Mobile Adversary Exploitation Breakout
November 2026 | Bucharest
Exploit mobile apps
Every day a flood of new mobile applications hits the store: games, utilities, IoT device clients and more. Almost every part of daily life can now be driven by an app, from hailing a cab and buying groceries to running a smart home, a fitness tracker or even a coffee machine. But is it just smart, or is it secure as well?
Mobile Adversary Exploitation Breakout enables attendees to master modern Android application penetration testing techniques and exploitation methods through intense, hands-on practice. This condensed one-day edition distils the flagship program down to its highest-impact core and runs it at pace.
The training focuses on practical exercises against several dedicated vulnerable apps, with the theory explained just before each do-it-yourself exercise so attendees immediately test their newly acquired skills. Both attack and defence techniques are covered. The primary focus is Android, but the mindset and techniques translate directly to iOS.
The day ends with a live capture-the-flag challenge.
Why is this workshop relevant?
This workshop is essential for anyone looking to master mobile security, taking you seamlessly from foundational concepts to professional execution.
By first mastering the Android ecosystem and application architecture, you’ll learn to pinpoint the specific threats and risks unique to the platform. You then put that knowledge into action through hands-on penetration testing and reverse-engineering, gaining the skills to surface real-world vulnerabilities in live applications.
Ultimately, this end-to-end training prepares you to deliver thorough, high-value security audits for both Android and wearable apps during client engagements.
Who is it for?
- Mobile application developers.
- Information security professionals.
- Mobile app vulnerability analysts and auditors.
- Mobility, mobile security and operations teams.
- Red team operators.
- Penetration testers moving into mobile security.
- Bug bounty hunters and security engineers.
What not to expect: to become a mobile ninja overnight. This is an intense, honest, hands-on day, and participants leave with a repeatable methodology and a lab pack to keep practising.
Workshop agenda
Kernel-level app isolation and SELinux enforcement, Zygote and the ART runtime, the install-time and runtime permission model, and an overview of the five attack surfaces. Includes a practical STRIDE threat-modelling walkthrough, the OWASP Mobile Top 10, and MASVS L1 versus L2 in practice.
Android Debug Bridge fundamentals, connecting to the hosted Android instance, installing the Frida server, verifying Burp proxy connectivity, deploying the vulnerable apps, and a quick MobSF verification.
The APK file format and unpacking with apktool, auditing AndroidManifest.xml for exported components and dangerous flags, decompilation to Java and smali, finding hardcoded secrets and insecure crypto, deobfuscation strategies, and an introduction to native libraries.
Storage locations and their security model, plaintext credentials and tokens in SharedPreferences, unencrypted personal data in SQLite, sensitive data leaking through logcat, Firebase misconfiguration, and sensitive data in Android backups.
Burp Suite as a man-in-the-middle proxy, certificate handling on modern Android, detecting certificate and public-key pinning, and bypassing it with objection, Frida and manifest patching, including the approach for Flutter applications.
Frida architecture and scripting, hooking Java methods and modifying return values, hooking native functions, using objection to explore the runtime and extract live data from the keystore and heap, and bypassing root detection.
- Lab 1, static analysis: decompile an APK with jadx, audit the manifest for exported components, find hardcoded server credentials, identify weak crypto usage.
- Lab 2, MobSF automated scan: upload an APK, interpret CVSS-scored findings, compare automated against manual results, isolate false positives.
- Lab 3, insecure data storage extraction: pull the app data directory, find cleartext credentials, dump a SQLite database, read logcat for credential leaks.
- Lab 4, Burp MitM and SSL pinning bypass: route traffic through Burp, capture and modify a login request, identify and bypass the pinning implementation.
- Lab 5, runtime manipulation: hook the login function to log credentials at runtime, bypass root detection, modify a function return value, enumerate databases and the keystore from the live app.
Attendees receive a vulnerable APK and hunt for four to five specific flags, each targeting a vulnerability class covered during the day. Flags are scored individually, so partial completion counts, and the solutions are walked through live at the end.
- Static: find a hardcoded credential in the source representation.
- Storage: extract a flag from a SQLite database.
- Dynamic: hook a flag-validation function with Frida and force a true return.
- IPC: trigger an exported activity with the right intent extras to reveal a flag.
- API bonus: exploit an IDOR in the backend API to access another user’s flag.
About the trainer
BLESSEN THOMAS
Blessen Thomas is an independent security researcher with more than 14 years of experience in offensive security. His work spans red teaming and application security across web, thick client, API and mobile, smartwatch and wearable penetration testing, mobile platforms including iOS, Android and Windows, IoT, OT, mainframes, SAP, SWIFT, RPA, cloud, ATM and KIOSK systems, network penetration testing, physical covert entry, wireless and telecom, delivered for enterprises and financial institutions worldwide. He holds a B.Tech in Information Technology from Anna University.
Certifications
GPEN · CRTO · OPST · CREST CRT(PEN) and CPSA · OSCP · CRTP · OSWP · C)PTE · CEH · CHFI
Blessen has been acknowledged in numerous corporate Halls of Fame, including Oracle, Sony and Splunk, for responsible disclosure. He has contributed to OWASP MSTG, SecLists, the OWASP API Top 10, OSSTMM, Awesome Mainframe Hacking and the WAVSEP benchmark.
