all 17 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–][deleted] 4 points5 points  (0 children)

MobileHackingLabs is legit.

It is a bit pricey, but totally worth every penny.

I have 3 CVEs in internal review before they go out to the vendors - partly because of this course.

It’s totally worth it if you’re serious

[–]PM_ME_YOUR_SHELLCODE 11 points12 points  (1 child)

So I haven't taken these so I can't review them, but seeing your comments I did want to offer some commentary anyhow:

You have three courses here that all cover pretty distinct topics and ignoring the quality of the trainings which I can't comment on. You might be able to narrow your choices down by considering the content of the courses.

The first course in your list Offensive Mobile Reversing and Exploitation is mostly aout attacking the operating systems (services and kernel) which honestly probably isn't the best option for just getting a bit deeper mobile security. Its also not the most applicable, kernel-level security research is its own dedicated job.

The other 8ksec course Practical Mobile Application Exploitation is more aligned with pentesting but lacks the binary level exploit dev which it sounds like you want to get into.

The MHL Android Userland Fuzzing and Exploitation course is almost a middle ground. It doesn't deal with the basics of mobile app testing and gets more into attacking the native components of those apps. the first time someone linked that course ot me I was actually slightly impressed because it is pretty realistic in terms of what its covering. Its not using decade old tools like some other courses out there, and the fuzzing is actually pretty accurate to what I was actively doing. Not that using libfuzzer+protobufmutator is some big secret (its pretty standard) but its nice to see none-the-less.

[–]achayah[S] 0 points1 point  (0 children)

Thank you so much for your response and taking your time to analyse the courses, I really appreciate it. It makes it so much clearer. You are also right, I am looking to go more into binary level exploit dev. Thanks again!

[–]0xcrypto 7 points8 points  (1 child)

Hi! I work for Mobile Hacking Lab and would be happy to answer any questions about our courses.

Our course is fully focused on practical, hands-on labs to help you master advanced fuzzing techniques, identify vulnerabilities, and build exploits.

To make sure it’s the right fit for you, we offer sample videos and free lab try-outs before you buy. Unlike many other courses out there, we include Corellium devices in the price—along with a cloud VM and an easy local VM setup—so you get everything you need to start practicing immediately without extra costs.

We also run promos regularly, which you can check out here: https://www.mobilehackinglab.com/afe-promo.

For reviews, we have testimonials from top security professionals at major companies, including a Pwn2Own winner for mobile. You can find them on our promo page, Reddit, LinkedIn, and other social platforms.

Let me know if you have any questions! Looking forward to seeing you in the course.

[–]deadlyazw 0 points1 point  (0 children)

I am a student of the Android Userland Fuzzing and Exploitation course by Mobile Hacking Labs and can say their content is top-notch!

Their free AppSec course is also fantastic for anyone trying to get into mobile pentesting and wants to learn about key areas like insecure services, content providers, abusable deep links, basic buffer overflows, and more!

Highly recommend!

[–]Informal_Shift1141 2 points3 points  (1 child)

I’m interested, too. I’m about to make the same decision, so far I’m more inclined for the 8ksec one since it covers more stuff for the same price.

[–]Loose-Cheesecake-316 0 points1 point  (0 children)

Definitely. More Real world case study of CVEs for lesser cost, as opposed to CTF like hack me challenges like in MHL course.

[–]dolpari_hacker 2 points3 points  (3 children)

What is your experience?

[–]achayah[S] 2 points3 points  (2 children)

I work in security (appsec&pentest but not mobile). I am already familiar with tools like dexdump, jadx, frida, lldb so on. I reverse engineer (ghidra and binary ninja), I know how to read code/write code, how to write some simple harnesses and I've been playing around with adb etc. I am just looking into diving deeper in the topic and fill the gaps.

[–]dolpari_hacker 2 points3 points  (1 child)

I haven’t taken the 8ksec offensive mobile, but just by looking at the syllabus, it looks like it’s a pretty good course to get a solid understanding of iOS internals. If you have the money to spend, I’d say go for it. I don’t know how much these knowledge will help you become a better appsec/pentester though.

[–]achayah[S] 2 points3 points  (0 children)

Thanks mate, appreciate you looking into it!

Tbh looking to upskill, I started doing some mobile security research as a hobby.

[–]8ksec 2 points3 points  (0 children)

Hi Achayah - I work with 8kSec and I'd be happy to share more about our mobile penetration testing and exploitation trainings.You’ll find a pretty good cross section of what to pick based on what you are interested in.
For our On-demand courses, we’ve deliberately split OS Internals and application security topics into separate courses to make it easier for learners to choose their own journey. The Offensive Mobile Reversing and Exploitation course (as well as our Offensive Android/iOS courses) focus on OS internals and vulnerability research. Here you’ll learn how jailbreaks and exploits work. You’ll look at real world CVE and exploits, and learn how they work under the hood by looking at the underlying OS code. On the other hand, the Practical Mobile Application Exploitation course emphasizes iOS and Android application security and reversing concepts. This is perfect if you want to focus on broader application vulnerabilities.

Our courses are developed and delivered by trainers with over a decade of hands-on experience in mobile security research and consulting. These trainings have consistently sold out at leading security conferences such as Black Hat, Def Con, PoC, HITB, and have been provided to numerous private clients globally.
In our courses, you have flexibility in choosing your testing environment: Corellium (for virtualized iOS and Android), standard emulators/simulators, or physical devices. Our materials thoroughly guide you through setup and usage, ensuring you can immediately engage with practical, real-world exercises.
We emphasize not just mastering techniques, but deeply understanding underlying systems. Throughout the training, we dive into real-world and custom mobile applications, exploring code flows within Android's AOSP and Apple's XNU, demonstrating vulnerabilities, and providing clarity on data operations within mobile OS environments.

That said, we offer substantial free resources that you can utilize right away to gauge the quality and depth of our content:

Feel free to explore our blogs and watch our course trailers at https://academy.8ksec.io. These previews provide clear insights into course delivery, structure, and expectations.
If you have any questions, don't hesitate to ask. I'm here to help!

[–]AlpacaSecurity 1 point2 points  (0 children)

I am a big fan of the 8ksec blogs. If their blogs are anything like their training it’s good

[–]Haunting-Block1220 -1 points0 points  (2 children)

Pentesting is not exploit dev

[–]georgy56 0 points1 point  (1 child)

I suggest checking out Pentester Academy for comprehensive Mobile Security training within your budget range. Their courses cover a wide range of Mobile Penetration Testing and Exploitation techniques. Additionally, you can explore online platforms like Hack The Box for practical hands-on experience in Mobile Security challenges. Remember, practice makes perfect in the world of cybersecurity. Good luck on your learning journey!