Mobile › Module 10 › Lesson 4
Lab — Capstone
Execute capstone on $MOB_LAB — checklist, lab path, evidence pack sealed; zero unauthorized scope.
Visual · t27_capstone_lab
Capstone: checklist × $MOB_LAB literacy evidence. Original Cyberlium.
Opening
Close the mobile security literacy loop — MASVS verified, report shipped, RoE signed — without stranger phone exploits.
Walk Topic 27 checklist on YOUR $MOB_LAB: verify RoE, lab path current, MASVS and report labs complete, MDM pack if brief assigned, iOS rows if applicable, evidence pack indexed, scan for stranger device refs and bypass cookbooks (must be zero). Update index with capstone UTC completion. Integrity paragraph: responsible mobile assessment discipline key insight from YOUR path. No unauthorized app testing, no covert MDM, no fabricated findings. Optional mentor review — three clarity questions. Revert emulator snapshot after if brief requires.
1. Execute checklist
Check each row; link artifact or N/A; confirm zero refused techniques in any file.
Scan sealed pack for bypass recipes and unauthorized target paths — remove before handoff.
Command guide
Try these commands — Execute checklist
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Mobile security capstone — https://mas.owasp.org/MASVS/ OWASP MASTG — https://mas.owasp.org/MASTG/ Apple Platform Security — https://support.apple.com/guide/security/welcome/web Android security — https://developer.android.com/privacy-and-security/security-tips
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows:
Command — copy this
choco install openssl
Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export MOB_LAB=${MOB_LAB:-$HOME/cyberlium-lab/t27-mob}
grep NEVER "$MOB_LAB/notes/no-stranger-phones.txt"
grep 'HARD BAN' "$MOB_LAB/notes/no-bypass-cookbook.txt"
unzip -l "$MOB_LAB/apk/demo.apk" 2>/dev/null | head -5
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject 2>/dev/null | head -1
python3 - <<'PY'
import os
lab = os.environ.get('MOB_LAB', os.path.expanduser('~/cyberlium-lab/t27-mob'))
path = os.path.join(lab, 'report', 'capstone-summary.txt')
open(path, 'w').write('
'.join([
'Mobile Security Literacy Capstone',
'scope: YOUR $HOME/cyberlium-lab/t27-mob/ + lab emulator only',
'static: demo.apk manifest review + jadx docs literacy',
'dynamic: adb devices + frida-ps on emulator — no bypass scripts',
'network: openssl s_client + pinning literacy — no objection/unpin',
'report: finding-draft + MASVS remediation + evidence index',
'never: stranger phones / store piracy resign / production bypass',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'scope|never|bypass' "$MOB_LAB/report/capstone-summary.txt" chmod 600 "$MOB_LAB/report/"*.txt "$MOB_LAB/report/"*.md 2>/dev/null || true
═══ WINDOWS ═══
Capstone on YOUR lab Windows VM only
Command — copy this
Get-Content $HOME/cyberlium-lab/t27-mob/notes/no-stranger-phones.txt | Select-String NEVER Get-Content $HOME/cyberlium-lab/t27-mob/report/capstone-summary.txt | Select-String never adb devices -l
Primary tools to practice this lesson: grep, openssl, python3. Reference sites: Mobile security capstone (https://mas.owasp.org/MASVS/); OWASP MASTG (https://mas.owasp.org/MASTG/); Apple Platform Security (https://support.apple.com/guide/security/welcome/web); Android security (https://developer.android.com/privacy-and-security/security-tips). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Integrity paragraph
RoE + MASVS evidence discipline key → professional handoff idea from YOUR lab path.
Name what breaks if you skip scope or fabricate — ethics tie-in.
3. Shutdown
Notes secured chmod 600; index signed complete UTC.
Ready for Topic 28 Advanced Cryptography on separate authorized track.
4. What you ship: capstone evidence pack complete
Checked checklist + sealed literacy pack + integrity paragraph + zero refused scan.
5. What you record before the next lesson
Capstone pack path. $MOB_LAB quiet.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Capstone includes unauthorized banking app bypass as bonus exhibit.
Right
Capstone complete on $MOB_LAB with full teardown. Next: topic quiz.
Mission: Topic 27 capstone
1) Walk checklist with evidence links. 2) Integrity paragraph from your path. 3) Seal pack — zero refused files. 4) Sign index UTC complete.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum N/A documentation?”
Knowledge Check
APPLY: Capstone target:
Multiple choice
Knowledge Check
APPLY: True or False: Pinning bypass on unauthorized app earns capstone credit.
True or False
Knowledge Check
APPLY: Capstone teardown includes:
Multiple choice