Mobile Security Fundamentals & Environment Setup

1. Prerequisite Knowledge

1.1 What Is Penetration Testing

Penetration testing is the process of evaluating the security of a target system by simulating the techniques and methods of real attackers, carried out only after obtaining written authorization from the system owner. Its purpose is to discover security vulnerabilities, assess their severity, and provide remediation recommendations.

The essential difference between penetration testing and hacking lies in authorization. Unauthorized security testing is illegal. All experiments in this course are conducted in a local emulator environment and do not involve any external systems.

The standard penetration testing process consists of five phases:

1. Information Gathering: Collect relevant information about the target system (domain names, IP addresses, open ports, application versions, etc.)
2. Vulnerability Scanning: Use automated tools or manual methods to discover potential weaknesses
3. Exploitation: Verify whether a vulnerability can be practically exploited
4. Privilege Escalation: Elevate from low-level privileges to higher-level access
5. Reporting: Organize findings into a structured document that includes vulnerability descriptions, reproduction steps, impact assessments, and remediation recommendations

1.2 Overview of the Android Operating System

Android is a mobile operating system developed by Google, built on the Linux kernel. Its architecture is organized into five layers, from bottom to top:

The Android security model relies on the following mechanisms:

• Application Sandbox: Each app runs under a separate Linux user ID, with its own process and data directory. By default, App A cannot access App B's files.
• Permission System: Apps must declare required permissions in AndroidManifest.xml. Starting with Android 6.0 (API 23), runtime permissions were introduced, allowing users to grant or deny sensitive permissions while the app is running.
• Application Signing: All APKs must be digitally signed before they can be installed. Signing verifies the integrity of the app's origin and the developer's identity.
• SELinux (Security-Enhanced Linux): A mandatory access control system. In Enforcing mode, even processes running as root will be denied if they violate the defined policies.

1.3 APK File Structure

An APK (Android Package) is the installation package format for Android applications. It is essentially a ZIP archive; after changing the file extension from .apk to .zip, you can open it with any decompression tool.

An APK contains the following core files and directories:

AndroidManifest.xml is one of the most important files for a security audit. It contains:

• package: The app's unique identifier (e.g., com.example.app)
• uses-permission: The list of declared permissions
• activity/service/receiver/provider: Declarations of the four core component types; the android:exported attribute determines whether a component can be invoked externally
• application: Global application configuration, including security-related attributes such as android:debuggable, android:allowBackup, and others

1.4 Tool Inventory

For installation instructions for the following tools, refer to the Appendix – Tool Installation Manual:

2. Command Line Basics

2.1 What Is the Command Line

A Command Line Interface (CLI) is a way of interacting with an operating system by typing text commands. Unlike a Graphical User Interface (GUI), where you point and click with a mouse, a CLI requires you to enter instructions in a specific format.

Windows provides two command-line environments:

• Command Prompt (cmd.exe): The traditional Windows command line, which uses DOS-style commands
• PowerShell: A more powerful command-line environment that supports scripting and pipeline operations

We will use cmd.exe as the default command-line environment. To launch it: press Win + R, type cmd, and press Enter.

2.2 File System Navigation

Current Directory and the Prompt:

After opening the command line, you will see something like the following:

C:\Users\用户名>

Here, C:\Users\用户名 represents the current working directory. The > is the prompt, indicating that the system is waiting for user input.

Basic Commands:

# 列出当前目录的文件和子目录
dir
# dir = directory 的缩写

# 切换目录
cd Desktop
# cd = change directory 的缩写
# 执行后当前目录变为 C:\Users\用户名\Desktop

# 返回上一级目录
cd ..
# .. 表示父目录

# 切换到指定盘符
D:
# 将当前盘符从 C 盘切换到 D 盘

# 同时切换盘符和目录
cd /d D:\tools
# /d 参数允许跨盘符切换

# 创建目录
mkdir test_dir
# mkdir = make directory 的缩写

# 删除空目录
rmdir test_dir
# rmdir = remove directory 的缩写

Types of Paths:

• Relative Path: A path relative to the current directory. For example, if the current directory is C:\Users, then cd 用户名 navigates into C:\Users\用户名.
• Absolute Path: A complete path starting from the drive letter. For example, C:\platform-tools\adb.exe.

2.3 Additional Command Line Notes

Tab Auto-Completion:

Type the first few characters of a path and press the Tab key; the system will automatically complete the rest. If there are multiple matches, press Tab repeatedly to cycle through them. This feature dramatically improves input speed and reduces typos.

Command History:

Press the ↑ (up arrow) key to recall previously entered commands. Press the ↓ (down arrow) key to move toward more recent history. This prevents you from having to retype the same commands.

Command Line Reminders:

• Use spaces to separate commands and parameters
• Press Enter to execute a command
• When a path contains spaces, wrap it in double quotes, e.g., cd "C:\Program Files"
• The Windows command line is case-insensitive

3. MuMu Emulator Installation and Configuration

3.1 The Concept of an Emulator and Why We Use One

An emulator is a program that simulates a target hardware and software environment on the host operating system. An Android emulator allows a Windows computer to run the Android OS and Android apps.

The reasons for choosing an emulator over a physical device for penetration testing are:

• Safety: Testing operations may cause irreversible modifications to a system. An emulator can be quickly restored to its initial state using snapshots.
• Root Access: Emulators typically offer a one-click root function. Gaining root on a physical device is a complex process that carries the risk of bricking the device.
• Screenshots and Recording: Because an emulator runs inside a desktop window, it is easy to take screenshots and record the screen to document the testing process.

Reasons for choosing the MuMu emulator:

• Based on Android 12 and compatible with mainstream apps
• Offers a one-click root toggle
• Supports both AMD and Intel CPUs
• Has built-in ADB debugging support

3.2 Download and Installation

Step 1: Download the Installer

1. Open your browser and navigate to https://mumu.163.com/
2. Click the "Download MuMu Emulator" button and select the Windows version
3. Wait for the installer download to complete (the file is approximately 500 MB)

Step 2: Run the Installer

1. Double-click the downloaded mumu_installer_xxx.exe
2. Click "Yes" in the User Account Control dialog that appears
3. On the first screen of the installation wizard, click "Custom Install"
4. Change the installation path (it is recommended to choose a non-system drive, such as D:, and reserve at least 10 GB of space)
5. Click "Install Now"
6. Wait for the progress bar to finish (approximately 3–8 minutes, depending on disk performance)
7. Once installation is complete, a MuMu Emulator shortcut will appear on the desktop

Step 3: First Launch

1. Double-click the desktop shortcut
2. The emulator window will display the Android boot screen
3. Wait for system initialization to complete (approximately 2–3 minutes)
4. You will then enter the Android home screen, which displays the system interface

3.3 Basic Configuration

Enabling Root Access:

1. Click the gear icon (Settings) on the toolbar on the right side of the emulator window
2. In the settings panel, select "Other Settings"
3. Find the "Root Access" option and click the toggle to turn it on
4. Close the settings panel
5. Click the power icon at the top of the emulator window and select "Restart"
6. Wait for the emulator to finish restarting

Other Essential Settings:

# 待 ADB 配置完成后执行以下命令（第 5 节之后补充操作）：

# 允许安装来自未知来源的应用
adb shell settings put secure install_non_market_apps 1

# 关闭 Google Play 保护机制
adb shell settings put global package_verifier_enable 0

# 将 SELinux 设为 Permissive 模式
adb shell su -c "setenforce 0"
adb shell getenforce
# 预期输出：Permissive

3.4 Basic Emulator Operations

The emulator uses the mouse to simulate finger touch operations:

Explanation of the toolbar buttons on the right side of the emulator window (from top to bottom):

• Screenshot
• Screen Recording
• Rotate Screen
• Volume Control
• Settings
• Minimize / Maximize / Close

4. ADB Installation and Connection

Learning Objectives

1. Complete the download and configuration of Android SDK Platform Tools
2. Connect to the MuMu emulator using ADB
3. Master 10 basic ADB commands

4.1 Introduction to ADB

ADB (Android Debug Bridge) is a command-line tool included in the Android SDK that enables communication between a PC and an Android device. ADB uses a client-server architecture:

• ADB Client: Runs on the PC; the user sends commands through the command line
• ADB Server: Runs in the background on the PC and manages the connection between the client and the device. By default, it listens on TCP port 5037
• ADB Daemon (adbd): Runs on the Android device and executes instructions sent by the server

4.2 Installing Platform Tools

Step 1: Download

1. Open your browser and go to: https://developer.android.com/tools/releases/platform-tools
2. In the "Downloads" section, click the download link for the Windows version
3. Accept the license agreement to begin the download
4. You will obtain the file: platform-tools-latest-windows.zip(approximately 10 MB)

Step 2: Extract

1. Locate the downloaded ZIP file
2. Right-click → "Extract All"
3. Enter the destination path C:\platform-tools
4. Click "Extract"
5. Confirm that the C:\platform-tools directory contains the adb.exe file

Step 3: Configure Environment Variables

An environment variable is a list of paths that the operating system uses to locate executable programs. Once C:\platform-tools is added to this list, you can run the adb command from any directory.

1. Press Win + R, type sysdm.cpl, and press Enter
2. In the "System Properties" window, select the "Advanced" tab
3. Click the "Environment Variables" button
4. In the "System variables" section, locate the row where the variable name is Path and double-click it
5. Click "New"
6. Enter C:\platform-tools
7. Click "OK" to close all dialog boxes

Step 4: Verification

1. Open a new command-line window (any already open windows must be closed and reopened)
2. Enter the following command:

adb version

Expected output (the version number may differ):

Android Debug Bridge version 1.0.41
Version 35.0.1-11580240
Installed as C:\platform-tools\adb.exe

If you see the message 'adb' 不是内部或外部命令, it means the environment variable configuration did not take effect. Check: whether you have closed the old command-line window, and whether the path in the Path variable is spelled correctly.

4.3 Connecting to the MuMu Emulator

Prerequisite: The MuMu emulator is launched and running.

# 1. 连接模拟器
# MuMu 模拟器的 ADB 端口固定为 7555
# 127.0.0.1 表示本机（localhost）
adb connect 127.0.0.1:7555

# 预期输出：
# connected to 127.0.0.1:7555

# 2. 验证连接状态
adb devices

# 预期输出：
# List of devices attached
# 127.0.0.1:7555   device

device indicates a normal connection. Other possible statuses:

• offline: The emulator is still booting or the ADB service has not fully initialized; wait and try again
• unauthorized: You need to confirm the USB debugging authorization dialog on the emulator
• no device: The ADB service is in an abnormal state; try running adb kill-server and then re-run adb connect

Troubleshooting:

# 如果连接失败，尝试重启 ADB 服务：
adb kill-server
adb start-server
adb connect 127.0.0.1:7555

4.4 Basic ADB Commands

# 1. 进入设备 Shell
adb shell
# 提示符变为设备名称或 "root@..." 表示已进入模拟器内部
# 输入 exit 返回 PC 命令行

# 2. 安装 APK
adb install 应用文件.apk
# 将 PC 上的 APK 文件安装到模拟器
# 预期输出：Performing Streamed Install → Success

# 3. 卸载应用
adb uninstall com.example.app
# com.example.app 为应用的包名，不是应用名称

# 4. 查看已安装应用列表
adb shell pm list packages
# 输出所有已安装应用的包名

# 5. 查找特定应用
adb shell pm list packages | findstr "mumu"
# findstr 为 Windows 下的文本过滤命令（Linux 下为 grep）

# 6. 推送文件到设备
adb push PC上的文件路径 /sdcard/
# 将 PC 文件复制到模拟器的 /sdcard/ 目录

# 7. 从设备拉取文件
adb pull /sdcard/设备上的文件 PC上的目标路径
# 将模拟器文件复制到 PC

# 8. 查看设备信息
adb shell getprop ro.build.version.release
# 输出 Android 版本号
adb shell getprop ro.product.model
# 输出设备型号

# 9. 重启设备
adb reboot
# 模拟器重启

# 10. 以 root 身份重启 ADB 守护进程
adb root
# 将 adbd 以 root 权限重新启动

5. Reqable Installation and HTTP Packet Capture

5.1 HTTP Protocol Fundamentals

HTTP (HyperText Transfer Protocol) is an application-layer protocol for communication between a client and a server. It operates on a request-response model:

