities are important and this course provides a lot of hands-on practical lessons to clear the concept of each vulnerability. You will explore the concepts of the most frequently found Vulnerabilities with addition to other vulnerabilities found in Android Mobile Applications and methods to exploit those vulnerabilities as well as how to suggest a Patch for these Vulnerabilities. You will also learn how to approach the scope of an Android Application to PenTest and find Attack Surfaces and finally Bag yourself a hefty Bounty amount from the Bug Bounty Programs.

Who this course is for:

Anyone Interested in Hacking
Beginners in Ethical Hacking willing to earn legally by Bug Bounty Hunting
Beginners in Penetration Testing
Android Application Developers willing to secure their Applications
Who want to pursue Ethical Hacking as Career
Bug Bounty Hunters interested in Android Application PenTesting

2025 ANDROID Hacking MASTERCLASS & Bug-Bounty Hunting

What you'll learn

Explore related topics

Course content

Introduction2 lectures • 5min

Understanding Android Architecture6 lectures • 28min

Reverse Engineering Android Applications5 lectures • 17min

Setting Up Mobile Penetration Testing Platform2 lectures • 5min

Introduction to BURPSUITE7 lectures • 30min

Setting up & Test Vulnerable Applications4 lectures • 28min

Introducing & Hunting OWASP TOP 10 Mobile Vulnerabilities29 lectures • 2hr 20min

Perform Penetration Tests on Live Applications3 lectures • 17min

Start Earning Money by Hunting Bugs4 lectures • 12min

Bonus Lecture1 lecture • 6min

Requirements

Description

Who this course is for: