I watched this certification from INE Security for some time and on last Blackfriday (2023) finally purchased voucher for it. It was great deal, because the price was 50% off from the original.
I read on internet about this certification, other people experiences and how should I prepare for it.
I decided that I will prepare for it by myself, so I did not purchase any prepcourse except for two courses about Android hacking from udemy academy, just to compare my skill with skills of the presenters.
How did I prepare for the exam ? First of all I have to say this very clearly:
If you are not familiar with Android development, Android studio, emulators, rooted devices and Java programming, you gonna have hard time, because this exam does not require just to find vulnerabilities and write report, but you have to instead submit working POC application to exploit found vulnerabilities. This is unique compared to other exams.
The application must be able to exploit all discovered vulnerabilities against target applications.
I studied and experimented for about a month, but because I was already experienced (I write applications and code for Android) I just went throught scenarious, which could possibly be on final exam.
Once I clicked ‘Start exam’ I downloded two vulnerable applications and info PDF about how should be POC application structured.
I started with statical analysis of first application and followed with second one. I analyzed both of them with JADX tool.
I used adb logcat, android studio and online hash database to gather my plaintexts. JADX did real good job I was able to read the code almost like the original one.
This really helped, because if you can read the code properly you can understand it and based on this you can build your own POC application.
I stucked in one particular part, but finally understood where I was making mistake and fixed the code based on that.
I began my exam on Monday morning and completed my proof of concept by the second day. But I wanted be sure that I did not overlook any important detail and really understood found vulnerabilities and that there was nothing under the surface.
So on Wednesday I went throught the process of exploitation again and found one more fix that I implemented into my application.
I submitted my proof of concept same afternoon and received an email confirming my success minutes after submitting the application and source code. I received my result very quickly without having to wait for days or weeks.
The turnaround was so swift that I decided to visit the membership website to confirm if my certificate was there. To my relief, everything checked out, and I was honored with EMAPT certification.
I need to mention that you should have following skills to be successfull within the exam:
- setup your environment properly (for API level 24 — Android 7) — Android Studio and emulator. I had also real rooted device as a backup
- AndroidManifest analysis — used components its attributes and permissions
- be able to work with android emulator and adb shell
- understand what is Activity, Service, Content Provider, Intents, Broadcast listener etc.
- understand how hashing and encryption works
- be able to decompile and analyze the code
- be able to develope Android applications in Java to make calls to exploit found vulnerabilities
I can say that exam was like medium level. Do not expect something totally horrible such obfuscated code or hours spend on guessing encryption keys. It was pretty straightforward, but without certain level of experience you can easily fail.
I liked the fact that I had enought time (7 days) to finish my exam and there was none time pressure, so I could enjoy the experience even more.
You can retake the exam for FREE! The only condition is that you have to submit your POC application for this exam even in case it would not work or you already know that you will probably fail .
I really enjoyed this experience and I can say it was worth of it, because I realized certain things and found areas that I should visit again and dig deeper.