Mobile app security: Android and iOS

37 courses, 821 lessons. A real Kali Linux lab in the browser.

Introduction to mobile app security (Level 101, 30 lessons): You learn why apps on a phone are a security topic of their own, look inside an APK and an IPA, and take a first look at secrets, storage, network and device management.
Android fundamentals: architecture, permissions and updates (Level 101, 33 lessons): You get to know Android's layers, permissions, app isolation and storage, and make a phone safe with screen lock, updates, Play Protect and the work profile.
Getting started with Android development in Kotlin and Java (Level 101, 31 lessons): You get to know the structure of an Android project, build it from the Gradle command line, write small screens in Kotlin and Java, run your first unit tests and sign a release.
iOS fundamentals: architecture, permissions and safe use (Level 101, 30 lessons): You learn from scratch how the iPhone and iPad work: versions, app isolation, permissions, the Apple account, screen lock, updates, backups and configuration profiles, and make a device safe.
The Android security model: sandbox, permissions, signing and SELinux (Level 201, 22 lessons): You learn, through a security person's eyes, how apps are kept apart, how permission protection levels and special access work, and how APK signing schemes, verified boot and encryption fit in.
App components and intents: activity, service, receiver, provider (Level 201, 22 lessons): You learn the four components that make up an Android app, intents and deep links, and how to protect that surface.
Testing and builds on Android: JUnit, Robolectric, Gradle and CI (Level 201, 22 lessons): You manage Gradle scripts and dependencies, test Kotlin and Java code with JUnit and Robolectric without an emulator, set quality gates with lint and R8 and tie it all into a CI pipeline.
Secure mobile development 1: storage, cryptography, authentication and network (Level 201, 22 lessons): You apply the first four areas of OWASP MASVS-style requirements: storing data safely, using cryptography correctly, getting sessions and biometrics right and protecting network traffic.
Android static analysis fundamentals: apktool, jadx and aapt2 (Level 201, 22 lessons): You learn to examine an APK without running it: unpack the package, read the manifest and resources, browse the code with jadx, and turn embedded secrets and risky settings into a clean finding note.
Reviewing data storage on Android: preferences, databases and backups (Level 201, 22 lessons): You examine the traces an app leaves on a phone using prepared data exports: you look for sensitive data in preference files, SQLite databases, cache, external storage and backups, and recommend the fix.
Mobile app traffic analysis: prepared captures, TLS and pinning (Level 201, 22 lessons): You read a mobile app's network behaviour from prepared traffic captures: you assess which servers it sends what to, its TLS settings, certificate validation and pinning, and find the leaks.
The iOS security model: secure boot, code signing, sandbox and data protection (Level 201, 22 lessons): You learn iOS's layered protection through a security person's eyes: the secure boot chain, the Secure Enclave, code signing and entitlements, the sandbox, data protection classes and the Keychain.
Static analysis of an IPA: Info.plist, entitlements and bundled files (Level 201, 22 lessons): You examine an iPhone app package without running it: you read Info.plist settings, entitlements, the provisioning profile, embedded frameworks and files, and find and report secrets and risky settings.
Mobile device management (MDM) fundamentals (Level 201, 22 lessons): You learn how an organisation manages its fleet of phones and tablets: enrolment methods, ownership models, policies, app distribution, compliance and lost-device actions, all tried on a simulated management console.
Inside the Android platform: Binder, Zygote, ART and hardware-backed security (Level 301, 22 lessons): You learn how the platform works from boot to app process, the package manager, privileged apps, the TEE and key attestation.
Secure mobile development 2: platform, code quality, resilience and privacy (Level 301, 23 lessons): You apply the remaining four areas of MASVS-style requirements: building components and WebViews safely, handling input and dependencies, strengthening your own app against tampering and designing privacy in.
Smali and native code review: dex bytecode and .so libraries (Level 301, 22 lessons): Where jadx gives up you read smali, get to know the dex format, follow the JNI bridge and statically audit native libraries for compiler protections, embedded secrets and risky functions.
Reviewing WebViews, deep links and IPC (Level 301, 22 lessons): You audit the doors through which an app takes outside data: you find and fix mistakes in deep links, app links, WebView settings, JavaScript bridges, content providers and PendingIntents.
Mobile backend API security (Level 301, 22 lessons): You audit the API the app talks to in your own lab: you derive the endpoints from the APK, find mistakes in authentication, authorisation, sessions, rate limiting and versioning, and fix them on the server side.
