Between 2013–2017, AppSec Labs taught Android Application Hacking at Black Hat USA five years running, and at Black Hat Asia. The course was built and delivered by our founder, Erez Metula, whom Black Hat’s own programme described as a “world renowned application security expert”.

We no longer offer training of any kind — this page is history. Today AppSec Labs is an Israeli application-security company specializing exclusively in penetration testing of web applications, REST APIs, and mobile apps – founded in 2010 by Erez Metula (author of Managed Code Rootkits), based in Kfar Saba, Israel, serving hundreds of organizations worldwide.

The courses

Each of these is still on Black Hat’s archive:

Why it mattered at the time

It is easy to forget how new this was. When the course first ran in 2013, there was no OWASP Mobile Application Security Verification Standard and no Mobile Application Security Testing Guide — both came later. Teams were shipping Android applications far faster than anyone had agreed how to test them, and a tester arriving at their first mobile engagement had almost no methodology to fall back on.

So the course had to build one: how to get inside an APK, read what the developers actually did, reach the parts of an application a user never sees, and tell a real vulnerability from an interesting artefact. Running for five consecutive years at Black Hat USA — and being repeated at Black Hat Asia — is the clearest measure of how much that was needed.

What was taught

  • Reversing Android applications — unpacking and decompiling an APK, reading obfuscated code, and recovering the developer’s intent from what shipped.
  • Runtime manipulation — hooking a running application, tampering with method calls and parameters, and defeating client-side controls that were never meant to be trusted in the first place.
  • The mobile attack surface properly understood — not just the app, but the API behind it, the data left on the device, the IPC surface, and the transport in between.
  • Finding what matters — authorisation flaws and business-logic abuse in the backend, which is where the serious mobile findings almost always are.

The platform: AppUse

A two-day class cannot spend its first morning on environment setup. Twenty people arrive with twenty laptops, twenty Android SDK versions and twenty different reasons why the proxy certificate will not install — and by the time that is solved, the day is gone.

So we built AppUse and taught on it. It was a ready-made Android assessment environment in a virtual machine: a modified emulator, a “hostile” ROM with runtime manipulation hooks built in, Burp Suite already wired through the proxy, and the reversing and analysis tooling of the day preinstalled. Everyone in the room booted the same image and started attacking applications within minutes, which is the only way a class like that works.

It became something of a Swiss army knife for Android penetration testing and spread well beyond our courses — for several years it was a common answer to “what do I use to test an Android app?”. It has been unmaintained since around 2016 and should not be used today; Frida and objection made a bundled ROM unnecessary. The full account of AppUse, and what to use instead, is here.

What became of it

The training wound down with the rest of our courses — we chose to specialise in testing. But the methodology did not go anywhere: mobile application penetration testing is one of the three things we do, alongside web applications and REST APIs, and the last point above is still the one that matters most. The interesting finding is rarely in the APK; it is in what the API lets the app ask for.

Expert-led testing of complex authenticated applications – multi-tenant isolation, authorization/BOLA, business-logic and workflow abuse, complex role models – with developer-usable remediation.

Talk to us about testing your mobile application. See also the wider training story, the book that came out of the same research, the people who came through here, and working with us.