Pocket Me Rocket

This ad-hoc talk at c0c0n 2012 demonstrates how Android devices can be leveraged as portable penetration testing platforms, turning smartphones into tools for basic security assessment operations in the field.

Key Topics Covered

Core Concept:

• Android smartphones can serve as lightweight, portable penetration testing platforms
• The talk title “Pocket Me Rocket” references the power of having a pentesting toolkit in your pocket
• Presented as an impromptu session exploring practical mobile-based security testing

Using Android for Pentesting:

• Android’s Linux-based architecture provides a familiar environment for security tools
• Available scripting environments (SL4A, Python for Android) enable custom tool development
• Network tools available on Android can perform reconnaissance and basic assessment tasks
• The portability of a phone-based toolkit enables ad-hoc testing in physical security assessments

Practical Applications:

• Network discovery and reconnaissance from a mobile device
• Basic vulnerability scanning using mobile-optimized tools
• Wireless network assessment leveraging the phone’s built-in WiFi capabilities
• Quick security checks during physical penetration tests

Actionable Takeaways

1. Android devices provide a surprisingly capable platform for basic penetration testing
2. The portability factor enables security assessments in scenarios where laptops are impractical
3. Combined with scripting frameworks, Android becomes a flexible testing tool
4. Mobile pentesting supplements rather than replaces traditional laptop-based testing