Exploiting Android Apps for beginners - Check Apps Security

Name: Exploiting Android Apps for beginners - Check Apps Security
Rating: 4.0 (42 reviews)

Has the right balance of theory and hands-on. Good set of tools discussed. Offered by leaders in Mobile App Security.

Created byToshendra Sharma

Last updated 12/2015

English

What you'll learn

Understand Android's Architecture and Security Model
Get familiar with tools for development, reverse engineering and security analysis
Pentesting Android Apps

Course content

10 sections • 68 lectures • 9h 59m total length

Importance of Information Security7:14
Mobile First and State of the Art Product Design7:36
Explore mobile first and state-of-the-art technology, and why mobile dominates today globally. Explore smartphones to wearables and internet of things, learn trends, mobile payments, and the need for security.
Need for Mobile Security and OWASP Top 1010:21
Discover why mobile security matters for Android apps. Get an intro to the OWASP top 10 mobile risks and key protections like secure storage, transport layer protection, authentication, and cryptography.
Basic Terminologies in Information Security8:47
About CIA Triad7:04
Learn the CIA triad—confidentiality, integrity, and availability—and how these pillars secure information with cryptography, access controls, backups, and disaster recovery.
Introduction to Cryptography11:46
Hashing and Digital Signature13:53
Digital Certificates and PKI12:59
TLS_SSL_Protocol and Handshake Process6:57
DoS and DDoS attack7:42
AAA7:50
Password Security7:44
Access Control4:40

A Brief about Android11:52
Explore Android, a free, open-source Linux-based operating system developed by Google. Understand its dessert-named version history and learn to identify and fix security vulnerabilities in apps.
Android Bootup Process7:27
Android Architecture7:54
Explore android architecture from the linux kernel to the app framework. Learn how baldric virtual machine, the android runtime, and core services like activity manager enable app development.
Android Data Structure and File system13:24
Explore android data structure and file system concepts, including internal and external storage, /data/data package directories, adb access, and app data components like cache, databases, and shared preferences.
Android Logging and Logcat13:48
Android Apps7:08
Explore how Android apps are built and packaged as APK files, inspect dex and resources, and understand activities, services, broadcast receivers, content providers, intents, permissions, and shared preferences.
Android Security Model10:42
Android Permissions8:53
Security Compliance w.r.t. Android Framework and Java7:24
Examine mobile security compliance for Android apps, covering PCI DSS, HIPAA, and FIPS standards, and discuss how open-source Android and sandboxing influence policy enforcement.
Google Bouncer4:29

Setting up a Proxy for Android Emulator5:54
Setting Up a Proxy for Android Device4:52
Installing CA Certificate6:44
Install the ca certificate from burp suite on android devices and emulators to trust proxies and intercept ssl traffic for testing.
MITM and SSL MITM Attacks: PART 116:23
MITM and SSL MITM attacks PART 29:15
Examine how a man-in-the-middle attack intercepts traffic between a mobile device and gateway, using ssl strip to downgrade https to http and capture credentials in clear text.
Data Manipulation6:13

APK Files in a Nut Shell10:49
apk files are zip-based packages for Android apps, containing classes.dex, resources, and the manifest; signing certificates and sha hashes aid reverse engineering of activities, intents, services, and content providers.
Intro to Reverse Engineering6:52
Explore reverse engineering of Android apps by turning unreadable bytecode in apk files into readable Java source, using decompiling tools and automated workflows to decompile, modify, and rebuild apps.
Reversing to Get the Source Code7:25
Learn to reverse an Android app by converting a dex file to a jar and decompiling it with jadx to reveal readable source code.
Using APKTool for Reverse Engineering9:26
Introduction to Android Malwares9:04
Dynamic vs Static Analysis4:08
Static Analysis of Android Malwares17:58
Learn static analysis of Android malware by using reverse engineering tools to reconstruct code, inspect Android manifest permissions and background services, and examine decompiled binaries and encrypted data.
Introduction to Android Tamer6:07
Dynamic Analysis with DroidBox8:23
Dynamic Analysis of Android Malwares10:11
Perform dynamic analysis of Android malware with DroidBox, observing runtime behavior, network activity, and file operations in a sandboxed emulator.

Introduction to Android Pentests4:32
Fuzzing Android Apps with Burp Proxy4:52
Fuzzing Android Apps with Burp Intruder11:44
Attacking authentication8:00
Content Provider Leakage10:25
Client Side Injection8:14
Insecure Data Storage - Shared Preferences8:52
Examine insecure data storage in Android apps, focusing on shared preferences storing credentials in clear text and other storage options. Encrypt key-value data with crypto libraries and use password-based encryption.
Insecure Data Storage - SQLite Databases8:11
Demonstrates insecure data storage with sqlite databases, where usernames and passwords are readable from the database file. Highlights encryption as the fix to protect sensitive app data.
Unintended Data Leakage10:30
Broken Cryptography15:17
Automated Security Assessments with Drozer14:37
Exploiting Android Devices Using Metasploit12:04
Learn to use metasploit to exploit android devices, create a backdoor, and establish a reverse shell, using payloads and msf console to assess android app security.

Requirements

Android Dev Environment
Linux OS

Description

If you at any point of time in your career or academia surfaced information security, you know for a fact that security analysis is not only about thorough understanding of a system but also includes a good list of tools and techniques to analyze that particular system. Unlike network and web, mobile security is a recent phenomenon. In order to analyze mobile application, one should understand the underlying architecture, security model, development frameworks and the relevant tools.

This course deals with applications within the most widely used mobile OS, Android. The course introduces underlying Android architecture, its permission model and the default security measures in place. It deals with developer tools like Eclipse, Android Studio, Android Debug Bridge or ADB, UI Automator and Monkey Runner, along with tools and techniques for Network Analysis.

As a part of reversing and malware analysis, static and dynamic techniques have been discussed. Pentesting an Android App is has also been discussed. Issues like unintended data leakage, insecure data storage and tools like Burp Intruder & Metasploit have also been covered. The course concludes by discussing Android best practices for security.

To conclude, this course deals with Android security concepts and discusses the relevant tools in detail to exploit an Android application.

Who this course is for:

Existing security professional trying to get into Mobile App Security in general and Android security in personal
Students in Security specialization
Android developers
Members of QA team testing Android Apps

Exploiting Android Apps for beginners - Check Apps Security

What you'll learn

Explore related topics

Course content

Introduction13 lectures • 1hr 55min

Android Architecture and Security Model10 lectures • 1hr 33min

Getting Familiar with Android Developer Tools3 lectures • 38min

Interacting with an Android Device6 lectures • 37min

Android Network Analysis6 lectures • 49min

Android Reversing and Malware Analysis10 lectures • 1hr 30min

Android Application Pentesting and Exploitation12 lectures • 1hr 57min

Android Device and Data Security3 lectures • 27min

Using Android as a Pentesting Tool3 lectures • 20min

Conclusion2 lectures • 14min

Requirements

Description

Who this course is for: