Ethical testing starts with one question: what am I allowed to test?

Start with permission, then a hypothesis

Ethical hacking is a controlled investigation. Define the owner, the exact devices, the time window, the actions allowed and the stop conditions before touching a system. Joining a LAN is not permission to test every device on it.

For this beginner exercise, use your own Android phone, a spare test app and dummy data. The question is: does the feature still work when an optional permission is denied? No malware, remote control or credential collection is needed.

Make the scope explicit in code

This Python 3 example checks a written inventory. It sends no traffic and does not establish legal permission by itself. Replace the fictional inventory only after agreeing the actual scope.

owned_lab = {
    "android-spare": {"owner": "me", "allowed": {"permission-review"}},
    "ubuntu-lab": {"owner": "me", "allowed": {"local-demo"}},
}

def in_scope(device, action):
    record = owned_lab.get(device)
    return record is not None and action in record["allowed"]

print(in_scope("android-spare", "permission-review"))  # True
print(in_scope("visitor-phone", "permission-review"))  # False

Save as scope_demo.py and run python3 scope_demo.py. Expected output: True, then False. An unknown device stays out of scope.

Run the phone experiment

1. Record the Android version, test app and the feature you will try.
2. Open Settings and find that app’s permissions. Menu names vary by device.
3. Deny one optional permission and repeat the feature using dummy data.
4. Record the observed result, restore only access the feature needs, and repeat.

Notification access, accessibility, device administration and VPN access deserve separate reviews. A permission request alone does not prove malicious behaviour. Explain the difference between a normal permission and special access in the recording.

What makes this a useful finding?

Write down the exact feature, permission state and repeatable observation. “The app is spying” is not justified merely because a permission appears. Investigate the app’s purpose and documented behaviour before making claims.

Defence: install supported software from trusted sources, grant the narrowest useful access and remove apps or permissions you no longer need.

Continue learning

The OWASP Mobile Application Security Testing Guide provides a structured testing reference. This introductory exercise is not a complete penetration test, certification or guarantee of employment. Source checked: 22 October 2026.