Turning an Android Phone into a Linux Device for Physical Penetration Tests

Summary

The video demonstrates turning a rooted Android phone into a discreet Linux device for physical pentests, then using Tailscale and a proxy-agent tunnel to maintain remote access and route scans into the phone’s local network.

Key points

• The presenter frames the phone as a discreet alternative to a Raspberry Pi for physical penetration tests, describing leaving it powered and connected to Wi-Fi in a target office.
• The setup uses a rooted Android phone and a Linux filesystem with a graphical desktop; the presenter says root access is needed for capabilities such as raw-packet operations and Wi-Fi scanning.
• The presenter recommends using an old, unused phone and inspecting the open-source setup code before running it.
• Tailscale connects the phone and the operator’s Kali system; SSH is used to access the phone, and a proxy-agent tunnel routes traffic through it.
• The demonstration scans a router with Nmap. The presenter also describes possible internal-network service discovery, Active Directory and credential attacks, and man-in-the-middle activity.
• The presenter says the tunnel can let the operator reach systems on the same network as the phone; the video presents this as a pentesting setup, not a report of a real intrusion.