Nex-G Innovations

Module 1: Getting Started with Android Security

• Introduction to Android
• Digging deeper into Android
• Sandboxing and the permission model
• Application signing
• Android startup process

Module 2: Preparing the Battlefield

• Setting up the development environment
  • Creating an Android virtual device
• Useful utilities for Android Pentest
  • Android Debug Bridge
  • Burp Suite
  • APKTool

Module 3: Reversing and Auditing Android Apps

• Android application teardown
• Reversing an Android application
• Using Apktool to reverse an Android application
• Auditing Android applications
• Content provider leakage
• Insecure file storage
  • Path traversal vulnerability or local file inclusion
  • Client-side injection attacks
• OWASP top 10 vulnerabilities for mobiles

Module 4: Traffic Analysis for Android Devices

• Android traffic interception
• Ways to analyze Android traffic
  • Passive analysis
  • Active analysis
• HTTPS Proxy interception
  • Other ways to intercept SSL traffic
• Extracting sensitive files with packet capture

Module 5: Android Forensics

• Types of forensics
• Filesystems
  • Android filesystem partitions
• Using dd to extract data
  • Using a custom recovery image
• Using Andriller to extract an application's data
• Using AFLogical to extract contacts, calls, and text messages
• Dumping application databases manually
• Logging the logcat
• Using backup to extract an application's data

Module 6: Playing with SQLite

• Understanding SQLite in depth
  • Analyzing a simple application using SQLite
• Security vulnerability

Module 7: Lesser-known Android Attacks

• Android WebView vulnerability
  • Using WebView in the application
  • Identifying the vulnerability
• SInfecting legitimate APKs
• Vulnerabilities in ad libraries
• Cross-Application Scripting in Android

Module 8: ARM Exploitation

• Introduction to ARM architecture
  • Execution modes
• Setting up the environment
• Simple stack-based buffer overflow
• Return-oriented programming
• Android root exploits

Module 9: Writing the Pentest Report

• Basics of a penetration testing report
• Writing the pentest report
  • Vulnerabilities
  • Scope of the work
  • Tools used
  • Testing methodologies followed