1. The client (browser or app) sends a request to the server
2. The server processes the request and returns a response

Structure of an HTTP Request:

方法 路径 协议版本
请求头字段1: 值1
请求头字段2: 值2
（空行）
请求体（可选）

The request method indicates the type of operation to perform on a resource:

Request headers carry additional information. Common header fields:

Structure of an HTTP Response:

协议版本 状态码 状态文本
响应头字段1: 值1
（空行）
响应体

The status code indicates the result of the request:

5.2 How a Proxy Server Works

A proxy server sits between the client and the server, relaying communication data for both sides.

Under normal circumstances, the client connects directly to the server:

客户端 ────→ 服务器

When a proxy is configured, the client connects to the proxy server, and the proxy forwards the request to the target server:

客户端 ────→ 代理服务器 ────→ 目标服务器

Since all data flows through the proxy, the proxy can capture, inspect, and modify the communication content. Penetration testing leverages this capability to analyze and tamper with network traffic.

5.3 Installing Reqable

1. Open your browser and navigate to https://reqable.com/
2. Click "Download" → Select the Windows version
3. Double-click the downloaded installer and follow the default options to complete the installation
4. A Reqable icon will appear on the desktop; double-click to launch it

Initial Setup:

1. Open the main Reqable interface
2. Make sure the "Capture" tab on the left is selected
3. Make a note of the proxy port number displayed at the top (default is 9000)

5.4 Configuring the Emulator Proxy

Step 1: Obtain the Host Computer's IP Address

# 打开命令行，输入：
ipconfig

# 在输出中查找 "IPv4 地址"，常见格式：
# 192.168.x.x 或 10.x.x.x
# 注意：选择与模拟器通信的网卡对应的 IP（通常是以太网或 WLAN 适配器）

Step 2: Set the Emulator's Global Proxy

# 将 <IP> 替换为步骤 1 获取的地址
adb shell settings put global http_proxy <IP>:9000

# 示例：
adb shell settings put global http_proxy 192.168.1.105:9000

# 验证代理是否生效：
adb shell settings get global http_proxy
# 预期输出：192.168.1.105:9000

# 如需取消代理：
adb shell settings put global http_proxy :0

Note:settings put global http_proxy sets an Android system-level global HTTP proxy. This setting affects network requests sent through the standard HTTP API. Some applications use non-standard networking libraries and may bypass this setting. For such applications, VPN mode must be used.

5.5 Capturing Your First HTTP Request

1. Confirm that Reqable is running and the proxy port is 9000
2. Confirm that the emulator proxy has been configured and is active
3. Open the system browser within the emulator
4. Enter the following into the browser address bar: http://httpbin.org/get
5. Press Enter to navigate to the page
6. Switch to the Reqable window

Expected Result:

A new entry will appear in the request list on the left side of Reqable:

• The left side will display GET http://httpbin.org/get
• The detail panel on the right is divided into a "Request" tab and a "Response" tab
• The "Request" tab shows the request method (GET) and request headers
• The "Response" tab shows the status code (200 OK), response headers, and response body (text in JSON format)

httpbin.org is a public service used for testing HTTP requests. Its /get endpoint returns the incoming request information verbatim.

6. HTTPS Packet Capture and Certificate Installation

6.1 HTTPS and TLS Encryption

HTTPS (HTTP Secure) is the combination of the HTTP protocol and TLS (Transport Layer Security). TLS provides three core security guarantees:

1. Encryption: Communication content is encrypted, so even if a third party intercepts the data, they cannot read the original content.
2. Authentication: The server's identity is verified using a digital certificate, preventing a man-in-the-middle from impersonating the target server.
3. Data Integrity: A Message Authentication Code (MAC) is used to detect whether data has been tampered with during transmission.

