Mobile learning path

Orientation and first principles — what the bug class is and how it behaves.

1. 10 Mobile App Security Best Practices for 2026
   9 min readcatdoes.com2026
   Library for mobile application security best practices, offering guidance for React Native, Expo, and Supabase. It details techniques such as code obfuscation using R8, certificate pinning via Network Security Configuration, and secure local storage with react-native-keychain. The resource also covers implementing multi-factor authentication, securing API communication with interceptors and request signing, managing sessions with JWTs and secure storage, and employing runtime protection (RASP) with tools like react-native-jail-monkey, all aimed at addressing OWASP Mobile Top 10 threats and mitigating data breach risks.
2. Common Vulnerabilities and Exposures Examples in Mobile Apps
   6 min readcorellium.com2026
   Library for validating mobile application CVEs, enabling security teams to reproduce exploits and analyze vulnerabilities in virtualized iOS and Android environments. It supports automated security assessments, real-time reporting, and tools like Frida for hooking and tracing behavior, addressing challenges posed by the rising volume of CVEs and the limitations of testing within app sandboxes. This approach moves beyond static CVE database entries to provide actionable insights into exploitable risks, exemplified by issues like CVE-2024-26131 in the Element Android App and the Operation Triangulation CVE chain impacting iOS.
3. iOS Security Testing - OWASP MASTG
   7 min readmas.owasp.org2026
   Library for iOS security testing, detailing environment setup with macOS hosts, jailbroken devices, and tools like Burp Suite or OWASP ZAP. It covers obtaining device UDIDs via Finder or command-line tools such as `idevice_id` and `instruments`, and contrasts iOS simulators with emulators, noting the simulator's limitations for reverse engineering. The library also explains jailbreaking concepts, contrasting them with Android rooting, and highlights the benefits of privileged access for security testers, including root file system access and unrestricted debugging. It further categorizes jailbreak types (tethered, semi-tethered, semi-untethered, untethered) and discusses the challenges of maintaining jailbroken devices due to Apple's security hardening and signing mechanisms, mentioning exploits like CVE-2015-6794 and CVE-2015-7037.
4. Awesome Android Reverse Engineering: Curated List
   5 min readgithub.com2026
   Library of curated training, tools, and resources for Android reverse engineering, covering static and dynamic analysis techniques, decompilation with JADX and Ghidra, dynamic instrumentation with Frida and Objection, network analysis using Burp Suite and Wireshark, and popular tools like MobSF, QARK, and Androguard. It also lists resources for obfuscation, anti-reversing, firmware analysis, and includes CTFs and crackmes for hands-on practice.
5. Android security checklist: WebView - Oversecured Blog
   8 min readblog.oversecured.com2026
   Checklist of common Android WebView vulnerabilities, including insufficient URL validation (scheme bypasses via `javascript://`, `file://`, `content://`, and reflection API attacks), Universal XSS, JavaScript injection, and insecure internal URL handlers. The guide details attacks on JavaScript interfaces, universal/file access from file URLs, and arbitrary file theft via file choosers, citing examples like `DeeplinkActivity` and `OVAA`.

Real testing methodology, tooling, and writeups that show the work.

1. How a popular Android library silently exposed thousands of apps to Arbitrary File Overwrite (AFO). https://itis911.github.io/writeups/cropper-vulnerability.html
   6 min readitis911.github.io2026
   Library detailing an Arbitrary File Overwrite (AFO) vulnerability in the `com.canhub:android-image-cropper` library. The vulnerability arises from the library's default manifest configuration, specifically an `android:exported="true"` Activity and root-scoped `<paths>` in its `FileProvider`. This combination allows any installed app to craft an intent, providing a malicious source URI and an attacker-controlled output URI. The library then decodes an image, re-encodes it, and writes it to the specified output, effectively enabling file overwrites that could lead to account takeover via configuration corruption or, in specific non-standard loading scenarios, code execution by replacing native libraries.
2. Reverse engineering and modifying Android apps with JADX and Frida
   18 min readhttptoolkit.com2026
   Library for reverse engineering and modifying Android applications, utilizing JADX for code extraction and Frida for dynamic instrumentation. This resource details how to decompile APKs, analyze Java source code generated by JADX, and write custom Frida scripts to bypass security measures like certificate pinning, enabling traffic interception with tools like HTTP Toolkit. It covers techniques applicable to understanding and altering app behavior beyond standard certificate pinning implementations.
3. Bypassing iOS Frida Detection with LLDB and Frida
   5 min readtonygo.tech2026
   Writeup details bypassing iOS Frida detection using LLDB and Frida. The process involves jailbreaking an iPhone, setting up development tools like `libimobiledevice`, `frida-tools`, and LLDB, and then using `debugserver` for remote debugging. The author demonstrates how to find and breakpoint `FridaInTheMiddle.systemSanityCheck()` with LLDB to bypass detection, trace the `dummyFunction(flag:)` Swift function using `frida-trace` to get its mangled name, and finally hook this function with a Frida script to intercept and decode the Swift string argument, ultimately revealing the flag.
4. SQL injection vulnerabilities in Owncloud Android app
   10 min readsecuritylab.github.com2026
   Advisories detail SQL injection vulnerabilities in the Owncloud Android app, specifically impacting the `FileContentProvider` (GHSL-2022-059) and the `ReceiveExternalFilesActivity`. The `FileContentProvider` allows malicious applications to exploit SQL injection flaws through its `delete`, `insert`, `query`, and `update` methods, potentially leading to unauthorized data access or modification within the app's databases. Additionally, improper sanitization of externally provided file paths in `ReceiveExternalFilesActivity` can allow attackers to read from or write to the application's internal storage.
5. Android, SQL and ContentProviders - Why SQL injections aren't dead yet
   12 min readblog.ostorlab.co2026
   Writeup detailing SQL injection vulnerabilities within Android Content Providers. It explains how these providers, used for inter-process data communication, can be exploited when user-supplied input is not properly sanitized before being used in SQL queries. The article uses the Yahoo Weather app's Content Providers as a specific example, illustrating the mechanisms that allow for these injection attacks.

