Mobile › Module 1 › Lesson 2
Lab Devices Only
Lab devices only means emulator, YOUR enrolled lab phone, or intentional vulnerable samples — document the device ID in $MOB_LAB notes before any tool run.
Visual · t27_lab_devices_only
Lab device literacy. $MOB_LAB only. Original Cyberlium.
Opening
The device is part of scope — Cyberlium refuses work on hardware you do not own or lack written permission to test.
A lab device is an Android emulator (AVD), physical phone you purchased for class, or org-issued test handset under explicit mobile lab policy. Intentional vulnerable apps — DVIA, MSTG crackmes, OWASP samples, APKs you compiled — live on that device only. Cyberlium maps allowed devices on YOUR $MOB_LAB inventory — serial or AVD name, owner, enrollment source — never 'borrowed' phones without owner consent. Next: No Stranger Phones.
1. Allowed lab surfaces (named)
Emulator: Pixel API-level AVD with Google APIs or AOSP image — snapshots reset state. Physical lab phone: factory-reset test unit with USB debugging enabled under YOUR control. Vulnerable apps: DVIA, InsecureBankv2-class courseware, MSTG/UnCrackable samples labeled for training.
On $MOB_LAB, list device type, API level, and owner — fictional serials OK if labeled sample.
Command guide
Try these commands — Allowed lab surfaces (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP MSTG apps — https://mas.owasp.org/MASTG/0x04b-Mobile-App-Authentication/ (intentional lab apps literacy) Android emulator — https://developer.android.com/studio/run/emulator (YOUR lab device setup) Portable Continuum — https://github.com/OWASP/MASTG (MASTG repo literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t27-mob/notes" "$HOME/cyberlium-lab/t27-mob/apk" "$HOME/cyberlium-lab/t27-mob/report" "$HOME/cyberlium-lab/t27-mob/evidence"
cat > "$HOME/cyberlium-lab/t27-mob/lab.env" <<'EOF'
export MOB_LAB=$HOME/cyberlium-lab/t27-mob
export MOB_LAB_APK=$HOME/cyberlium-lab/t27-mob/apk
export MOB_LAB_DEVICE=${MOB_LAB_DEVICE:-emulator-5554}
EOFCommand — copy this
chmod 600 "$HOME/cyberlium-lab/t27-mob/lab.env" grep -E 'MOB_LAB|MOB_LAB_DEVICE' "$HOME/cyberlium-lab/t27-mob/lab.env" curl -sS https://developer.android.com/studio/run/emulator | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: OWASP MSTG apps (https://mas.owasp.org/MASTG/0x04b-Mobile-App-Authentication/); Android emulator (https://developer.android.com/studio/run/emulator); Portable Continuum (https://github.com/OWASP/MASTG). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why device scope matters before tools
adb, jadx, and Frida are powerful on any connected target — scope is what keeps practice legal and ethical. Production handsets with personal accounts, MDM-enrolled work phones outside IR tickets, and found devices are out of scope.
If you cannot answer 'who owns this phone and who approved testing?', pause and fix scope notes before connecting USB.
3. Device inventory habit
Forbidden: using a friend's daily driver because it 'has Android 14.' Allowed: device card — type, API level, owner, apps installed (lab only), enrollment source.
Ship: device inventory row for one $MOB_LAB target. Next: No Stranger Phones.
4. What you ship: lab device inventory row for $MOB_LAB
Device type, API level, owner, lab apps list. $MOB_LAB named. NEVER unowned hardware. chmod 600.
5. What you record before the next lesson
Date. Device inventory row. $MOB_LAB named. File t27-m01-l02-lab-devices-only.txt chmod 600.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Use roommate phone because emulator is slow. Skip device log because 'it's just adb.'
Right
Write device inventory row for YOUR $MOB_LAB target. Next: No Stranger Phones.
Mission: document YOUR lab device
1) Name emulator or physical lab phone. 2) Record API level and owner. 3) List two intentional vulnerable apps allowed. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Emulator snapshots beat irreversible mistakes on personal hardware.
Knowledge Check
APPLY: Lab devices only on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: DVIA and MSTG samples are acceptable lab app targets when installed on YOUR $MOB_LAB.
True or False
Knowledge Check
APPLY: Before connecting adb you should:
Multiple choice