Android/iOS Penetration Testing

Resources

• List of Courses

  • Android Bug Bounty Hunting : Hunt Like a Rat (https://codered.eccouncil.org/course/android-bug-bounty-hunting-hunt-like-a-rat?logged=false)
  • TCMSEC - Mobile Application Penetration Testing (https://academy.tcm-sec.com/p/mobile-application-penetration-testing)
  • Hacking Android Applications for Bug Bounty and Pentesting (https://www.udemy.com/course/hacking-android-applications-for-bug-bounty-and-pentesting/?couponCode=BLACKFRIDAY)
  • https://www.udemy.com/share/106LbA3@qU3PeqSmRA0Y2EkM3tygWLd_Cy6wS708dgiccAHlHOKw_IXtMRqvAu84VmqmQKGTMQ==/

• Resources

  • Mobile Application Pentesting Cheat Sheet (https://github.com/tanprathan/MobileApp-Pentest-Cheatsheet)
  • Reversing iOS Apps - https://github.com/ivRodriguezCA/RE-iOS-Apps/tree/master
  • All Things Android : https://github.com/jdonsec/AllThingsAndroid
  • Android Pentest 101 : https://github.com/dn0m1n8tor/AndroidPentest101
  • OWASP MASTG : https://mobile-security.gitbook.io/mobile-security-testing-guide/
  • https://github.com/ashishb/android-security-awesome
  • https://youtu.be/Tujbk4ToVMI
  • Awesome Android Security - https://github.com/saeidshirazi/awesome-android-security‣
  • iOS Penetesting Cheatsheet : https://github.com/ivan-sincek/ios-penetration-testing-cheat-sheet
  • Part 1: https://kishorbalan.medium.com/start-your-first-ios-application-pentest-with-me-part-1-1692311f1902 Part 2: https://kishorbalan.medium.com/ios-pentesting-series-part-2-into-the-battlefield-f17ed2778890 Part 3: https://kishorbalan.medium.com/ios-pentesting-series-part-3-the-ceasefire-53fcea3bbd70

• Talks

  • TDI 2022 - Android Application Hacking (https://csbygb.gitbook.io/pentips/talks/android-app)

• Insecure Android Apps for Learning/Practice

  • InsecureShop App - https://www.insecureshopapp.com/
  • InsecureBankv2 - https://github.com/dineshshetty/Android-InsecureBankv2
  • DIVA-Android - https://github.com/payatu/diva-android
  • EVABS (Extremely Vulnerable Android Labs)- https://github.com/abhi-r3v0/EVABS
  • VyAPI - The Modern Cloud-Based Vulnerable Hybrid Android App - https://github.com/appsecco/VyAPI
  • Vulnerable-File-App (Android Directory Traversal Vulnerable App & Exploit) - https://github.com/d0nutptr/Vulnerable-File-AppVuldroid
  • Vulnerable Android Application https://github.com/jaiswalakshansh/Vuldroid
  • OVAA (Oversecured Vulnerable Android App) - https://github.com/oversecured/ovaa
  • Damn Vulnerable Bank - https://github.com/rewanthtammana/Damn-Vulnerable-Bank
  • Allsafe (Intentionally vulnerable Android application) - https://github.com/t0thkr1s/allsafe
  • Android-InsecureBankv2 - https://github.com/dineshshetty/Android-InsecureB
  • Beetlebug ctf - https://github.com/hafiz-ng/Beetlebug
  • InjuredAndroid - CTF - https://github.com/B3nac/InjuredAndroid
  • AndroGoat - https://github.com/satishpatnayak/AndroGoat
  • OWASP Security Shepherd - https://github.com/OWASP/SecurityShepherd
  • vulnwebview - https://github.com/t4kemyh4nd/vulnwebview
  • Android Application Security - https://github.com/RavikumarRamesh/hpAndro1337
  • **DVHMA - https://github.com/logicalhacking/DVHMA**

https://twitter.com/cyph3r_asr/status/1413438299545296902?s=61&t=9aQD2WWBvHpsJosK42YH3A