# Android Pentest

> Comprehensive Android mobile application penetration testing with rooted-device ADB and Frida-based MCP tooling. Covers OWASP MASTG full methodology: recon, static + dynamic analysis, SSL/root bypass, IPC fuzzing, data exfiltration, crypto audit, and reporting. Triggers on requests to pentest Android apps, analyze APKs, bypass mobile security controls, or run MASVS/MASTG assessments.

- Skill: `hardw00t/android-pentest` (Agent Skill, multi-file: 86 files)
- Install (CLI): `npx skillmds@latest add hardw00t/android-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/hardw00t/android-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: hardw00t (https://skillmd.com/u/hardw00t)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/hardw00t/android-pentest

---


# Android Mobile Application Penetration Testing

Thin router for full MASTG-aligned Android assessments via ADB + Frida + Mobile MCP. Load workflow / methodology / reference files on demand; do not attempt to memorise the whole skill up front.

## When to Use
- Start a new Android app security assessment
- Bypass SSL pinning, root detection, anti-tamper, or biometric checks
- Extract/triage local storage (SharedPreferences, DBs, files, logs)
- Test exported activities, services, providers, receivers, deep links
- Hook crypto / auth / session / keystore at runtime
- Map a build to OWASP MASVS / MASTG for compliance evidence
- Produce structured findings + remediation guidance

## Trigger Phrases
"pentest this Android app" • "security test the APK" • "bypass SSL pinning on <app>" • "extract data from <app>" • "test Android authentication" • "fuzz Android intents" • "MASTG testing for <app>" • "mobile app security assessment"

## When NOT to Use This Skill
- iOS apps → use `ios-pentest` (if available) or generic mobile skill
- Server-side API fuzzing of mobile backends → use `api-security` / `web-pentest`
- Decompiling Android malware for IR → use `malware-analysis`, not this pentest-focused skill
- Supply-chain / SCA on third-party SDKs → use `sca` / `dependency-audit`
- Cloud backend of the mobile app → use `cloud-pentest`

## Decision Tree
```
Do you have the APK or only package name?
├─ package only → get_app_info + pull_apk (parallel), then branch on protections
└─ APK on disk  → static analysis first (jadx, apktool), then dynamic
                 └─ App runs? → frida_spawn → bypass_ssl → bypass_root → proxy
                 └─ App crashes on root? → see references/troubleshooting.md (Root detection)
                 └─ TLS still not decrypted? → workflows/ssl_pinning_bypass.md Methods 2→3

What's the objective?
├─ Full assessment          → workflows/complete_assessment.md
├─ SSL pinning only         → workflows/ssl_pinning_bypass.md
├─ Auth / session           → workflows/auth_testing.md
├─ Deep links / IPC / fuzz  → workflows/deeplink_intent_testing.md
├─ Crypto audit             → workflows/crypto_analysis.md
└─ Data storage / exfil     → workflows/data_exfiltration.md
```

## Parallelism Hints
Run concurrently (independent, same device):
- `get_app_info` + `pull_apk` + `list_exported_components`
- `dump_databases` + `dump_shared_prefs` + `dump_internal_storage` + `dump_external_storage` + `get_logcat`
- Multiple `frida_run_script` calls against the same PID (crypto_hooks.js ∥ credential_hooks.js ∥ intent_monitor.js)
- Static APK analysis (decompile, secrets scan) ∥ dynamic runtime hooks

Must be sequential:
- `frida_spawn` → `frida_bypass_ssl` → `frida_bypass_root` (scripts need the PID and must attach before the app finishes its protection init)
- `setup_proxy` before any traffic-capture or network workflow
- `install_ca_cert` before `setup_proxy` on a fresh device
- `capture_traffic_start` → drive app → `capture_traffic_stop`

## Sub-Agent Delegation
- Spawn a **static-analysis sub-agent** on the pulled APK (jadx decompile → secrets grep → manifest review → native-lib inventory) while the main agent runs dynamic Frida hooks. Rejoin before reporting.
- Spawn a **per-component sub-agent** when fuzzing many exported components: one agent per activity/provider/service batch; each owns its own Frida PID and logcat filter. Avoids cross-contamination of hook state.
- Spawn a **reporting sub-agent** to normalise findings into `schemas/finding.json` and render templates once the main testing pass completes.

## Reasoning Budget
- **Extended thinking (high)**: triaging findings across evidence, classifying severity, writing CWE/MASTG mappings, designing custom Frida hooks for obfuscated classes, reverse-engineering native SSL-pinning paths.
- **Low / no extended thinking**: repetitive Frida hook runs, standard dumps, canned payload fuzzing, applying the universal SSL bypass, invoking known MCP tool sequences.
- Don't burn tokens reasoning about which universal bypass to try first — just run `frida_bypass_ssl(pid)` and escalate on failure.

