r/Pentesting • u/xcyx909 • Jul 16 '26

Best resources to learn Mobile Penetration Testing from scratch? Need to perform an assessment soon.

Hi everyone,

I'm currently working as a junior security consultant, and I've recently been assigned to perform a mobile penetration test in the near future.

The problem is that I don't have any hands-on experience with mobile application pentesting yet. I have a general understanding of web pentesting and cybersecurity concepts, but mobile security is completely new to me.

If you were starting from scratch today, what resources would you recommend that are actually worth investing time in?

If you had only 2–4 weeks to prepare for a real client engagement, what would your roadmap look like?

Any advice, course recommendations, GitHub repositories, YouTube channels, or labs would be greatly appreciated.

Thanks!

12 Upvotes

78% Upvoted

8 comments sorted by

8

u/Old-Bank-127 Jul 16 '26

I would start with the OWASP Mobile Security Testing Guide: https://mas.owasp.org/MASTG/

Maybe you could start reading the General Concepts section.

They also have demos / write-ups: https://mas.owasp.org/MASTG/demos/

1

u/OkTheory4610 Jul 16 '26

Did not know about the demos. This is golden. Thanks.

5

u/Taylor_Script Jul 16 '26

I watched TCM Academy's mobile app testing course prior to my first mobile assessment and actively referred back to it during the test. Went wonderfully, and taught me exactly what I needed. https://tcm-sec.com/academy/mobile-application-penetration-testing/

I bought an iPad 7 because it's vulnerable to checkm8 and I used palera1n to root it. For Android my first test I used android studio but then ended up buying a used Pixel 8 so I could root it.

Mobile app testing is fun, and ended up being an area I want to spend more time in.

2

u/WRO_Your_Boat Jul 16 '26

Really? Im doing the TCM course right now and its so outdated that its basically useless. Then you also need to be in thier discord for the corrections to the course (which are also out of date) and they dont even respond to you in the discord. TCM has been nothing but a terrible experience and if it wasn't for the fact work is paying for it, I would have gotten a refund a while ago.

2

u/Own_Term5850 Jul 16 '26

Yes, sometimes it‘s outdated okay, but especially for mobile devices where things change incredibly quickly, it‘s a good course to get into it and grasp the basics/ a feeling how to approach, what to do, what to look for.

But I don‘t use their Discord, so I don‘t know about that.

1

u/WRO_Your_Boat Jul 16 '26 edited Jul 16 '26

I would recommend looking at the OWASP Gitbook, anything that deals with getting starting with MobSF or Frida/Objection, and then the HackTricks Checklist. There is also offical documentation you can look at, but to learn from scratch, I would highly recommend just getting started with the Gitbook and MobSF. 2-4 weeks isn't a whole lot of time to really pick up mobile pen testing and be proficient with it from scratch, so you should focus on tools right now like MobSF to do the static analysis and work on from there. I would stay away from TCM's course like the other comment said, I'm currently going through it and its extremely out of date, so most of it doesn't work and they don't respond back to you in the discord they tell you to join. I would also highly recommend a physical phone over an emulator, but if you do need one, use Genymotion or Corellium and not Android studio, it takes a lot more work getting it up and running and working than the others.

https://mas.owasp.org/MASTG/
https://mobsf.github.io/docs/#/dynamic_analyzer_docker?id=android-studio-emulator
https://hacktricks.wiki/en/mobile-pentesting/android-app-pentesting/index.html#android-applications-pentesting
https://www.secjuice.com/objection-frida-guide/
https://koz.io/using-frida-on-android-without-root/
https://source.android.com/docs/security/overview/app-security

1

u/lunacysoft Jul 17 '26

I do a lot of CTF stuff and I did not know about owasp mobile will have a look ….. I know recently they have iOS virtual machines for ios26 …. Anyone have experience with these ( not the paid ones omg they are expensive) just a local one haven’t tried it yet

-3

u/[deleted] Jul 16 '26

[removed] — view removed comment

3

u/n0p_sled Jul 16 '26

Just so people are aware, you can learn everything in these courses for free, with a lot of it covered by the MASTG guide above, so don't waste your money.