Hacking Android Devices

Sam Bowne

Submitting Projects

CCSF students must do these things to get credit:

  • Perform the project steps until you find a flag
  • Capture a whole-desktop image showing the flag
  • Outline or highlight the flag in the image
  • Submit the image in the appropriate Project in Canvas
  • Type the flag into the text field

If you prefer, you can use the automated scoreboard
at the bottom of this page, but please do not submit
the same project both in Canas and the automated
scoreboard.

   

Android Emulator Setup


Any OS

M 140: Android Studio Emulator 15
M 141: Burp with Android Studio's Emulator 20
M 145: Making a Rooted Android Emulator 10
M 146: Troubleshooting Emulators 30 extra
M 142: Rooting Android Studio's Emulator not recommended 15 extra
M 105: Plaintext Login 15
M 107: GenieMD Broken SSL (Harvard & IBM)    15 + 40 extra
M 111: Debian Linux Virtual Machine    15
M 108: Kali Virtual Machine not recommended 15 extra
M 109: Broken SSL 30 extra
M 120: Burp and Android 8 10 extra
Download Kali VM

Alternative Android Emulators

Not Recommended

Mac or Linux

M 101: Genymotion 15
M 103: Burp 20

Windows

Do M 108 first
M 104: BlueStacks 15
M 106: Burp and Nox 20
M 601: Rooting BlueStacks on Windows    10 extra

ADB


Any OS

M 200: ADB with Android Studio 15
M 207: ES Explorer Command Injection    10 + 10 extra
M 210: Security Audit of an App    15 extra
M 211: Find a New App Vulnerability and Report it    50 extra

ADB for Alternative Emulators

Not Recommended

Mac or Linux

M 201: ADB on Genymotion on a Mac    15
M 202: BlueStacks on a Mac 15 extra

Windows

M203: ADB & Nox on Windows    15

Private Cloud

H 110: Private Cloud with Proxmox  35 extra
H 112: Cloudflare Quick Tunnel  25 extra

Restricted Projects

Click Here (password required)

Vulnerability Scanners

M 301: Qark    15 extra
M 302: AndroBugs    10
M 304: MobSF Static Analysis    25 extra
M 305: MobSF Dynamic Analysis    35 extra
M 310: Android Malware and VirusTotal    20 extra

Smali

M 401: Trojaning the Progressive App    20
M 402: mAadhaar Code Modification    20
M 404: Safeway Reversible Encryption -- REMOVED 10-28-22    
M 410: Exploiting an Android Phone with Metasploit    15 extra
M 412: Reversing FlareBear    20
M 414: Chirp Hardcoded Password    10 extra

Attacking App Components

M 503: SomNote Vulnerable Content Provider    15
M 511: Exploiting Sieve: a Vulnerable App    20
M 512: Exploiting EVABS    55 extra
M 513: Instrumenting with Frida    15
M 520: Stealing Secrets from Lastpass on Android    15 extra
M 521: Stealing Secrets from Keeper on Android    15

Scores archived 7-24-23

Scores archived 8-20-25

Enter Flags · Scoreboard · Details


Scores archived, scoring software updated 8-20-25
M 412, 513, 521 changed to required 8-25-25
Private Cloud added 8-30-25
M 146 added 9-12-25
Restricted projects added 9-20-25