## Multimodal Hooks
- Use Mobile MCP `get_screen_state` + screenshot for UI-driven auth flows (biometric prompts, OAuth redirects, MFA steps). Attach screenshots as `evidence.screenshot` on the finding.
- Capture a screenshot at the point of bypass (e.g., authenticated home screen after biometric spoof) — visual evidence strengthens severity justification.
- For deep-link repros, screenshot the resulting activity to prove the unintended state is reachable.

## Structured Output
All findings MUST validate against [`schemas/finding.json`](schemas/finding.json). Android-specific required/common fields:
`package_name`, `app_version`, `target_sdk`, `device_id`, `frida_pid`, `mastg_id`, `masvs_control`, `component.{type,class_name,exported}`, `evidence.{logcat,frida_output,screenshot,pcap}`.

## Workflow Index
| Workflow | When |
|----------|------|
| [workflows/complete_assessment.md](workflows/complete_assessment.md) | End-to-end MASTG pass |
| [workflows/ssl_pinning_bypass.md](workflows/ssl_pinning_bypass.md) | Enable TLS interception |
| [workflows/auth_testing.md](workflows/auth_testing.md) | Login, session, biometric, JWT |
| [workflows/deeplink_intent_testing.md](workflows/deeplink_intent_testing.md) | IPC fuzz, deep links, providers |
| [workflows/crypto_analysis.md](workflows/crypto_analysis.md) | Weak algos, hardcoded keys, keystore |
| [workflows/data_exfiltration.md](workflows/data_exfiltration.md) | Local storage + logcat leakage |

## Methodology Index
| Document | Coverage |
|----------|----------|
| [methodology/recon.md](methodology/recon.md) | Info gathering, attack-surface map |
| [methodology/static_analysis.md](methodology/static_analysis.md) | APK/smali/secrets review |
| [methodology/dynamic_analysis.md](methodology/dynamic_analysis.md) | Runtime hooking, instrumentation |
| [methodology/network_testing.md](methodology/network_testing.md) | Traffic, API, TLS verification |
| [methodology/data_storage.md](methodology/data_storage.md) | Local storage, DBs, file perms |
| [methodology/crypto_testing.md](methodology/crypto_testing.md) | Encryption and key management |
| [methodology/auth_testing.md](methodology/auth_testing.md) | Auth, session, biometric |
| [methodology/client_side_injection.md](methodology/client_side_injection.md) | WebViews, deep links, providers |

## Payloads Index
| File | Use |
|------|-----|
| [payloads/intent_injection.txt](payloads/intent_injection.txt) | Intent/IPC fuzz inputs |
| [payloads/path_traversal.txt](payloads/path_traversal.txt) | File/provider path escapes |
| [payloads/sql_injection.txt](payloads/sql_injection.txt) | Content provider SQLi |
| [payloads/xss_payloads.txt](payloads/xss_payloads.txt) | WebView XSS |
| [payloads/xxe_payloads.txt](payloads/xxe_payloads.txt) | XML parsers in-app |

## Examples Index
| Example | Scenario |
|---------|----------|
| [examples/new_assessment.md](examples/new_assessment.md) | Kickoff blueprint for a new target |
| [examples/data_storage_investigation.md](examples/data_storage_investigation.md) | Enumerating local sensitive data |
| [examples/auth_bypass.md](examples/auth_bypass.md) | Biometric / session / JWT bypass |

## References Index
| Document | Coverage |
|----------|----------|
| [references/owasp_mobile_top10.md](references/owasp_mobile_top10.md) | OWASP Mobile Top 10 mapping |
| [references/android_security_checklist.md](references/android_security_checklist.md) | Testing checklist |
| [references/frida_snippets.md](references/frida_snippets.md) | Reusable Frida one-liners |
| [references/troubleshooting.md](references/troubleshooting.md) | Frida / SSL / root / ADB / SQLCipher fixes |
| [references/bounty_patterns_2024_2026.md](references/bounty_patterns_2024_2026.md) | Post-2023 bounty TTPs (deep-link hijack / App-Links bypass, WebView deep-link XSS, unprotected broadcast-receiver leakage) |

## Checklists
| File | Purpose |
|------|---------|
| [checklists/owasp_mastg_full.md](checklists/owasp_mastg_full.md) | Full MASTG compliance |
| [checklists/quick_wins.md](checklists/quick_wins.md) | Fast-vuln sweep |
| [checklists/pre_engagement.md](checklists/pre_engagement.md) | Setup verification |
| [checklists/report_items.md](checklists/report_items.md) | Report completeness |

