Android App Security Testing Lab: Emulator, ADB, MobSF, Frida and Burp

Part of our free Build Your Own Cyber Lab series. Work through it in order, or jump to the part you need.

1. Plan your lab: hardware, hypervisors and safe networking
2. VirtualBox and VMware basics, then Kali, Parrot and Windows 11
3. Beyond VirtualBox: Hyper-V, VMware Workstation and Proxmox
4. Dual boot Kali Linux and Windows safely
5. Ubuntu in your lab: desktop, server, SSH and Docker
6. Active Directory lab with Windows Server
7. Attack-and-defend network: firewall and vulnerable targets
8. Metasploitable 2 and 3: install and first exploits
9. Blue-team lab: Wazuh, Sysmon and Security Onion
10. Android app testing lab: emulator, MobSF, Frida and Burp (you are here)
11. OT/ICS security lab: OpenPLC, Modbus and an HMI
12. Network lab: build it in Packet Tracer or GNS3, read it in Wireshark

What you will build

A self-contained Android testing lab that covers the methods in the OWASP Mobile Application Security Testing Guide (MASTG):

• Static analysis - pulling apart an APK without running it (MobSF, jadx).
• Dynamic analysis - running the app on a rooted emulator and hooking it at runtime (Frida, objection).
• Traffic interception - reading and modifying the app's API calls (Burp Suite).

Only test apps you are allowed to test: the intentionally vulnerable apps listed below, or your own.

Step 1: A rootable emulator with Android Studio

1. Install Android Studio and open Device Manager > Create device.
2. Pick a phone profile, then choose a system image labelled Google APIs rather than Google Play. Google APIs images allow adb root; Play Store images are locked down like retail phones.
3. Pick an x86_64 image so it runs quickly on a PC, and start the emulator.

Step 2: ADB basics

adb (Android Debug Bridge) ships with Android Studio's platform tools.

adb devices                 # the emulator should be listed
adb root                    # restart adbd as root (Google APIs images)
adb install app.apk         # install a test app
adb shell pm list packages  # find the app's package name
adb logcat                  # live device logs - apps often leak secrets here

Step 3: Intentionally vulnerable apps

• OWASP MAS crackmes (the UnCrackable apps) - root detection, tamper checks and secrets to recover, graded by level.
• InsecureBankv2 - a deliberately vulnerable banking app with a small backend, good for traffic and storage issues.
• DIVA (Damn Insecure and Vulnerable App) - short exercises covering insecure storage, logging and input validation.

Step 4: Static analysis with MobSF

MobSF (Mobile Security Framework) produces a full static report from an APK: permissions, exported components, hard-coded secrets, insecure settings and more. Run it in Docker on your Ubuntu host from part 5:

docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest

Browse to http://<host-ip>:8000, upload an APK and read the report. Check the MobSF README for the current image tag and default login. Pair it with jadx (a decompiler) to read the Java/Kotlin code behind each finding.

Step 5: Dynamic instrumentation with Frida and objection

Frida injects JavaScript into a running app so you can watch and change its behaviour - bypassing root detection, dumping keys, or forcing a check to return true.

1. On your PC: pip install frida-tools objection
2. Check your Frida version with frida --version, then download the frida-server release with the same version for your emulator's architecture (x86_64) from Frida's GitHub releases.
3. Push and start it:

adb root
adb push frida-server /data/local/tmp/
adb shell "chmod 755 /data/local/tmp/frida-server && /data/local/tmp/frida-server &"
frida-ps -U                 # lists processes on the device

4. objection wraps common Frida tasks in simple commands:

objection -g <package.name> explore
# inside objection:
android root disable
android sslpinning disable

Step 6: Intercept traffic with Burp Suite

1. In Burp, add a proxy listener on all interfaces (for example port 8080).
2. Point the emulator at it: set the Wi-Fi proxy to your PC's IP and port 8080 in the emulator's settings, or start the emulator with an HTTP proxy option.
3. Install Burp's CA certificate. Since Android 7, apps ignore user-installed certificates by default, so for most apps the certificate must be added to the system store on a rooted emulator. The exact method changes between Android versions - follow PortSwigger's current Android guide for your API level.
4. Apps that use certificate pinning will still refuse the connection. That is where objection's android sslpinning disable or a Frida pinning-bypass script comes in.

What to look for

Map what you find to the OWASP MASVS categories: insecure data storage (shared preferences, SQLite, logs), weak cryptography, missing pinning, exported activities and content providers, hard-coded API keys, and server-side flaws in the API behind the app.

Our mobile forensics lab and mobile labs let you practise the analysis side in the browser.

Keep it legal and contained

Only attack machines you own or have written permission to test. Vulnerable VMs and malware samples belong on an isolated network with no route to your home LAN or the internet, and never expose a deliberately vulnerable machine with a bridged adapter or a port forward.

Next step

Part 11 builds an industrial control system lab with a PLC, Modbus and an HMI.