# Android Apk Pentester

> Use when performing authorized Android APK, XAPK, or APKS security testing that needs static analysis, split install handling, rooted emulator setup, mitmproxy interception, Frida hook generation, or emulator/root detection validation.

- Skill: `ptn1411/android-apk-pentester` (Agent Skill, multi-file: 10 files)
- Install (CLI): `npx skillmds@latest add ptn1411/android-apk-pentester`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ptn1411/android-apk-pentester/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: ptn1411 (https://skillmd.com/u/ptn1411)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ptn1411/android-apk-pentester

---


# Android APK Pentester

## Purpose

Use this skill for authorized Android application security testing. It supports
static APK/XAPK/APKS analysis, split APK installation, rooted emulator setup,
traffic interception, and Frida hook generation for lab validation.

Load `references/android_pentest_patterns.md` when you need detailed detection
vectors, certificate injection notes, APK format differences, or native
protection signatures.

## Workflow

| Phase | Script | Purpose |
|---|---|---|
| 0 | `scripts/setup_avd.py` | Start/configure an emulator, enable adb root/remount, push `frida-server` |
| 1 | `scripts/analyze_apk.py` | Extract manifest metadata, permissions, DEX strings, native libs, and protection indicators |
| 2 | `scripts/install_apk.py` | Install APK, XAPK, split APKs, or bundletool APKS archives |
| 3 | `scripts/disguise_emulator.py` | Apply lab emulator property/profile changes and verify common emulator markers |
| 4 | `scripts/setup_intercept.py` | Inject mitmproxy CA into system store and configure device proxy |
| 5 | `scripts/generate_hooks.py` | Generate Frida scripts for SSL pinning tests, crypto logging, and detection validation |

## Usage

```bash
# Prepare emulator command plan first
python android-apk-pentester/scripts/setup_avd.py --avd Pixel_API_35 --frida-server frida-server --writable-system --dry-run

# Static analysis
python android-apk-pentester/scripts/analyze_apk.py app.apk --out output/apk-analysis
python android-apk-pentester/scripts/analyze_apk.py app.xapk --out output/apk-analysis
python android-apk-pentester/scripts/analyze_apk.py app.apks --out output/apk-analysis

# Install packages
python android-apk-pentester/scripts/install_apk.py app.apk
python android-apk-pentester/scripts/install_apk.py app.xapk
python android-apk-pentester/scripts/install_apk.py app.apks --bundletool bundletool.jar

# Interception and dynamic validation
python android-apk-pentester/scripts/setup_intercept.py --inject-cert --set-proxy
python android-apk-pentester/scripts/generate_hooks.py --target com.example.app --all --out hooks/
```

## Outputs

| File | Content |
|---|---|
| `apk_analysis.json` | Manifest metadata, permissions, components, strings, native libs, findings |
| `hooks/*.js` | Generated Frida scripts for authorized runtime testing |
| `hooks/hooks_manifest.json` | Hook selection and run commands |
| `intercept/` | Optional mitmproxy capture output |

## Practical Notes

- Use `setup_avd.py --dry-run` before changing an emulator.
- Use `.apks` only with `bundletool.jar` or `BUNDLETOOL_JAR`.
- Android 7+ apps usually ignore user CAs; use system CA injection in the lab emulator.
- Re-run `disguise_emulator.py` after each cold boot because property changes are RAM-only.
- Prefer physical devices for targets that rely on hardware-backed attestation.

## Anti-Patterns

| Mistake | Fix |
|---|---|
| Running emulator setup without preview | Use `setup_avd.py --dry-run` first |
| Treating APKS as a ZIP of directly installable APKs | Use `bundletool install-apks` via `install_apk.py` |
| Using only a user-installed CA | Inject the CA into the system trust store on a test emulator |
| Forgetting split APK order | Use XAPK extraction or bundletool instead of manual `adb install` |
| Assuming every detection vector is bypassable | Hardware attestation and kernel-level checks need a physical device |