RAGBAZandroid compromise
assessment field course
A hands-on unit for forensic and red-team students: investigate a phone you own for rootkits, RATs, stalkerware, and backdoors — then acquire the artifacts that prove it, below the OS where malware can no longer lie to you.
Every technique here is for devices you own or are explicitly authorized to examine. The toolchain is read-only: it never writes, flashes, unlocks, or roots a device. Acquisition assumes access you already hold on your own lab hardware. Handle all evidence as case material.
what this is
The course answers one operational question about a phone you own: is there a rootkit, RAT, stalkerware, or backdoor on this device, and how would I know? It is deliberately defensive and evidence-first — students never attack a third party. They collect, reason, and report, the way real incident response works.
The reframe that drives everything: this is DFIR, not penetration testing. The question is never "can I break in," it is "what would persistence look like, and where does it hide." Five labs walk that question from a clean baseline to a blind capstone assessment.
the five labs
toolchain
Three read-only collectors, all authorized-use gated. Download from any lab page or here.
| tool | role | runs on |
|---|---|---|
| apts.sh | Triage collector — walks the six persistence surfaces, raises FLAG lines, hashes evidence. | bash + adb |
| apts_tui.py | Curses TUI — keyboard-driven triage plus boot-chain imaging and known-good comparison. | python3 + adb |
| acquire_artifacts.sh | Live acquisition — logs, dumpsys, packages/APKs, network, app-private data. | bash + adb (+root) |
the professional standard
These collectors are a teaching scaffold — they make the persistence surfaces visible and explicable. For real casework, pair them with MVT (Mobile Verification Toolkit) from Amnesty International's Security Lab, which matches iOS backups and Android acquisitions against curated IOC feeds, including mercenary spyware such as Pegasus. Have students install MVT from the official repository and check its current docs, since the IOC methodology evolves.
One caveat carries the whole unit: a kernel-level rootkit can lie to ADB. A clean triage output does not equal a clean device. That is why the course ends below the OS — imaging the boot chain and comparing to known-good.
← ragbaz product
The same containment-first philosophy powers DetCordon — disposable, network-isolated sandboxes for watching hostile web payloads without exposing the operator surface. Structured IOC extraction, not just video. open product →