Key visible differences between HTTP and HTTPS:

• URLs for HTTP requests begin with http:// and use port 80 by default
• URLs for HTTPS requests begin with https:// and use port 443 by default
• In the browser address bar, HTTPS websites typically display a lock icon

6.2 Digital Certificates

A digital certificate is a digital file used to verify the identity of a network entity, issued by a Certificate Authority (CA). X.509 is the standard format for digital certificates.

Certificate Chain of Trust:

根证书（Root CA）
  ↓ 使用根证书私钥签名
中间证书（Intermediate CA）
  ↓ 使用中间证书私钥签名
服务器证书（End-entity Certificate）

Operating systems and browsers come preloaded with a set of trusted root certificates. When visiting an HTTPS website, the client verifies that the server's certificate was issued by one of these trusted root certificates or an intermediate certificate in the chain.

Man-in-the-Middle Proxy Certificate Mechanism:

When Reqable acts as a man-in-the-middle proxy, for each HTTPS request, it dynamically generates a forged server certificate signed by the Reqable root certificate. If the client (the emulator) has trusted the Reqable root certificate, it will trust these forged certificates — which enables Reqable to decrypt HTTPS traffic.

Starting with Android 7.0 (API 24), the system distinguishes between "user certificates" and "system certificates":

• User certificates: Certificates installed through the Settings interface, stored in /data/misc/user/0/cacerts-added/
• System certificates: Pre-installed in the system, stored in /system/etc/security/cacerts/

By default, apps trust only system certificates. Therefore, a Reqable certificate installed the normal way (as a user certificate) cannot decrypt HTTPS traffic from most apps (those with targetSdkVersion ≥ 24). The certificate must be deployed to the system certificate directory.

6.3 Installing the Reqable Certificate to the System Directory

Step 1: Export the Reqable Root Certificate

1. Reqable main interface → Settings icon (gear) in the top-right corner
2. SSL Configuration → Export Root Certificate → Select the PEM format
3. Save the file — for example, name it reqable-ca.pem and place it on the desktop

Step 2: Compute the Android-Style Hash for the Certificate

# 切换到证书文件所在目录
cd %USERPROFILE%\Desktop

# 计算哈希值（需要 OpenSSL）
openssl x509 -inform PEM -subject_hash_old -in reqable-ca.pem | head -1
# 输出一个 8 位十六进制字符串，例如：2a5b6c7d
# 记录此值

If OpenSSL is not installed:

1. Navigate to https://slproweb.com/products/Win32OpenSSL.html
2. Download the "Win64 OpenSSL Light" version
3. Install using the default options
4. Add the bin subdirectory from the OpenSSL installation directory to the system Path environment variable (the method is the same as configuring the ADB environment variable)

Step 3: Generate the Android-Formatted Certificate File

# 将 <hash> 替换为步骤 2 输出的哈希值
openssl x509 -inform PEM -text -in reqable-ca.pem > <hash>.0

# 示例（假设哈希值为 2a5b6c7d）：
openssl x509 -inform PEM -text -in reqable-ca.pem > 2a5b6c7d.0

After execution, a file named <hash>.0 will be generated in the current directory.

Step 4: Push the Certificate to the Emulator

# 确保 ADB 已连接
adb connect 127.0.0.1:7555

# 以 root 身份重启 ADB 守护进程
adb root

# 将系统分区重新挂载为可读写
adb remount
# 预期输出：remount succeeded

# 推送证书文件
adb push 2a5b6c7d.0 /system/etc/security/cacerts/

# 设置文件权限（644 表示：所有者可读写、组可读、其他可读）
adb shell chmod 644 /system/etc/security/cacerts/2a5b6c7d.0

# 重启模拟器使配置生效
adb reboot

# 等待模拟器重启（约 1-2 分钟）
# 重新连接并确认代理设置
adb connect 127.0.0.1:7555
adb shell settings get global http_proxy
# 确认代理配置仍然有效（如果被清除，重新设置）

6.4 Verifying HTTPS Packet Capture

1. Confirm that Reqable is running
2. Enter the following in the emulator's browser: https://httpbin.org/get
3. Press Enter to navigate to the page
4. Switch to the Reqable window and examine the newly appeared request

