Android APK Pentester
Purpose
Use this skill for authorized Android application security testing. It supports
static APK/XAPK/APKS analysis, split APK installation, rooted emulator setup,
traffic interception, and Frida hook generation for lab validation.
Load references/android_pentest_patterns.md when you need detailed detection
vectors, certificate injection notes, APK format differences, or native
protection signatures.
Workflow
| Phase |
Script |
Purpose |
| 0 |
scripts/setup_avd.py |
Start/configure an emulator, enable adb root/remount, push frida-server |
| 1 |
scripts/analyze_apk.py |
Extract manifest metadata, permissions, DEX strings, native libs, and protection indicators |
| 2 |
scripts/install_apk.py |
Install APK, XAPK, split APKs, or bundletool APKS archives |
| 3 |
scripts/disguise_emulator.py |
Apply lab emulator property/profile changes and verify common emulator markers |
| 4 |
scripts/setup_intercept.py |
Inject mitmproxy CA into system store and configure device proxy |
| 5 |
scripts/generate_hooks.py |
Generate Frida scripts for SSL pinning tests, crypto logging, and detection validation |
Usage
# Prepare emulator command plan first
python android-apk-pentester/scripts/setup_avd.py --avd Pixel_API_35 --frida-server frida-server --writable-system --dry-run
# Static analysis
python android-apk-pentester/scripts/analyze_apk.py app.apk --out output/apk-analysis
python android-apk-pentester/scripts/analyze_apk.py app.xapk --out output/apk-analysis
python android-apk-pentester/scripts/analyze_apk.py app.apks --out output/apk-analysis
# Install packages
python android-apk-pentester/scripts/install_apk.py app.apk
python android-apk-pentester/scripts/install_apk.py app.xapk
python android-apk-pentester/scripts/install_apk.py app.apks --bundletool bundletool.jar
# Interception and dynamic validation
python android-apk-pentester/scripts/setup_intercept.py --inject-cert --set-proxy
python android-apk-pentester/scripts/generate_hooks.py --target com.example.app --all --out hooks/
Outputs
| File |
Content |
apk_analysis.json |
Manifest metadata, permissions, components, strings, native libs, findings |
hooks/*.js |
Generated Frida scripts for authorized runtime testing |
hooks/hooks_manifest.json |
Hook selection and run commands |
intercept/ |
Optional mitmproxy capture output |
Practical Notes
- Use
setup_avd.py --dry-run before changing an emulator.
- Use
.apks only with bundletool.jar or BUNDLETOOL_JAR.
- Android 7+ apps usually ignore user CAs; use system CA injection in the lab emulator.
- Re-run
disguise_emulator.py after each cold boot because property changes are RAM-only.
- Prefer physical devices for targets that rely on hardware-backed attestation.
Anti-Patterns
| Mistake |
Fix |
| Running emulator setup without preview |
Use setup_avd.py --dry-run first |
| Treating APKS as a ZIP of directly installable APKs |
Use bundletool install-apks via install_apk.py |
| Using only a user-installed CA |
Inject the CA into the system trust store on a test emulator |
| Forgetting split APK order |
Use XAPK extraction or bundletool instead of manual adb install |
| Assuming every detection vector is bypassable |
Hardware attestation and kernel-level checks need a physical device |
1---2name: android-apk-pentester3description: Use when performing authorized Android APK, XAPK, or APKS security testing that needs static analysis, split install handling, rooted emulator setup, mitmproxy interception, Frida hook generation, or emulator/root detection validation.4---56# Android APK Pentester78## Purpose910Use this skill for authorized Android application security testing. It supports11static APK/XAPK/APKS analysis, split APK installation, rooted emulator setup,12traffic interception, and Frida hook generation for lab validation.1314Load `references/android_pentest_patterns.md` when you need detailed detection15vectors, certificate injection notes, APK format differences, or native16protection signatures.1718## Workflow1920| Phase | Script | Purpose |21|---|---|---|22| 0 | `scripts/setup_avd.py` | Start/configure an emulator, enable adb root/remount, push `frida-server` |23| 1 | `scripts/analyze_apk.py` | Extract manifest metadata, permissions, DEX strings, native libs, and protection indicators |24| 2 | `scripts/install_apk.py` | Install APK, XAPK, split APKs, or bundletool APKS archives |25| 3 | `scripts/disguise_emulator.py` | Apply lab emulator property/profile changes and verify common emulator markers |26| 4 | `scripts/setup_intercept.py` | Inject mitmproxy CA into system store and configure device proxy |27| 5 | `scripts/generate_hooks.py` | Generate Frida scripts for SSL pinning tests, crypto logging, and detection validation |2829## Usage3031```bash32# Prepare emulator command plan first33python android-apk-pentester/scripts/setup_avd.py --avd Pixel_API_35 --frida-server frida-server --writable-system --dry-run3435# Static analysis36python android-apk-pentester/scripts/analyze_apk.py app.apk --out output/apk-analysis37python android-apk-pentester/scripts/analyze_apk.py app.xapk --out output/apk-analysis38python android-apk-pentester/scripts/analyze_apk.py app.apks --out output/apk-analysis3940# Install packages41python android-apk-pentester/scripts/install_apk.py app.apk42python android-apk-pentester/scripts/install_apk.py app.xapk43python android-apk-pentester/scripts/install_apk.py app.apks --bundletool bundletool.jar4445# Interception and dynamic validation46python android-apk-pentester/scripts/setup_intercept.py --inject-cert --set-proxy47python android-apk-pentester/scripts/generate_hooks.py --target com.example.app --all --out hooks/48```4950## Outputs5152| File | Content |53|---|---|54| `apk_analysis.json` | Manifest metadata, permissions, components, strings, native libs, findings |55| `hooks/*.js` | Generated Frida scripts for authorized runtime testing |56| `hooks/hooks_manifest.json` | Hook selection and run commands |57| `intercept/` | Optional mitmproxy capture output |5859## Practical Notes6061- Use `setup_avd.py --dry-run` before changing an emulator.62- Use `.apks` only with `bundletool.jar` or `BUNDLETOOL_JAR`.63- Android 7+ apps usually ignore user CAs; use system CA injection in the lab emulator.64- Re-run `disguise_emulator.py` after each cold boot because property changes are RAM-only.65- Prefer physical devices for targets that rely on hardware-backed attestation.6667## Anti-Patterns6869| Mistake | Fix |70|---|---|71| Running emulator setup without preview | Use `setup_avd.py --dry-run` first |72| Treating APKS as a ZIP of directly installable APKs | Use `bundletool install-apks` via `install_apk.py` |73| Using only a user-installed CA | Inject the CA into the system trust store on a test emulator |74| Forgetting split APK order | Use XAPK extraction or bundletool instead of manual `adb install` |75| Assuming every detection vector is bypassable | Hardware attestation and kernel-level checks need a physical device |
ptn1411