Mobile › Module 1 › Lesson 2
Lab Devices Only
Lab devices only means emulator, YOUR enrolled lab phone, or intentional vulnerable samples — document the device ID in $MOB_LAB notes before any tool run.
Visual · t27_lab_devices_only
Lab device literacy. $MOB_LAB only. Original Cyberlium.
Opening
The device is part of scope — Cyberlium refuses work on hardware you do not own or lack written permission to test.
A lab device is an Android emulator (AVD), physical phone you purchased for class, or org-issued test handset under explicit mobile lab policy. Intentional vulnerable apps — DVIA, MSTG crackmes, OWASP samples, APKs you compiled — live on that device only. Cyberlium maps allowed devices on YOUR $MOB_LAB inventory — serial or AVD name, owner, enrollment source — never 'borrowed' phones without owner consent. Next: No Stranger Phones.
1. Allowed lab surfaces (named)
Emulator: Pixel API-level AVD with Google APIs or AOSP image — snapshots reset state. Physical lab phone: factory-reset test unit with USB debugging enabled under YOUR control. Vulnerable apps: DVIA, InsecureBankv2-class courseware, MSTG/UnCrackable samples labeled for training.
On $MOB_LAB, list device type, API level, and owner — fictional serials OK if labeled sample.
Command guide
Try these commands — Allowed lab surfaces (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, curl. Reference sites: OWASP MSTG apps (https://mas.owasp.org/MASTG/0x04b-Mobile-App-Authentication/); Android emulator (https://developer.android.com/studio/run/emulator); Portable Continuum (https://github.com/OWASP/MASTG). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why device scope matters before tools
adb, jadx, and Frida are powerful on any connected target — scope is what keeps practice legal and ethical. Production handsets with personal accounts, MDM-enrolled work phones outside IR tickets, and found devices are out of scope.
If you cannot answer 'who owns this phone and who approved testing?', pause and fix scope notes before connecting USB.
3. Device inventory habit
Forbidden: using a friend's daily driver because it 'has Android 14.' Allowed: device card — type, API level, owner, apps installed (lab only), enrollment source.
Ship: device inventory row for one $MOB_LAB target. Next: No Stranger Phones.
4. What you ship: lab device inventory row for $MOB_LAB
Device type, API level, owner, lab apps list. $MOB_LAB named. NEVER unowned hardware. chmod 600.
5. What you record before the next lesson
Date. Device inventory row. $MOB_LAB named. File t27-m01-l02-lab-devices-only.txt chmod 600.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Use roommate phone because emulator is slow. Skip device log because 'it's just adb.'
Right
Write device inventory row for YOUR $MOB_LAB target. Next: No Stranger Phones.
Mission: document YOUR lab device
1) Name emulator or physical lab phone. 2) Record API level and owner. 3) List two intentional vulnerable apps allowed. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Emulator snapshots beat irreversible mistakes on personal hardware.
Knowledge Check
APPLY: Lab devices only on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: DVIA and MSTG samples are acceptable lab app targets when installed on YOUR $MOB_LAB.
True or False
Knowledge Check
APPLY: Before connecting adb you should:
Multiple choice