https://github.com/levz0r/android-pentest-lab
Notes and tooling for turning a stock Xiaomi phone into a portable mobile-security workbench (Magisk + Termux + Kali via proot-distro).
https://github.com/levz0r/android-pentest-lab
android frida kali-linux magisk mitmproxy mobile-security pentesting privacy security termux xiaomi
Last synced: 1 day ago
JSON representation
Notes and tooling for turning a stock Xiaomi phone into a portable mobile-security workbench (Magisk + Termux + Kali via proot-distro).
- Host: GitHub
- URL: https://github.com/levz0r/android-pentest-lab
- Owner: levz0r
- Created: 2026-05-01T10:13:16.000Z (2 months ago)
- Default Branch: main
- Last Pushed: 2026-05-24T17:11:47.000Z (about 1 month ago)
- Last Synced: 2026-06-26T12:27:30.938Z (11 days ago)
- Topics: android, frida, kali-linux, magisk, mitmproxy, mobile-security, pentesting, privacy, security, termux, xiaomi
- Language: Shell
- Size: 112 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# android-pentest-lab
Ethical hacking workbench using a Xiaomi Redmi (codename `dandelion`, model 220233L2G) running Android 11 as the field device. The Mac is the controller; the phone is the portable lab.
## Scope
Authorized targets only: own infrastructure, CTF platforms (HTB, THM, picoCTF, OverTheWire), intentionally vulnerable VMs, and engagements with written authorization. No third-party targeting.
## Device profile
| | |
|---|---|
| Model | Xiaomi 220233L2G (`dandelion`, MTK mt6762/mt6765) |
| Android | 11 (API 30), MIUI V125, patch 2022-07 |
| ABI | armeabi-v7a (32-bit userspace) |
| Kernel | 4.19.127 |
| RAM / /data | 6 GB / 110 GB free |
| Bootloader | unlocked (`flash.locked=0`) |
| Root | none — Magisk feasible later |
| Termux | installed |
Implications: 32-bit userspace rules out some recent Go binaries. MTK Wi-Fi has no usable monitor-mode driver — skip NetHunter Wi-Fi tooling on this device.
## Layout
```
scripts/
adb/ Mac-side scripts that drive the phone over adb
termux/ Bootstrap & install scripts run inside Termux
kali/ proot-distro Kali setup and tool installers
root/ Magisk / boot.img patching helpers (unused until rooted)
configs/ Dotfiles, sshd_config, tmux, etc. pushed to the device
notes/
ctf/ Per-box writeups (HTB, THM, ...)
recon/ Methodology notes
labs/ Self-hosted target setup notes
targets/ Per-engagement scratch dirs (gitignored)
```
## Quickstart
1. Pair & connect over Wi-Fi ADB (already done).
2. `scripts/termux/bootstrap.sh` — run inside Termux to install the base toolset.
3. `scripts/kali/install-kali.sh` — optional, installs Kali via proot-distro.
4. `scripts/adb/connect.sh` — reconnect from the Mac after reboot.
## References
- Termux wiki: https://wiki.termux.com
- proot-distro: https://github.com/termux/proot-distro
- Magisk: https://github.com/topjohnwu/Magisk