Automated mobile scanning: MobSF, semgrep and triaging findings (Level 301, 22 lessons): You learn to scan APKs and IPAs with automated tools, read the report, weed out false alarms, write your own rules and connect scanning to the team's workflow.
Triage of suspicious Android apps (Level 301, 22 lessons): From the defence team's side you assess a suspicious APK without running it: you extract permissions, components, tell-tale signs of known families and network indicators, and write a verdict and response note.
Secure development on iOS: Swift code review and fixes (Level 301, 22 lessons): You find and fix security mistakes in Swift apps from the source: Keychain and data protection, crypto, biometrics, network trust, links, web views and privacy.
Reviewing data storage on iOS: containers, backups and the Keychain (Level 301, 22 lessons): You audit the data an iOS app leaves behind using prepared exports: container folders, plists and databases, caches and cookies, backup contents and the protection levels of Keychain items.
Managing Android Enterprise: work profile, full management and policy files (Level 301, 22 lessons): You manage an Android fleet with policy files: work profile and fully managed modes, passcode and update policies, managed app configuration, kiosk mode and compliance, writing the policies as JSON and verifying them on the simulated device.
Apple device management: configuration profiles and declarative management (Level 301, 22 lessons): You learn the building blocks of managing an iPhone and iPad fleet: configuration profiles and payloads, supervised mode, automated enrolment, managed apps, declarative management and profile signing, all tried on files and a simulated server.
Reviewing cross-platform apps: React Native, Flutter and hybrid (Level 301, 22 lessons): You learn how apps built from one codebase look inside the package and where they go wrong: JavaScript bundles, Dart snapshots, bridge plugins, secure storage plugins and over-the-air update mechanisms.
Mobile app assessment with MASVS: method, evidence and report (Level 301, 22 lessons): You learn to run a mobile app assessment end to end: scope and authorisation, the MASVS control groups, the test plan, collecting evidence, rating severity, writing the report and retesting fixes.
Privacy review of mobile apps: SDKs, permissions and declarations (Level 301, 22 lessons): You show with evidence what an app does with personal data: data inventory, permission and SDK inventory, traffic verification, comparison with store declarations, consent flows and assessment against the rules of different countries.
Reviewing app resilience: obfuscation, integrity and attestation (Level 401, 21 lessons): You learn to evaluate defences against reverse engineering and tampering: you measure obfuscation quality, review integrity and environment checks, set up server-side app attestation and decide whether it is enough for the threat model.
Android device triage and forensics (Level 401, 18 lessons): You examine a suspect company phone from prepared evidence sets: you preserve the evidence, build a timeline from the bugreport, logs, package and usage records, look for traces of compromise and report the findings.
iOS binary analysis: Mach-O, Objective-C and Swift (Level 401, 18 lessons): You read an iOS app's binary statically: you take apart the Mach-O structure, load commands and Objective-C and Swift metadata, and find security checks and embedded secrets in the pseudocode.
iOS device triage and forensics (Level 401, 18 lessons): You examine a suspect iPhone from prepared evidence sets: you read backup and sysdiagnose contents, assess installed profiles, apps and crash records, scan with indicators and build a timeline.
Fleet compliance, conditional access and app protection policies (Level 401, 18 lessons): You tie a device's state to the decision to reach company data: compliance rules, conditional access, app protection policies on unenrolled devices, exception handling and measuring fleet health.
Mobile threat modelling and secure architecture (Level 401, 18 lessons): You assess a mobile system at design time: assets and trust boundaries, device, app, network and backend threats, and architecture decisions and security requirements for offline work, payment and identity flows.
Mobile DevSecOps: the build pipeline, signing keys and release security (Level 401, 18 lessons): You secure a mobile app's road from code to store: security gates in the pipeline, dependency and SDK checks, protecting signing keys, pre-release verification, staged rollout and emergency withdrawal.
Building and running a mobile application security programme (Level 501, 18 lessons): You move from one app to the organisation's whole mobile portfolio: inventory, risk tiering, standards and requirements, team training, metrics, managing suppliers, vulnerability disclosure and incident readiness.
Case: the Yelkovan Bankası mobile banking assessment (Level 501, 21 lessons): You bring the whole path together in one case: you assess Yelkovan Bankası's Android and iOS apps, backend and staff fleet, respond to a lookalike app incident, retest the fixes and present to leadership.

