Phase 1 — Initial Access
Path Traversal to Arbitrary File Writes
Discover path traversal vulnerabilities in Android application components. Chain them to achieve arbitrary file writes to controlled locations on the device filesystem.
Taught by Ken Gannon, Pwn2Own winner 2023-2025 and Head of Vulnerability Research at MHL. Build a 3-phase, 11-link exploit chain against a Samsung Galaxy S8 — from path traversal to full device compromise. Pre-configured virtual labs. No hardware needed.
A pre-rooted Samsung Galaxy S8 running in the cloud. No hardware to buy. No emulator to configure. Log in and start building exploit chains.
Real ARM64 firmware. The same target Ken Gannon used at Pwn2Own.
Full filesystem access, debugger attached, all tools pre-installed.
Browser-based. Spins up in under 60 seconds from any machine.
Path traversal to full device compromise — every link explained.
Lab environment included with enrollment. Extend anytime.
AI-powered hint system when you get stuck on a chain link.
Course preview
Sample lessons from the course. No slides, no theory dumps — watch actual vulnerability exploitation on real Android devices.
Ken Gannon (3x Pwn2Own winner) introduces the Advanced Android Hacking course and the 11-link Samsung Galaxy S8 exploit chain you'll learn to build from scratch.
Course sample: the Pwn2Own journey, what it takes to compete at the world's top hacking competition, and how this course builds the skills to get there.
Tour of the pre-configured virtual lab environments where you'll develop and test exploits on real Android device images. No hardware needed.
What you'll learn
Reverse-engineer and replicate a real Samsung Galaxy S8 exploit chain — 8 bugs, 3 OS features, 11 total links in the chain.
Discover path traversal vulnerabilities in Android application components. Chain them to achieve arbitrary file writes to controlled locations on the device filesystem.
Leverage the file write primitive to force-install a malicious application package. Trigger a device reboot to activate the payload and establish persistence without user interaction.
Complete the chain through browser-based interaction to achieve full device compromise. Exfiltrate data, demonstrate impact, and document the entire chain end-to-end.
Why this course
Learn the exact vulnerability classes and chaining methodology used to win Pwn2Own. Not theoretical — these are techniques that earned cash bounties on stage.
Every exercise runs in a virtual Android environment you access through your browser. No physical device. No emulator setup. No wasted time on configuration.
Build a complete exploit chain against a Samsung Galaxy S8. 8 bugs, 3 OS features, 11 links. Path traversal through arbitrary file writes to full device compromise.
Get direct video mentorship from MHL's vulnerability research team. Ask questions, get unstuck, and get feedback on your exploit development approach.
Access Djini AI, MHL's proprietary bug-finding assistant. Use AI-augmented analysis alongside manual techniques to accelerate your vulnerability research workflow.
Lifetime access to course content with updates as new techniques emerge. Certification exam included — prove your exploit development skills with a recognized credential.
How it compares
| Feature | MHL Advanced Android Hacking | SANS SEC575 | Udemy |
|---|---|---|---|
| Real exploit chains | ✓ 11-link Samsung chain | ✗ Overview only | ✗ Not covered |
| Virtual labs | ✓ Pre-configured VMs | Physical device required | ✗ Video-only |
| 1:1 Mentorship | ✓ Video sessions | ✗ | ✗ |
| Hands-on labs | ✓ 100% lab-based | Lecture-heavy | Video-only |
| Certification included | ✓ Exam included | GIAC extra ($900+) | ✗ |
| Price | €500 (33% off) | $8,000+ | $15 - $200 |
Full course syllabus
6 modules. 11 chain links. From path traversal to full device compromise — every step hands-on in your virtual lab.
Limited time offer
Taught by Ken Gannon · Pwn2Own winner 2023-2025
Common questions
No. All labs run on pre-configured virtual Android environments that you access through your browser. There is no hardware to buy, no device to root, and no emulator to configure. You get 90 days of lab access included with the course.
You will build a complete exploit chain against a Samsung Galaxy S8 that chains 8 distinct bugs and 3 OS features into an 11-link attack. The chain starts with path traversal vulnerabilities to achieve arbitrary file writes, escalates through forced app installation and device reboot, and culminates in full device compromise through browser interaction and data exfiltration. These are the same techniques used in real Pwn2Own competitions.
Yes. The course includes 1:1 mentorship video sessions with MHL's vulnerability research team. You can ask questions, get help when you are stuck on a specific chain link, and receive feedback on your exploit development approach. This is direct access to researchers who actively compete in Pwn2Own.
Enter the promo code AAH-MAR-33 at checkout on the Mobile Hacking Lab website. The discount of 33% (saving you €250) will be applied automatically. The code reduces the price from €750 to €500 and includes the full course, 90 days of lab access, and the certification exam.
SANS SEC575 is a broad mobile security overview that costs $8,000+ before the optional GIAC certification ($900+). AAH goes significantly deeper on exploitation specifically — you build a complete 11-link exploit chain against real hardware, learn Pwn2Own techniques from an actual winner, and get 1:1 mentorship. At €500 with the promo code, AAH delivers deeper exploitation training at a fraction of the cost, with the certification exam included in the price.
€500 instead of €750. Course, 90-day labs, certification exam, 1:1 mentorship — all included. Taught by Ken Gannon, 3x Pwn2Own winner.
Use promo code AAH-MAR-33 at checkout.