Mobile application Penetration Testing

  • Home
  • Mobile application Penetration Testing

Mobile application Penetration Testing

Mobile application Penetration Testing

Master Android application penetration testing from scratch. Start with the fundamentals (Android architecture, sandbox, permissions model), then dive deep into static and dynamic analysis. Learn to decompile APKs, read Smali code, reverse engineer app logic, intercept traffic, and manipulate apps at runtime. Get hands-on with every major tool: MobSF, Frida, Medusa, and Drozer, plus native hooking and Smali patching. A practical course aligned with OWASP Mobile Top 10 and eMAPT preparation.

This course takes you through mobile application penetration testing from the ground up, covering both Android and iOS platforms. You will start with environment setup and APK/IPA structure, then move into static analysis: decompiling, reverse engineering, hardcoded secrets, insecure storage, and manifest misconfigurations. From there, you will shift to dynamic analysis, intercepting traffic with Burp Suite, bypassing SSL pinning using multiple techniques, and analyzing runtime behavior. The course then dives deep into hooking and instrumentation: you will learn how to use Frida for JavaScript-based hooking, Objection for rapid automated assessments, and Medusa for modular hook injection. We also cover native hooking (hooking into native libraries and JNI calls), root/jailbreak detection bypass, biometric bypass, and token manipulation. By the end, you will be able to perform a full mobile penetration test, from recon to exploitation to reporting.

Topics covered:

  • APK/IPA structure and reverse engineering
  • Static analysis (jadx, apktool, MobSF)
  • Dynamic analysis and traffic interception
  • SSL pinning bypass (multiple methods)
  • Frida scripting and hooking (Java and Native layers)
  • Objection runtime exploration
  • Medusa modular hooking framework
  • Native hooks and JNI interception
  • Root/Jailbreak detection bypass
  • Insecure data storage and token analysis
  • Reporting and documentation

Curriculum

(1.1) Android Architecture 30:11 (1.2) Android Security Features 24:29 (1.3) Java For Android 31:27 (1.4) Java For Android 39:48 (1.5) Android Studio 31:17 (1.6) Intents 32:44 (1.7) Put Extra For Intent 24:40 (1.8) Implicit Intent 22:15 (1.9) WebView 30:00 (1.10) Java For Android 45:21 (1.11) Shared Preferences 36:39 (1.12) Activities 21:30 (1.13) Service 28:28 (1.14) Askpermissions 24:24 (1.15) Deeplink 28:45 (1.16) Read write Permissions 30:13 (1.17) BAAS 59:02 (1.18) Adb Connect 30:27 (1.19) Find APK 36:16 (1.20) Static Analysis 27:19 (1.21) Static Analysis 25:25 (1.22) Static Analysis 31:41

(2.1) Mobile Static Analysis Roadmap 17:58 (2.2) Mobile Static Analysis Basics 38:53 (2.3) Mobile Static Practical Native 27:04 (2.4) Smali Code 21:33 (2.5) Smali Code 21:33 (2.6) Smali Code 12:49 (2.7) Smali Code 22:36 (2.8) Static Hybrid 23:46 (2.9) Analyzing React Native 22:53 (2.10) DotNet Static Analysis 22:46 (2.11) Flutter Static Analysis 21:24 (2.12) Weak Encryption 34:04 (2.13) Exported Activities 28:59 (2.14) Analyzer 07:25 (2.15) MobSf Framwork 22:27 (2.16) Exported Broadcastreciver 22:48 (2.17) Exported Service 21:12 (2.18) Exported Provider 24:54 (2.19) Deeplink Exploition 31:45 (2.20) Insecure Data Storage 24:55 (2.21) Weak Crypto 17:34 (2.22) Weak Network Configuration 11:23

(3.1) Dynamic Analysis Overview 18:22 (3.2) Introduction to Hooking & Frida 16:20 (3.3) Frida Hooking 25:17 (3.4) Debug Logcat 09:23 (3.5) Drozer 16:44 (3.6) Bypass Login Frida 23:56 (3.7) Objection 17:16 (3.8) Rootdetection 24:00 (3.9) SSL Pinning 22:55 (3.10) Configure Burpsuite 23:44 (3.11) Ssl Pinning Bypass 19:59 (3.12) Goodlab Target 25:34 (3.13) Anti-Frida 05:45 (3.14) Medusa 15:23 (3.15) Biometric 26:51 (3.16) Deep-hooking 25:16 (3.17) Deep Hooking Lab12.1 20:15 (3.18) Deep Hook Lab12.2 23:45 (3.19) Hook 12.3 22:01 (3.20) Hook 12.4 14:07 (3.21) Hook Cryptofunction 23:31 (3.22) Storage Monitoring 31:16 (3.23) Memory Dump 21:13 (3.24) Memory Dump Objection 05:05 (3.25) Native Hook Monitor 38:16 (3.26) Native Hooking 28:29 (3.27) Native Root Hooklv1 27:00 (3.28) Confused Debuty 23:33 (3.29) Assembling-The-Pieces 22:49

Student Feedback

5 based on 2 reviews
Latest Reviews
Hazem ElNaggar
2026-10-08 06:45:19

Excellent course with clear explanations and practical hands-on labs that provided valuable real-world skills in Mobile Penetration Testing. Highly recommended!

Jana Ahmed
2026-10-08 09:07:43

Good, all of techniques of Static analysis

Mobile Application Penetration Testing
Course Duration
30h 41m
Enrolled Students
17
Course Level
Intermediate
Course Pricing
One-Time Payment
4,000 L.E
8,000 L.E 50 % OFF
4,000 L.E Coupon Applied

Lifetime access to all course content

Have a coupon?
Coupon Applied
Course Tags
public
Enroll Now via WhatsApp
Hossam Shady
Hossam Shady
Offensive Cybersecurity, Penetration Testing, Ethical Hacking
2 Courses

Hossam Shady is the founder of Red Nexus, an expert in cybersecurity and penetration testing.
His passion for the field and real-world experience led him to establish the academy to provide high-quality Arabic content and simplify entering the cybersecurity job market. He focuses on direct, practical training that bridges the gap between learning and applying skills in real scenarios.