Projects

First look at a courier app: what is inside the APK and IPA?: You unpack the APK and IPA of Kuzeyyıldızı Kargo's courier app, find the package details, permissions, signer and a hard-coded key, and write a one-page first-look note.
Device health check for school tablets: On Gelincik Okulları's teacher tablets, you check the OS version, security patch level, screen lock and app permissions from a simulated adb device and prepared iOS exports, and fill in a checklist per device.
Manifest and component audit of a loyalty app: You open Turnalı Perakende's loyalty app with apktool and jadx, audit its exported components, permissions and signing scheme, and write a findings table proposing the manifest fix for each finding.
Audit what an appointment app stores on the phone: In prepared data exports from Lavinya Klinikleri's appointment app, you examine the preference files, SQLite databases, cache and backup archive, and write a storage report showing exposed patient data and tokens.
Review a booking app's network traffic: In prepared captures from Mercanköşk Otelcilik's booking app, you examine cleartext requests, weak TLS settings and the certificate pinning status, and hand in a corrected network security configuration with a findings note.
Fix storage and cryptography flaws in a field sales app: In the source code of Ayçiçeği Gıda's field sales app, you fix a session token stored in plaintext, a hard-coded encryption key and a weak password check, and get all the security unit tests to pass.
Static review of a document app's IPA: In the IPA of Sedirli Hukuk Bürosu's document app, you review Info.plist, transport security exceptions, entitlements and the files bundled in the package, and report the findings in order of severity.
Baseline MDM policy and compliance check for personal devices: For Karaçam Mobilya's sales team using personal devices, you write a baseline policy with passcode, encryption and update rules in a simulated MDM console, then check the device inventory against it and produce a compliance report.
Review and harden WebViews and deep links: In Göktaşı Yazılım's customer portal app, you review the WebView settings, deep link validation and the assetlinks.json file, fix the code and prove the fixes with unit tests.
Authorisation audit and fix of a parcel tracking API: On the lab API behind Kuzeyyıldızı Kargo's mobile app, you test object-level authorisation, token lifetime and rate limiting with recorded requests, fix the server code and report the retest results.
Triage and prioritise automated scan findings: You scan Yakamoz Telekom's subscriber app with MobSF and semgrep, dismiss false positives with reasons, write a custom semgrep rule for a missing check and give the developers a prioritised findings list.
A suspected fake payment app: static triage: You examine, without running it, a suspicious APK that imitates Selvikent Belediyesi's payment app, set out the signing and permission differences from the genuine one, list the indicators, write a YARA rule and prepare a public advisory.
A management policy set for Android and iOS field devices: For Demirsu Enerji's field team, you write an Android Enterprise policy file that sets up a work profile and an iOS configuration profile with restrictions, Wi-Fi and a certificate, and validate both on the simulated management server.
MASVS assessment report for an ordering app: You assess Ilgıntepe Tekstil's dealer ordering app against the MASVS checklist using a prepared assessment kit (APK, IPA, data exports, traffic captures), mark each requirement with its evidence and write the report for the client.
Privacy and SDK audit of a parents' app: You compare the third-party SDKs, requested permissions and prepared traffic captures of Gelincik Okulları's parents' app with its store privacy declaration, report the discrepancies and prepare a corrected declaration.
The captain's phone: Android device triage: You examine a bug report, logcat export and backup archive taken from a captain's phone at Lodoskaya Denizcilik with MVT and ALEAPP, and write a timeline and a decision note showing when the suspicious app was installed and what it did.
An executive's iPhone: triage from a backup and sysdiagnose: You examine a training backup, a sysdiagnose archive and the installed profile list from an executive's iPhone at Saklıvadi Üniversitesi with MVT and iLEAPP, and write a triage report stating with evidence whether the device can be trusted.
Add security gates to a driver app's build pipeline: You add static scanning, dependency checking and secret scanning steps to the build pipeline of Mavikaya Lojistik's driver app, move the signing key out of the repository into a vault and set up a gate that blocks the release on a critical finding.
Compliance rules and conditional access for store tablets: For Turnalı Perakende's store tablets, you write compliance rules, a conditional access policy and an app protection policy, test against sample sign-in logs whom the policy blocks and allows, and prepare a rollout plan.
A mobile security programme for a fourteen-app portfolio: From the inventory, scan and findings history data of Yakamoz Telekom's fourteen mobile apps, you derive risk tiers, set security requirements and metrics per tier, and write a one-year programme plan together with a script that calculates the metrics.