His research and trainings have been accepted at security conferences worldwide, including DEF CON 34 Red Team Village, Hack in the Box Dubai, Hacktivity, CanSecWest, OWASP AppSec EU, RootCon, HITCON, Infosec Southwest, BSides London, BSides Frankfurt, BSides Tallinn and DefCamp.
Key learning objectives:
✔ Understand Android architecture, the security sandbox and the IPC model.
✔ Perform manual and automated static analysis of APKs.
✔ Intercept, analyse and manipulate HTTPS traffic via Burp Suite.
✔ Use Frida and objection for runtime instrumentation and bypass techniques.
✔ Exploit common vulnerabilities: insecure storage, exported components, SQL injection and deep-link abuse.
✔ Use MobSF for automated scanning and interpret the results critically.
✔ Apply OWASP MASVS as an assessment framework.
✔ Produce findings in a structured pentest report format.
Other information & prerequisites
- A personal laptop running Windows 11 64-bit, macOS, or a Debian-based Linux host. No netbooks, Chromebooks, tablets or corporate-locked machines.
- A minimum of 100 GB free disk space and 16 GB RAM preferred, to run the provided tooling virtual machine.
- An i5 or i7 processor, Apple silicon or equivalent, with up-to-date display drivers.
- VirtualBox and the VirtualBox Extension Pack installed. Apple silicon users should use VMware Fusion or UTM.
- Hardware virtualisation enabled in BIOS, with the BIOS password available if it is currently disabled.
- Android SDK platform-tools (adb) available.
- Administrator privileges, with antivirus, firewall and VPN disabled during class.
- A working USB port, Wi-Fi and wired network capability, and the ability to read PDF files.
What participants receive
- A presentation of more than 200 pages with all slides and whitepapers.
- Access to a trainer-hosted Android 11 cloud instance, rootable and pre-provisioned.
- A custom tooling image containing off-the-shelf tools, runtimes, target apps, scripts and fuzzing payloads.
- Vulnerable apps for Android and iOS, plus supporting tools.
- A customised mobile security testing checklist.
- A full take-home lab pack covering all bonus modules for self-paced study after the event.
Lab environment:
This is an Android training and it runs entirely on emulators. Students receive a custom virtual machine image with the complete offensive toolchain pre-installed, imported into VirtualBox, and connect it to a trainer-hosted rootable Android 11 Genymotion cloud instance. No physical device is required.
Android 11 is chosen deliberately as the stable baseline where interception, SSL pinning bypass and Frida instrumentation all work first time, so class time is spent on technique rather than troubleshooting. Android 16 hardening, including scoped storage, trust-store and Frida-spawn changes, is covered conceptually so participants understand how the attack surface is shifting on newer devices.
BONUS TAKE-HOME MODULES
Full slides and lab guides are provided for self-paced study after DefCamp. These extend the one-day core into a complete end-to-end mobile red team methodology.
- IPC exploitation: intents, exported components, Content Provider SQL injection and path traversal, WebView remote code execution.
- Mobile backend, API and cloud pentesting: the OWASP API Top 10 in a mobile context, IDOR workflows, privilege escalation testing.
- Defence in depth and CI/CD integration: MASVS, MASTG and MASWE, code hardening with Semgrep, SAST, DAST, SBOM, SCA and RASP in the pipeline, supply chain attacks via malicious SDKs.
- Backend recon and cloud: OSINT for mobile backends, Firebase enumeration, exposed bucket discovery, real fintech compromise case studies.
- Cross-platform and non-JVM auditing: Kotlin, React Native, Flutter, PWA, .NET and HTML5 apps, including split APK and XAPK packages.
- Android malware analysis and forensics: static and dynamic malware analysis, forensic acquisition, extracting hidden strings and obfuscated telemetry.
- Pentesting non-rooted devices: operational approach, repackaging workflows and tools of the trade.
- Backend web server pentesting: approach and methodology for the infrastructure behind mobile apps.
- IoT smartwatch and wearable security: Android Wear and Apple Watch methodology, common flaws, real case studies from the financial sector.
- Embedded application pentest: why it matters, common issues, approach, methodology and tools.
- Mobile red teaming and offensive operations: from vulnerability assessment to full red team campaigns, MITRE ATT&CK Mobile mapping, nation-state mobile malware case studies.
Other information
Estimated Workshop Duration: 1 day, approximately 8 hours of instruction
Language of Instruction: English
Participation fee: EUR 320
FAQs
If we do not meet the minimum number of participants, you can either transfer to another workshop and pay or receive a refund for any difference in price, or opt for a full refund. You will be notified in advance and given options to choose what works best for you.
The workshop price covers food. However, accommodation is not included, but we can recommend nearby options for your convenience.
Yes, full refunds are available up to 15 days before the workshop start date. However, if you cancel after that, we can offer only 50% of the price.
You will receive an email with all the necessary details, including the workshop location, prerequisites, and schedule, at least one week before the event. If you have any immediate questions, feel free to reach out to us directly.