mario roberto fortunato
Android Engineer turned Offensive Security Practitioner, with 4+ years of experience building production mobile applications and a growing specialization in mobile penetration testing and malware analysis. Deep familiarity with Android internals, Kotlin/Java codebases, and mobile architecture patterns supports more thorough and developer-aware security assessments.
Certifications
- CAPT (Certified Associate Penetration Tester) - Hackviser (2026)
- PMPA (Practical Mobile Pentest Associate) - TCM Security (2026)
- Android Development Nanodegree - Udacity (2022)
Skills
- General: Linux (Ubuntu/Kali), Bash scripting, VirtualBox/KVM, network enumeration, CVE research
- Penetration Testing & Tooling: Metasploit, Meterpreter, Burp Suite, Wireshark, Nmap, Netcat, ffuf, Gobuster
- Mobile Security: JADX, Frida, Objection, apktool, ADB, split APK analysis
- Android Development: Kotlin, Jetpack Compose, Coroutines, Flow, Dependency Injection, Retrofit, Room, MVVM, MVI, Clean Architecture
Projects
The “MAL/PEN Lab”
Designed and implemented a segmented home lab network infrastructure across macOS and Ubuntu/Kali VM for isolated Android malware analysis and penetration testing activities. The architecture combines fail-closed containment with selective routing, host/guest firewalling and authenticated proxy-based ADB exposure, ensuring no unauthorized network path exists even if individual components fail. link
The Android Pentesting Playbook
Curated a comprehensive playbook as a guide for modern day Android penetration testing activities, from reconnaissance to reporting, through static, dynamic, and network analysis of application packages. Conceived as a single-source repository of the most up-to-date knowledge currently available on penetration testing modern Android applications.
Physical Key Device Protocol (PKDP)
A session-binding protocol layered on OpenSSH that cryptographically ties the lifetime of an SSH session to the continuous physical presence of a USB device. Designed as a hardware-enforced access control mechanism against unattended session hijacking.
Horizon Pattern
Designed a custom architectural pattern to extend traditional MVI approaches, enabling cleaner separation between UI and business logic in Jetpack Compose applications. link
Contact
- Email: dev[at]mariorobertofortunato.com
- LinkedIn: linkedin.com/in/mariorobertofortunato
- GitHub: github.com/mariorobertofortunato