PROGRESS
0%
Beginner Android Penetration Testing
Mission Briefing - Android's Security Model 0/1 ▶ Setting Up Your Arsenal - Building a Pentesting Lab 0/1 First Recon - Understanding the Target 0/1 Traffic Analysis 0/1 Attacking the Database - SQLite Injection 0/1 Final Challenge: Hack a Real-World Vulnerable Android App 0/1
← Beginner Android Penetration Testing

Setting Up Your Arsenal - Building a Pentesting Lab

Task 1 Lab Setup ▾
⬇ diva-android-master.zip Click to download Download

Introduction

A pentester is only as good as their tools. In this room, we'll build a safe, isolated, and legal environment to hack Android apps. We will use an emulator so we don't break our own phones.

Lab Setup Steps

1. Install Java Development Kit (JDK)

  • Why? Android tools are built on Java.
  • Action: Download JDK 8 or 11 from Oracle or OpenJDK. Install it and set the JAVA_HOME environment variable.
  • Verification: java -version

2. Install Android Studio & SDK

  • Why? It provides adb (Android Debug Bridge), emulator, and other platform tools.
  • Action: Download Android Studio from developer.android.com/studio. Install it. During installation, ensure the "Android SDK Platform-Tools" and "Android Emulator" are selected.

3. Install Genymotion (Faster Emulator)

  • Why? The default AVD is slow. Genymotion is much faster for testing.
  • Action:
    • Create a free account on genymotion.com.
    • Download Genymotion with VirtualBox.
    • Install it.
    • Create a new virtual device (e.g., Google Nexus 5 - Android 9.0 or 10.0).

4. Install APKTool

  • Why? For reverse engineering and repackaging APKs.
  • Action:
    • Download the apktool.jar and a wrapper script from the official website.
    • Place them in a folder (e.g., C:\tools\apktool) and add it to your PATH.

5. Install Burp Suite Community Edition

  • Why? To intercept, view, and modify network traffic between the app and the internet.
  • Action:

6. Configure Emulator to use Burp Proxy

  • Action in Genymotion:
    1. Start your Genymotion emulator.
    2. Go to Settings -> Wi-Fi.
    3. Long-press on the connected network (WiredSSID or similar) and select Modify network.
    4. Select Show advanced options.
    5. Set Proxy to Manual.
    6. Enter your computer's local IP address (e.g., 192.168.1.x) and Burp's port (default 8080).
    7. Save.

7. Test ADB Connection

  • Action on your computer's terminal:

    adb devices

  • Expected Output: You should see your running emulator's serial number (e.g., 192.168.56.101:5555 device).

Your First ADB Commands

# See connected devices
adb devices

# Get an interactive shell on the device
adb shell

# Inside the shell, list installed packages
pm list packages

# Exit the shell
exit

# Install an APK
adb install your_app.apk

# Pull a file from the device to your computer
adb pull /sdcard/Download/somefile.txt .

Summary

  • You have a functional testing lab: Emulator + ADB + APKTool + Burp Suite.
  • adb is your primary command-line tool to interact with the device.
  • Your emulator's traffic now routes through Burp, allowing you to intercept it.