دوره تست نفوذ پیشرفته اندروید و باگ‌بانتی

- Android security architecture: app sandbox, UID model, SELinux, Binder IPC.
- APK/AAB internals, DEX, resources, manifest merging, splits, and signing.
- Threat modeling: data flows, trust boundaries, assets, and reachable entry points.

- JADX, Apktool, decompilation limitations, and obfuscation triage.
- Trace authentication flows, crypto usage, sensitive sinks, and API clients.
- Smali patching and controlled repackaging in an authorized lab.

- ADB workflows, rooted emulator setup, and runtime observation.
- Frida Java/native hooks, overloads, class loaders, and method tracing.
- Objection and custom scripts for hypothesis-driven testing.

- Proxy setup, trust stores, Network Security Config, and TLS behavior.
- Certificate pinning analysis and lab-only bypass for inspection.
- WebSockets, GraphQL, gRPC/protobuf, and nonstandard API traffic.

- Exported activity/service/receiver/provider security and permission checks.
- Intent spoofing, unsafe parcelables, PendingIntent misuse, and URI grants.
- Content provider exposure, path traversal, and cross-app data access.

- URI routing, intent filters, verified App Links, and unsafe redirects.
- WebView JavaScript bridges, URL loading, file access, and origin confusion.
- Chaining app-to-web and web-to-app trust boundary failures.

- API mapping, object-level authorization, BOLA/IDOR, and role boundaries.
- Session lifecycle, token storage, refresh flows, device binding assumptions.
- Race conditions, transaction workflows, and high-impact logic flaws.

- SharedPreferences, SQLite/Room, files, backups, and logging exposure.
- Android Keystore, biometric-gated operations, and unsafe crypto patterns.
- Hardcoded credentials, signing keys, debug artifacts, and secret validation.

- JNI bridges, ARM64 shared libraries, strings, symbols, and Ghidra triage.
- Root/emulator/debugger/tamper detection as analysis obstacles.
- Safe, scoped evaluation of client-side trust and integrity assumptions.

- Repeatable static rules, MobSF triage, and finding verification.
- Targeted Frida scripts, Burp extensions, and API collection workflows.
- False-positive reduction, evidence capture, and regression checks.

- Program scope, rules of engagement, eligibility, and safe testing.
- Recon from public app packages, release diffs, and feature exploration.
- Impact chains, severity reasoning, and duplicate-resistant reporting.

- Black-box analysis of a purposely vulnerable Android target.
- Combine component, runtime, storage, and backend findings into attack paths.
- Deliver actionable PoCs with reproducible steps and remediation advice.

Assess an intentionally vulnerable Android application and its companion API. Build an attack-surface inventory, prioritize hypotheses, validate vulnerabilities, and prepare a consolidated researcher-grade submission package.

1. Scope, model, and map the target (1 hour)
2. Perform static and dynamic research (3 hours)
3. Validate findings and impact paths (2 hours)

REQUIRED SUBMISSION PACKAGE

- Attack-surface map and methodology notes
- Validated findings with precise reproduction steps
- Request/response evidence, scripts, and screenshots
- Impact narrative, severity rationale, and exploitability limits
- Root-cause explanation and prioritized remediation guidance