1. Lab- Setup
   1. Android Emulator / Physcial Device
   2. Magisk & Xposed Framework Installation
   3. Jadx & Apktool & Dex2jar
   4. Burpsuite & Frida
   5. Mobsf
   6. Android Studio
2. Part 2: Download & Installation
   1. Https://apps.evozi.com/apk-downloader/ Or Https://apkcombo.com/
   2. From Playstore
   3. Using Adb
3. Sec-1: Insecure Data Storage
   1. Sensitive Info Leakage Through Logs
   2. Copy/paste Buffer Caching
   3. Hardcoded Sensitive Data Like Api-keys, Credentials, Any Salt , Token Etc.
   4. Keyboard Press Caching
   5. Url Caching And Browser Cookie Objects
   6. Hardcoded Sensitve Data
   7. Insecure Local Storage Of Sensitive Data
   8. Sensitive Data Leakage Via Memory Leakage
   9. Backups For Sensitive Data
4. Sec 2: Ipc / Component Exploitation
   1. Exploit Exported Acitivity
   2. Exploit Exported Receiver
   3. Exploit Content Provider
   4. Misconfig Intent & Intent Filter
   5. Exploit Content Provider
   6. Misconfig App/deep Link
   7. Improper Webview Implementation
5. Sec 3 : Weak Cryptography
   1. Poor Key Managment Process
   2. Weak Hashing & Encryption
   3. Unencrypted Database Files
   4. Use Of Insecure Algorithm
6. Sec 4 : Reverse Engineering / Debugging
   1. Unauthorized Code Modification
   2. Insecure Version Of Os Installation Allowed
   3. Code Obfuscation
7. Sec 5: Runtime Analysis
   1. Client/server Side Attack
      1. SQl Injection
      2. Cross Site Scrpting
      3. Injections like XML ,XXE etc.
   2. Application Level Dos
   3. Inseucre Authentication
      1. No token/session Implementation
      2. Improper token/Session Implementation
      3. miconfig Oauth2 Flaw
      4. Authentication Bypass by chaining
   4. Subtopic 4
   5. Broken Access Control (BAC)
      1. IDOR & Privielege Escalation
      2. Unatuhorizes Api Call
8. BY 1: Application Restriction Bypass
   1. SSL PINNING BYPASS
      1. By Xposed
      2. BY Frida
      3. Reversing
   2. ROOT BYPASS
      1. Magisk Hide
      2. Xposed
      3. Frida
      4. Reversing
   3. 2FA/Passcode/Pin protection bypass
      1. Exported IPC Component
      2. Response Manipulation
   4. login bypass/Account takeover
      1. SQL INJECTTION
      2. CREDENTIAL BRUTEFORCING
      3. Response Manipulation
9. Main Topic 9