- use CVEs
- Breaking OEM
- unlock bootloader(this aprroach usually do not work for samsung devices because of Knox. However, this approche works for older samsung devices. Better to use the phones which have orginal android like Sony.)
- Use misconfiguratin
** Note: In some scenarios, non rooting devices can be used for pentesting.