Web Banner
Back to Pre-Conference Training Page

Back to Conference Home Page

Mobile Adversary Exploitation Breakout

Two-Day Interactive (Classroom) Training - OWASP New Zealand Day 2026

Course Details

Dates: Tuesday and Wednesday, 1-2 September 2026

Time: 8:45 a.m. to 5:30 p.m. (NZST)

Training Level: Intermediate

Instructor: Blessen Thomas

Course Fee: NZ $900.00 (plus GST and ticketing fees)

Registration Site: https://events.humanitix.com/owaspnz2026-training

Course Description

Every day we see a bunch of new mobile applications being published on the Store, from games, to utilities, to IoT devices clients and so forth, almost every single aspect of our life can be somehow controlled with “an app” like taking a cab ride or buying groceries. We have smart houses, smart fitness devices, and smart coffee machines…but is it just smart or is it secure as well?

The Mobile Adversary Exploitation Breakout training will enable attendees to master various mobile application penetration testing techniques and exploitation methods. With rise to IoT devices, we have included IoT Smart Watch Wearable (Android Wearable & iWatch) Application Penetration testing methodology and case studies.

The training focuses on practical hands-on exercises on several dedicated vulnerable apps, with the basic theory explained prior to the mind-bending Do-It-Yourself exercises, enabling the attendee to test his acquired skills during the training. Both attack and defending techniques will be taught.

These two days fast paced tightly action-packed brain-melting revamped custom-tailored flag-ship training program will include subjects covered from setting up Android pentest environment, Identifying and exploiting application vulnerabilities in a variety of mobile application architectures, changes in Android 16 Baklava security features, and complementary subjects.

The training will mainly focus on Android applications. However many of the techniques will apply to iOS applications as well.

This training ensures true end-to-end testing by covering comprehensive complementary subjects including Mobile Red Teaming, API and Cloud security, back-end infrastructure, and web server testing. Attendees will also dive into assessing non-native and hybrid architectures—including Kotlin, Flutter, HTML5, React Native, Progressive Web Apps (PWA), and .NET — as well as modern CI/CD pipeline security and embedded application testing.

Learning Outcomes

What You’ll Receive

Student Prerequisites

Students could be familiar with below topics, but it is not mandatory:

Student Laptop Hardware/Software Requirements

Working Personal laptop (no Netbooks, no Chromebook, no tablets, no corporate laptops, due to restrictions enabled), with Windows 11 64-bit, MacBook, Debian-based Linux in Host machine installed.

Windows/Linux Users: Please install the latest version of a standard Type-2 hypervisor (VirtualBox recommended).

Apple Silicon (M1-M4) Users: Due to architecture differences, users must have VMware Fusion or UTM installed for stable ARM emulation.

Detailed Topic Outline

Day 1 - Foundations, Reverse Engineering, and Static Analysis

Module 1 - Android Architecture and Security model
Module 2 - Lab Environment and Toolchain Setup
Module 3 - APK Reverse Engineering and Static Analysis
Module 4 - Insecure Data Storage

Day 2 - Dynamic Analysis, Network Interception, and Advanced Exploitation

Module 5 - Network Interception and SSL Pining Bypass
Module 6 - Runtime Instrumentation - Frida and objection
Module 7 - IPC Exploitation: Intents, Components,and Content Providers
Module 8 - Mobile Backend Infrastructure,API, Cloud Pentesting (Brief)
Wrap Up and Next Steps

Your Instructor

Blessen Thomas - Biography to be provided