Mobile Application Pentesting & Bug Bounty Hunting in 2025

Explore setting up an Android Studio project, understanding package names, minimum SDK choices, Kotlin vs Groovy, and the Android manifest with activities, including the concept of the main activity.

Understand how the Android platform is built on Linux, how Android applications use APK packaging, and the evolution of Android versions from initial to latest.

Download and install Android Studio from the official site, start the IDE, and create a new project; ensure 8 GB RAM and consider Genymotion as a lighter, free open-source alternative.

Create an Android Studio project with an empty activity and a unique package name, select a broad minimum SDK, and review the manifest, which defines the main activity.

Create and build your first Android project, generate an APK, and preview the hello world layout. Set up an Android virtual device to run and test app on an emulator.

Install and run your Android app by building the debug apk or dragging it onto the device, then verify app info and extract the package name using adb.

Explore the fundamentals of Android decompilation, treating an APK as a zip, extracting the manifest and resources, and why classes.dex cannot reveal the original source code.

Discover decompiling an android application to inspect assets for hard coded api keys and jwt tokens, decode tokens with jwt.io, and assess security severity in mobile pentesting.

Learn to reverse engineer Android applications by decompiling with APK tool, inspect the manifest and XML resources, and identify API keys and other sensitive data.

Analyze application code using a secrets search in Visual Studio Code, identify api keys, and decompile rapido.apk with apktool to view the manifest, permissions, and activities.

Decompile the diva apk to inspect its Android manifest, permissions, and main activity, then install and run it on a device to observe the launcher splash screen and testing workflow.

Explore how to identify Android activities from the manifest, spot insecure logging, hard coded credentials like Twitter API key, and decompile apks with APK tool to inspect dex and smali.

Install the app in Android Studio by dragging and dropping onto a started device, then inspect the main activity and manifest to understand permissions and the multiple activities.

Master jadx for reverse engineering by decompiling an android apk to readable java code and manifest, extracting classes from dex files, and viewing package names and libraries.

installing the diva apk for security testing exposes insecure logging, showing how credit card data or credentials can be logged in logs via log.e.

Identify how hardcoded credentials and other sensitive data are stored insecurely on mobile devices by analyzing shared preferences usage and basic static analysis to reveal insecure storage practices.

Explore how android shared preferences store username and password as key-value pairs and persist data after app close. See how adb reveals insecure plain-text storage in shared preferences.

Identify insecure login implementations by examining how credit card numbers and other PII are logged in Android apps, using logcat and log statements to reveal sensitive data exposure.

demonstrates insecure data storage in an Android app using SQLite database to store user credentials in plain text, exploring the my user table in IDs two and validating vulnerability.

Demonstrates insecure data storage in an Android app by writing credentials to a file via a file writer, exposing username and password, and noting passwords should be encrypted or hashed.

This lecture demonstrates insecure data storage by writing credentials to a file on external storage via a file writer, exposing the username and the password in u info dot txt.

Explore common input validation issues by demonstrating an SQL injection in a mobile app, revealing how unsanitized input can expose and retrieve all users' data from a SQLite database.

Learn how improper input validation in mobile WebView contexts enables unsafe protocol use and file loading. See how this can expose sensitive internal data when loading URLs and files.

Examine common input validation issues in part three, showing how unfiltered input can cause crashes and buffer overflows and how to identify the root cause via large inputs and logs.

Exposes critical access control vulnerabilities in Android apps by allowing external invocation of a sensitive activity via ADB to view API credentials, username, and password.

Continue exploring access control issues in Android apps, fetch private nodes via shared preferences to reveal the pin, and switch to root during hands-on pentesting.

Master ssl pinning bypass for mobile apps using Frida, frida tools, and objection; set up Burp Suite, install a trusted cert, and capture traffic from Rapido and Zomato.

Learn to set up Xcode on macOS for mobile security testing, including macOS virtualization options, creating a testing Apple ID, and configuring Swift-based iOS projects with bundle identifiers.

Discover information leakage risks from hardcoded credentials in binaries, assess misused app permissions, and compare iOS and Android static versus dynamic testing, including SSL pinning and Burp Suite.

Explore how iOS app projects differ from Android, navigate Xcode, and understand iOS simulators and their limits, including system integrity protection and the need for a physical device for testing.

Choose an iPhone from iPhone 5s to iPhone X for testing, ensure iOS is 16.x or lower, and use the Checkm8 bootrom exploit with a lightning to USB-A cable.

Install and run your first iOS app on a simulator or iPhone, configure signing with Apple ID and a dummy development certificate, then deploy to a physical device.

Install three tools, an all-in-one iOS device management platform, to connect devices, back up and restore, encrypt backups, copy files, jailbreak devices, and flash firmware from Windows or macOS.

Back up and encrypt your device before jailbreaking, using backups as needed. Learn firmware options and jailbreak methods such as USB jailbreak and dopamine, including DFU mode and IPA installation.

Explore iOS sideloading as a non jailbroken method to install third-party apps using a temporary developer certificate, with tools like Altstore, and understand certificate expiry after seven days.

Learn to install iOS apps via sideloading with AltStore and IPA files, compare temporary, semi-tethered, and untethered jailbreaks, and discuss Pale Rain and Check Rain exploits in bug bounty testing.

Examine insecure data storage in an iOS app by locating how a playlist input is saved in a plist file inside the app sandbox, using Frida and Objection for testing.

Identify insecure data storage by saving username and password in a plist file and reading it in plain text, exposing sensitive information that should be encrypted.

Understand how NSUserDefaults stores key-value data in iOS with plist files in the library preferences, persisting across launches and exposing insecure data storage risks.

Learn how the iOS keychain stores passwords, keys, certificates, and notes in an encrypted database via the Keychain Services API, and why insecure storage can be exposed when unlocked.

Demonstrates ssl pinning bypass on iOS using objection, guiding installation, package name identification via Frida or Info.plist, and disabling ssl pinning to capture http and https requests with burp suite.

Discover how to bypass iOS jailbreak detection with Frida and Objection, disable iOS jailbreak checks, verify results (device not jailbroken vs jailbroken), and inspect common paths like /bin/bash and /usr/sbin/sshd.

Learn to use MobSF for iOS security testing, upload an IPA, view reports, assess the security score, inspect Info.plist, and export a PDF report highlighting hard-coded secrets.

Explore using Nuclei templates for static analysis to uncover hardcoded credentials and API keys in mobile apps, then learn to run templates and interpret results, including handling false positives.