mario roberto fortunato
Android Engineer turned Offensive Security Practitioner, with 4+ years of experience building production mobile applications and a growing specialization in mobile penetration testing and malware analysis. Deep familiarity with Android internals, Kotlin/Java codebases, and mobile architecture patterns supports more thorough and developer-aware security assessments. Active contribution to the Open Source community, releasing tools that helps the activity of analysis of Android applications.
Certifications
- CAPT (Certified Associate Penetration Tester) - Hackviser (2026)
- PMPA (Practical Mobile Pentest Associate) - TCM Security (2026)
- Android Development Nanodegree - Udacity (2022)
Skills
- General: Linux (Ubuntu/Kali), Bash scripting, VirtualBox/KVM, network enumeration, CVE research
- Penetration Testing & Mobile Security: Burp Suite, JADX, Frida, Objection, apktool, ADB, split APK analysis
- Android Development: Kotlin, Jetpack Compose, Coroutines, Flow, Dependency Injection, Retrofit, Room, MVVM, MVI, Clean Architecture
Contact
- Email: dev[at]mariorobertofortunato.com
- LinkedIn: linkedin.com/in/mariorobertofortunato
- GitHub: github.com/mariorobertofortunato
Projects
Reverse Obfuscated Standard Android Libraries - ROSAL
Wrote an Open Source tool in Python, useful during static analysis for mapping obfuscated classes contained in Android apps APKs. A deterministic approach matches the classes that survive obfuscation based on their parameters, creating a 1:1 map between the APK classes and those implemented in plain text within the libraries declared as dependencies. link
The “MAL/PEN Lab”
Designed and implemented a segmented home lab network infrastructure across macOS and Ubuntu/Kali VM for isolated Android malware analysis and penetration testing activities. The architecture combines fail-closed containment with selective routing, host/guest firewalling and authenticated proxy-based ADB exposure, ensuring no unauthorized network path exists even if individual components fail. link
The Android Pentesting Playbook
Curated a comprehensive playbook as a guide for modern day Android penetration testing activities, from reconnaissance to reporting, through static, dynamic, and network analysis of application packages. Conceived as a single-source repository of the most up-to-date knowledge currently available on penetration testing modern Android applications.
Horizon Pattern
Designed a custom architectural pattern to extend traditional MVI approaches, enabling cleaner separation between UI and business logic in Jetpack Compose applications. link