1st off, Hi. I'm @jhaddix the newest guy on this blog...
Android App testing requires some diverse skills depending on what you're trying to accomplish. Some app testing is like forensics, there's a ton of server side stuff with web services, and there's also times when you need to show failings in programmatic protections or features which requires reversing, debugging, or patching skills.
To develop these skills you need some practice targets. Here's a list of all known Android security challenges, both app level vulns and crackme-type (RE/patching):
In some cases the write-up and challenge starter info is included, in other cases you might have to Google around as some of these CTF's are old.
** Should you need some help with configuring an Android pentest / Crackme environment, cktricky and CG have already written some pieces on that: http://carnal0wnage.attackresearch.com/search?q=android **
Hacme Bank Android - Foundstone
http://www.mcafee.com/us/downloads/free-tools/hacme-bank-android.aspx
ExploitMe Android - Security Compass
http://securitycompass.github.io/AndroidLabs/
InSecure Bank - Paladion
http://www.paladion.net/downloadapp.html
GoatDroid - OWASP and Nvisium Security
https://github.com/jackMannino/OWASP-GoatDroid-Project
IG Learner - Intrepidus Group
https://play.google.com/store/apps/details?id=com.intrepidusgroup.learner
Evil Planner Bsides Challenge and Mercury vulnerable test app - MWR Labs
https://labs.mwrinfosecurity.com/blog/2013/03/11/bsides-challenge/
https://labs.mwrinfosecurity.com/blog/2013/03/28/announcing-mercury-v2-2/
MoshZuk.apk
Description - http://imthezuk.blogspot.com/2011/07/creating-vulnerable-android-application.html
File - https://dl.dropboxusercontent.com/u/37776965/Work/MoshZuk.apk
Crackme.de’s and deurus's Android Crackmes 1-4 ++
http://crackmes.de/users/deurus/android_crackme01/
http://crackmes.de/users/deurus/android_crackme02/
http://crackmes.de/users/deurus/android_crackme03/
http://crackmes.de/users/deurus/android_crackme04/
http://crackmes.de/users/pnluck/android_signme/
Hackplayers.com Crackmes (in Spanish so an extra challenge)
http://www.hackplayers.com/2010/12/reto-android-crackme1.html
http://www.hackplayers.com/2011/12/reto-14-android-crackme2.html
Nuit du Hack's 2k12 & 2k11 (pre-quals and finals) Android Crackme’s
http://blog.w3challs.com/index.php?post/2012/07/02/NDH2k12-wargame-CrackMe-Android
http://blog.spiderboy.fr/tag/crackme/
Hack.Lu's CTF 2011 Reverse Engineering 300
http://shell-storm.org/repo/CTF/Hacklu-2011/Reversing/Space%20Station%200xB321054A%20(300)/
Androidcracking.blogspot.com's Crackme’s
http://androidcracking.blogspot.com/2012/01/way-of-android-cracker-0-rewrite.html
http://androidcracking.blogspot.com/2010/10/way-of-android-cracker-1.html
BlueBox Android Challenge
http://bluebox.com/labs/android-security-challenge/
InsomniDroid
Description - http://www.strazzere.com/blog/2012/03/488/
Partial Walkthrough - http://www.fortiguard.com/files/insomnichallenge.pdf
(File) http://www.strazzere.com/crackmes/insomnidroid.apk
CSAW2011 CTF Android Challenges
Android 1 file - http://shell-storm.org/repo/CTF/CSAW-2011/Forensics/Android1%20-%20200%20Points/CSAW2011CTF.apk
Android 2 file - http://shell-storm.org/repo/CTF/CSAW-2011/Forensics/Android2%20-%20400%20Points/CSAW2011CTF.apk
Defcon 19 Quals b300 dex challenge
http://shell-storm.org/repo/CTF/Defcon-19-quals/Binary_L33tness/b300/b300_b258110ad2d6100c4b8
GreHack 2012 CTF Reverse Engineering 100
http://repo.shell-storm.org/CTF/GreHack-2012/reverse_engineering/100-GrehAndroidMe.apk/
Nullcon HackIM CTF 2012 RE 300
http://www.nullcon.net/challenge/data/Null%20Mobile.apk
C0C0N CTF 2011 RE level 100
http://www.nullcon.net/challenge/c0c0n/data/cocon_apk.zip
Atast CTF 2012 Bin 300
http://andromedactf.wordpress.com/2013/01/02/atast-ctf-2012-bin300chall5/
SecuInside 2011 CTF Level 7 (level 3 is also android but i am unable to find the bin)
Witeup - http://codeengn.com/archive/Reverse%20Engineering/Solution%20-%20CTF/2011%20SECUINSIDE%20CTF%20Write-up%20%5BCMU%5D.pdf
File - http://big-daddy.fr/repository/CTF2011/SecuInside-CTF/Q7/WonderfulWidget.apk
Happy hacking! Don't hesitate to leave a comment on any other Android challenges you find =)