Assessment Criteria:

• Certificate installation succeeded: The response body contains readable JSON text, not garbled characters
• Certificate installation failed: The response body area is empty, or the connection times out / is refused (TLS handshake failure)

7. Hands-On Exercise — Installing a Test App and Capturing Its Traffic

7.1 Environment Checklist

Before starting, confirm each of the following conditions one by one:

# 1. ADB 连接
adb devices
# 预期：127.0.0.1:7555   device

# 2. 代理配置
adb shell settings get global http_proxy
# 预期：<电脑IP>:9000

# 3. Root 权限
adb shell su -c "id"
# 预期：uid=0(root) gid=0(root)

# 4. SELinux 状态
adb shell getenforce
# 预期：Permissive（如果不是，执行 adb shell su -c "setenforce 0"）

7.2 Installing the Test App

# 语法：adb install <APK 文件的完整路径>
adb install C:\Users\用户名\Desktop\test_app.apk

# 预期输出：
# Performing Streamed Install
# Success

Once installation is complete, an icon for the new app will appear on the emulator's home screen. If the app does not appear on the home screen, you can find it in the app drawer (swipe up from the bottom).

Common Errors:

• INSTALL_FAILED_ALREADY_EXISTS: The app is already installed. Uninstall the existing version first: adb uninstall <包名>
• INSTALL_PARSE_FAILED_NO_CERTIFICATES: The APK is unsigned or its signature is invalid. Use a properly signed APK instead
• INSTALL_FAILED_INSUFFICIENT_STORAGE: The emulator has insufficient storage space. Increase the disk capacity in the MuMu settings

7.3 Packet Capture Operations

1. Confirm that the capture function is enabled in the main Reqable interface (the "Capture" tab on the left should be highlighted)
2. In the emulator, tap the icon of the test app to launch it
3. Interact with the various features of the app: tap buttons, switch pages, enter text and submit it
4. Observe how the request list in Reqable changes
5. Each time you see a new request, click through and inspect the following:

Analysis Template for Each Request:

请求 URL：
请求方法（GET/POST/其他）：
请求头中的重要字段：
  - Content-Type：
  - Authorization：
请求体内容（如果有）：

响应状态码：
响应体内容（摘录前 200 个字符）：
该请求的业务功能（我的操作触发了什么）：

Key Points of Interest:

• Does the request body contain sensitive information (plaintext data such as passwords, phone numbers, national ID numbers)?
• Does the response body return data beyond what the current user should have access to?
• Are there custom signature fields in the request headers (such as X-Sign, token)?

Acceptance Criteria:

• The app is successfully installed and runs
• At least 5 requests are captured in Reqable
• The analysis template is fully completed for each captured request
• You can distinguish between HTTP requests and HTTPS requests

8. Summary

8.1 Knowledge Framework

8.2 Toolchain Overview

PC 端工具：
├── Reqable（流量捕获）
├── ADB（设备通信）
│   ├── adb connect（连接模拟器）
│   ├── adb shell（进入设备命令行）
│   ├── adb install（安装应用）
│   └── adb push/pull（文件传输）
└── OpenSSL（证书处理）

模拟器端：
├── MuMu 模拟器（Android 12，已 Root）
└── 系统证书目录（已部署 Reqable 证书）

8.3 Environment Health Check

Please confirm each item and record the result (Pass / Fail):

# 检查项 1：ADB 连接
adb devices
# 通过条件：显示 127.0.0.1:7555   device

# 检查项 2：Root 权限
adb shell su -c "id"
# 通过条件：uid=0(root)

# 检查项 3：代理配置
adb shell settings get global http_proxy
# 通过条件：显示代理地址和端口

# 检查项 4：HTTP 抓包
# 在模拟器浏览器访问 http://httpbin.org/get
# 通过条件：Reqable 中显示请求记录

# 检查项 5：HTTPS 抓包
# 在模拟器浏览器访问 https://httpbin.org/get
# 通过条件：Reqable 中显示明文 JSON 内容