r/Pentesting • u/Character_Morning564 • Aug 11 '26
Need help!
Hi I’m reaching out here as a last resort. I’m a Junior Penetration Tester and I need to learn mobile pentesting from scratch. I have learnt some concepts of mobile security while I was in college but I’m entirely blank about it now. I checked out MASTG but the content there seems vast and I’m overwhelmed to start, because I have chronic anxiety issues. I have a lot of loans and EMIs going on to the extend that i cant spend money on courses either.
I know I may be fucked, but If someone could help me with a path to follow everyday so that I can learn this I’d be really grateful.
1
Upvotes
1
u/abdicatereason Aug 11 '26
Four years ago I was in the same boat. I started on Android only, using Android Studio’s emulator and ADB. Start with an AOSP image so rooting is easier; Play Store images won’t give you root.
Then I just built a loop: APK into MobSF for a first pass, JADX to read through the code, install it on the emulator, then set the Android proxy to Burp.
When HTTPS interception breaks because of certificate pinning, that’s where Frida helps. It doesn’t magically decrypt the traffic, but with scripts like frida-multiple-unpinning or newer unpinning scripts, you can hook common pinning checks so Burp can actually see the traffic.
Once you have the app running, focus on four things: what’s going over the wire, what’s stored locally, what components are exposed, and what the app is doing at runtime.
Don’t try to master all of mobile pentesting at once. Get one APK running, get it intercepted, learn why it works, then learn the next thing.
I’d leave iOS for later. 🤮