Skip to content

awesome-mobile-security-learning-resources.md

Latest commit

 

History

History
109 lines (96 loc) · 7.96 KB

awesome-mobile-security-learning-resources.md

File metadata and controls

109 lines (96 loc) · 7.96 KB
Raw

Awesome Mobile Security Learning Resources

Mobile security is an intersection of AppSec, reverse engineering, platform-specific knowledge (Android/iOS) and network/transport security. The current authoritative standards are the OWASP MASVS (Mobile Application Security Verification Standard) and the OWASP MASTG (Mobile Application Security Testing Guide), which replaced the older MSTG in 2023.

ToC

  1. Books
  2. Videos
  3. Free/Paid Courses
  4. Free/Paid Labs
  5. Security Tools
  6. Certifications
  7. Blogs/Articles

Books

  1. OWASP MASTG - Mobile Application Security Testing Guide (free) - The de-facto reference, replaces MSTG.
  2. OWASP MASVS - Mobile AppSec Verification Standard (free) - Requirement standard paired with MASTG.
  3. The Mobile Application Hacker's Handbook by Dominic Chell et al. - Classic, slightly dated but concepts are evergreen.
  4. Android Security Internals by Nikolay Elenkov (No Starch) - Deep internals, still highly regarded.
  5. iOS Application Security by David Thiel (No Starch) - Focused on iOS AppSec.
  6. Android Hacker's Handbook by Joshua J. Drake et al. - Lower-level Android exploitation.
  7. Hacking iOS Applications by Corellium / contributors - Vendor-led but good technical content.

Videos

  1. OWASP MAS Project videos
  2. Android App Reverse Engineering 101 by Maddie Stone
  3. iOS pentesting with Frida - playlist
  4. Mobile Hacking - Hextree.io by LiveOverflow / Fabian Faessler - Excellent modern Android RE content.
  5. DEF CON / Black Hat mobile security archives
  6. OffensiveCon - Android & iOS internals

Free/Paid Courses

  1. OWASP MAS training materials (free)
  2. Android App Reverse Engineering 101 (free) by Maddie Stone
  3. Hextree.io - Android Hacking courses - High-quality, recently refreshed.
  4. 8ksec - Mobile Security Bootcamps - Paid, practical Android/iOS.
  5. SANS SEC575: iOS and Android Application Security - Paid, industry standard.
  6. INE - Mobile Application Security and Penetration Testing
  7. TCM Security - Mobile Application Penetration Testing
  8. Practical DevSecOps - Certified Mobile Security Expert - (if available in their catalog).

Free/Paid Labs

  1. OWASP MASTG Crackmes / UnCrackable apps - Free Android/iOS crackmes aligned to MASTG.
  2. InsecureShop (vulnerable Android app)
  3. DIVA (Damn Insecure and Vulnerable App) - Classic Android training app.
  4. InjuredAndroid by B3nac
  5. Allsafe by t0thkr1s - Modern intentionally vulnerable Android app.
  6. DVIA-v2 (Damn Vulnerable iOS App) - Primary iOS training target.
  7. iGoat-Swift - OWASP iOS goat project.
  8. HackTheBox - Mobile challenges
  9. Root-Me - Mobile challenges
  10. pwnable.kr / pwnable.xyz - Android/ARM challenges

Security Tools

Static analysis

  1. MobSF (Mobile Security Framework) - The all-in-one OSS analyzer for APK/IPA.
  2. jadx - Decompile DEX to Java source.
  3. apktool - Decode/rebuild APK resources.
  4. Ghidra - SRE for native libraries (NDK, dylib).
  5. radare2 / Cutter - Reverse engineering framework.
  6. Hopper / IDA Pro - Commercial RE tools.
  7. Semgrep mobile rule packs - SAST for Android/iOS source.
  8. QARK by LinkedIn - Quick Android Review Kit (note: slower development).

Dynamic / instrumentation

  1. Frida - Dynamic instrumentation for Android/iOS/macOS/Linux/Windows. Essential.
  2. Objection - Runtime mobile exploration built on Frida.
  3. Drozer by WithSecure - Android attack surface analysis.
  4. Medusa - Framework of modular Frida scripts.
  5. RMS - Runtime Mobile Security

Network interception

  1. Burp Suite / mitmproxy / Charles Proxy
  2. HTTP Toolkit - Easy mobile HTTPS interception.
  3. Proxyman

Device / emulation

  1. Android Studio AVD + rooted emulator
  2. Genymotion
  3. Corellium - Virtual iOS / Android devices (paid).
  4. checkra1n / palera1n - iOS jailbreaks for testing.
  5. Magisk - Android rooting & module system.

SSL pinning / security controls bypass

  1. Frida scripts: codeshare.frida.re
  2. Objection android sslpinning disable / ios sslpinning disable

Certifications

  1. SANS GMOB - GIAC Mobile Device Security Analyst - Industry standard.
  2. eMAPT by INE/eLearnSecurity - Practical, affordable.
  3. OSMR by Offensive Security - Advanced macOS/iOS exploitation (not pure mobile but relevant).
  4. OSDA / Offensive Mobile certifications (various)
  5. 8kSec's Certified Mobile Security Testing Professional

Blogs/Articles

  1. OWASP MAS project home
  2. OWASP Mobile Top 10 (2024)
  3. Google Project Zero research (Android, iOS)
  4. Maddie Stone - in-the-wild 0-days tracker
  5. NCC Group research - mobile
  6. 8kSec blog
  7. Frida CodeShare - Shared Frida scripts.
  8. HackTricks - Android/iOS pentesting
  9. Dana Wang / HexRays blog - iOS internals
  10. Android Security Bulletins
  11. Apple Security Releases
  12. NVISO labs blog - mobile RE
  13. r2frida - radare2 + Frida integration.
  14. NowSecure research