Fabio Giubilo
Android Mobile Apps Reverse Engineer
Fabio Giubilo is a security consultant at BT specialising in web and mobile application security, with a strong focus on Android testing and reverse engineering. His work spans practical mobile penetration testing, static and dynamic analysis, and building tooling — and hands-on training challenges — that make assessments more efficient, structured, and evidence-driven. He has a particular interest in Android internals, Frida-based instrumentation, and AI-assisted engineering workflows that turn tester experience into practical offensive-security tools.
From UnCrackable to Uncrackable: Rebuilding the Android Crackme for 2026
The OWASP MAS Crackmes are how a lot of us learned mobile RE, but they were built for an older Android. Modern apps fight back with RASP, R8 obfuscation, native certificate pinning, instrumentation detection and encrypted storage, and our training targets haven't kept up. So I rebuilt the idea for 2026: a suite of three apps, each forcing a single discipline (static, then dynamic, then network) by closing off the shortcuts. It mirrors a real engagement and maps onto the MASVS Resilience category.
By the end you'll be able to:
- read and beat layered tamper, root and instrumentation detection
- tell which hardening actually slows an attacker, and which is just theatre
- bypass both managed and native certificate pinning to intercept live traffic
- design crackmes and internal CTFs that force real skill rather than pattern matching