## Templates
| Template | Purpose |
|----------|---------|
| [templates/finding_template.md](templates/finding_template.md) | Per-finding doc |
| [templates/executive_summary.md](templates/executive_summary.md) | Management summary |
| [templates/technical_report.md](templates/technical_report.md) | Full technical report |
| [templates/remediation_guide.md](templates/remediation_guide.md) | Developer-facing fixes |

## MCP Tool Reference

### Device interaction
| Tool | Purpose |
|------|---------|
| `get_screen_state()` | Current screen / UI tree |
| `tap_element(x,y)` / `long_press(x,y)` | Tap / long-press |
| `input_text(text)` | Type into focused field |
| `press_key(keycode)` | BACK=4 HOME=3 ENTER=66 |
| `swipe(x1,y1,x2,y2)` | Scroll, pattern unlock |

### Frida instrumentation
| Tool | Purpose |
|------|---------|
| `frida_spawn(pkg)` / `frida_attach(pkg)` | Start or attach |
| `frida_run_script(pid, script)` | Load JS hooks |
| `frida_bypass_ssl(pid)` / `frida_bypass_root(pid)` | Universal bypasses |
| `frida_hook_method(pid, class, method)` | Trace a single method |
| `frida_trace_crypto(pid)` / `frida_dump_credentials(pid)` | Canned traces |
| `frida_enumerate_classes(pid, pattern)` | Class discovery under obfuscation |
| `frida_memory_search(pid, pattern)` | Find secrets / keys in process memory |

### Network
| Tool | Purpose |
|------|---------|
| `setup_proxy(device, host, port)` / `clear_proxy(device)` | Proxy wiring |
| `install_ca_cert(device, path)` | Trust Burp CA (system store) |
| `capture_traffic_start(pkg)` / `capture_traffic_stop()` | PCAP |

### Data extraction
| Tool | Purpose |
|------|---------|
| `dump_databases(pkg)` / `dump_shared_prefs(pkg)` | SQLite + prefs |
| `dump_internal_storage(pkg)` / `dump_external_storage(pkg)` | Files |
| `get_logcat(pkg)` | Package-filtered logs |

### Components
| Tool | Purpose |
|------|---------|
| `list_exported_components(pkg)` | Attack surface |
| `launch_activity(pkg, activity, extras, data_uri)` | Deep link / intent |
| `send_broadcast(action, extras)` | Broadcast injection |
| `start_service(pkg, service, extras)` | Service abuse |
| `query_content_provider(uri)` | Provider SQLi / leakage |
| `fuzz_intent_extra(pkg, comp, key, payloads)` | Automated fuzz |

### App management
| Tool | Purpose |
|------|---------|
| `install_apk(path)` / `uninstall_app(pkg)` | Deploy / remove |
| `clear_app_data(pkg)` | Fresh state |
| `get_app_info(pkg)` | Metadata, permissions, SDK |
| `list_installed_apps()` / `pull_apk(pkg)` | Discovery / extraction |

## Frida Script Library (`scripts/`)
`ssl_pinning_bypass.js`, `root_bypass.js`, `crypto_hooks.js`, `credential_hooks.js`, `network_hooks.js`, `biometric_bypass.js`, `anti_tampering_bypass.js`, `intent_monitor.js`, `webview_hooks.js`, `dynamic_dex_hooks.js`, `keystore_hooks.js`, `method_tracer.js`.

## Tools
| Tool | Purpose | Install |
|------|---------|---------|
| ADB | Device comms | `apt install adb` (Android SDK platform-tools) |
| Frida / frida-tools | Dynamic instrumentation | `pip install frida-tools` (≥16.4) |
| Objection | Mobile exploration | `pip install objection` |
| apktool | APK decompile | `apt install apktool` (≥2.9) |
| jadx | Java decompile | github.com/skylot/jadx releases (≥1.5) |
| Burp Suite | Traffic interception | portswigger.net |
| Android Studio | Emulator, SDK | developer.android.com |

Setup scripts: `setup/setup_pentest_env.sh`, `setup/setup_physical_device.sh`, `setup/setup_emulator.py`, `setup/frida_server_manager.py`, `setup/burp_cert_installer.sh`, `setup/check_environment.py`.

MCP servers expected: `android-pentest` (Android Dynamic MCP), `mobile-mcp` (mobile-next for UI). Configure in `~/.claude/mcp.json`.

## Related Resources
- [OWASP MASTG](https://mas.owasp.org/MASTG/) • [OWASP MASVS](https://mas.owasp.org/MASVS/) • [Frida docs](https://frida.re/docs/) • [Android Security Bulletin](https://source.android.com/security/bulletin)

## Last Validated
2026-04 — minimum versions: Frida ≥16.4, apktool ≥2.9, jadx ≥1.5, Android platform-tools ≥35.