Mobile apps run on devices you do not control, which changes how they must be built and tested. This mobile penetration testing training teaches you how to assess Android and iOS applications, from the app package and local data to the backend it talks to, following the OWASP Mobile Application Security guidance.
Who should attend
- Penetration testers extending into mobile
- Mobile developers and technical leads
- Application security engineers
- Security analysts reviewing mobile products
Prerequisites
Participants should understand HTTP and web application basics and be comfortable with the command line. Experience with web application testing tools such as Burp Suite is helpful; basic familiarity with Java/Kotlin or Swift helps with the reverse engineering modules.
What you will learn
- Android and iOS security models and architecture
- Setting up a mobile testing lab and tooling
- Static analysis of application packages
- Dynamic analysis and runtime inspection
- Insecure data storage and sensitive data exposure
- Network communication, TLS and certificate pinning
- Authentication, session handling and biometric authentication
- Platform-specific issues such as exported components and deep links
- Reverse engineering resistance and tampering risks
- Testing the backend APIs of mobile apps
- Using the OWASP MASVS and MASTG as a testing framework
- Reporting mobile findings clearly
Hands-on labs
Participants work with intentionally vulnerable Android and iOS applications in a prepared lab, practicing static analysis, dynamic instrumentation, traffic interception and testing of the backend APIs.
What you receive
- Course materials and lab access
- A mobile testing checklist mapped to OWASP MASVS
- A certificate of attendance
Frequently asked questions
Learn to secure and test mobile apps
Contact us for dates, pricing and corporate options.