Novel research, edge cases, and the techniques that push the class forward.

1. Writing an iOS Kernel Exploit from Scratch
   43 min readsecfault-security.com2021
   Library for writing an iOS kernel exploit from scratch, focusing on chain #3 of a Google Project Zero exploit. It details setting up a test environment, reverse engineering IOKit drivers, analyzing a double-free vulnerability mitigated in iOS 11.4.1, and developing a full exploit using techniques including Siguza's sandbox escape. The entry serves as a beginner's reference for exploit development on iOS, with source code available.
2. DarkSword iOS Exploit Kit: 6 Flaws and 3 Zero-Days for Full Takeover
   6 min readthehackernews.com2026
   Library leveraging six iOS vulnerabilities, including zero-days CVE-2026-20700, CVE-2025-43529, and CVE-2025-14174, to steal sensitive data from iPhones running iOS 18.4 through 18.7. This JavaScript-based exploit chain, dubbed DarkSword, achieves code execution via JavaScriptCore vulnerabilities like CVE-2025-31277, escapes sandboxes through GPU processes, and escalates privileges via kernel flaws like CVE-2025-43520, ultimately exfiltrating information within minutes.
3. A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby - Project Zero
   46 min readprojectzero.google2026
   Library detailing a 0-click exploit chain targeting the Pixel 9, focusing on vulnerabilities within the Dolby Unified Decoder. This analysis delves into CVE-2025-54957, an integer overflow in the EMDF payload processing, and CVE-2025-36934, a driver vulnerability, explaining how these lead to arbitrary code execution in the mediacodec context and privilege escalation to the kernel. The research highlights the increased attack surface introduced by AI-driven audio transcription features in mobile devices.
4. Advanced Android Hacking Course
   mobilehackinglab.com2025
   Workshop materials from Ken Gannon, a Pwn2Own and Pwnie award winner, detail advanced Android hacking techniques used in competitive scenarios like Pwn2Own. Gannon, who has won Pwn2Own consecutively by compromising flagship devices, shares insights into the strategic approaches employed by security researchers to discover and exploit vulnerabilities in mobile platforms.
5. The Mac Malware of 2024 👾
   68 min readobjective-see.org2025
   Library cataloging new macOS malware for 2024, detailing specimens like the CloudChat stealer. It covers infection vectors, persistence mechanisms, and features, providing technical analysis and sample download links. The library references tools such as ProcessMonitor, FileMonitor, and Hopper Disassembler, and highlights the rise of info-stealers and AI's role in malware development.
6. Reversing of Eufy Security Video Doorbell sync protocol and wifi creds decryption from flash memory
   27 min readadepts.of0x.cc2026
   Library for reversing the Eufy Security Video Doorbell. This work details the soundwave sync protocol, jamming capabilities by deauthenticating the device from its hidden Wi-Fi network, and the extraction and decryption of Wi-Fi credentials from flash memory. It targets the OCEAN_XXXXXX network used by the Homebase Station and doorbell, building on prior research into Eufy's proprietary protocols.
7. A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens
   5 min readprojectzero.google2026
   Toolchain detailing a 0-click to root exploit chain for Pixel 10, leveraging a 2026 Dolby UDC vulnerability (CVE-2025-54957) patched in early 2026, and a newly discovered VPU driver `mmap` vulnerability. The VPU bug allows arbitrary kernel read-write by mapping physical memory beyond its intended region, granting immediate kernel code execution.
8. Android 15 Vulnerabilities: A Comprehensive Security Research Analysis
   medium.com2026
   Android 15 Vulnerabilities: A Comprehensive Security Research Analysis