Catalog
mobile-securityintermediate
Mobile Application Penetration Testing
Starts from zero, no prior security testing background needed, and builds up to Android and iOS static/dynamic analysis aligned to OWASP MASVS.
9 modules37 lessons16h
#mobile-security#android#ios#frida#owasp-masvs#reverse-engineering
What you'll learn
- Explain what a penetration test is and how mobile testing differs from other kinds, even with zero prior security background
- Use the core vocabulary of mobile testing correctly: APK/IPA, sandboxing, static vs. dynamic analysis, rooting/jailbreaking, instrumentation
- Explain the Android and iOS application security models and how they differ
- Perform static analysis on an APK: decompile, read manifest permissions, find hardcoded secrets
- Use Frida for dynamic instrumentation, including bypassing SSL/certificate pinning
- Identify and exploit Android-specific vulnerabilities: insecure storage, exported components, IPC issues
- Perform static and dynamic analysis on an iOS IPA, jailbroken and non-jailbroken
- Identify iOS-specific vulnerabilities: keychain misuse, insecure IPC, WebView issues
- Test the backend APIs a mobile app depends on for the same flaws that affect any API
- Map findings to OWASP MASVS controls and write a report a mobile dev team can act on
Who this course is for
Anyone who wants a structured path into mobile application security testing, a specialization in constant demand as mobile remains the primary platform for banking, healthcare, and consumer apps. No prior pentesting experience is required: Module 1 builds the foundation from scratch, defining every term before it gets used. Basic programming literacy helps from Module 3 onward but is not required to start, and Android/iOS development experience is never assumed.
A complete mobile application security testing track for Android and iOS, structured around the OWASP Mobile Application Security Verification Standard (MASVS) and Testing Guide (MASTG). Opens with a full foundations module for anyone new to security testing: plain-English explanations of what pentesting is, how apps and their sandboxes work, and the vocabulary the rest of the course uses constantly, before any tool is introduced. From there it covers static analysis and reverse engineering (APK/IPA structure, decompilation), dynamic instrumentation with Frida, SSL pinning bypass, platform-specific storage and IPC vulnerabilities, and testing the backend APIs every mobile app talks to. Every hands-on lab uses a named, freely downloadable, deliberately vulnerable practice app, with direct links, so you can build the same lab on your own machine and follow along exactly.
Curriculum
Course content
01Mobile Security Foundations: Starting From Zero
5 lessonsReviews
No reviews yet.