/android-pentest

Android Mobile Application Penetration Testing

Thin router for full MASTG-aligned Android assessments via ADB + Frida + Mobile MCP. Load workflow / methodology / reference files on demand; do not attempt to memorise the whole skill up front.

When to Use

• Start a new Android app security assessment
• Bypass SSL pinning, root detection, anti-tamper, or biometric checks
• Extract/triage local storage (SharedPreferences, DBs, files, logs)
• Test exported activities, services, providers, receivers, deep links
• Hook crypto / auth / session / keystore at runtime
• Map a build to OWASP MASVS / MASTG for compliance evidence
• Produce structured findings + remediation guidance

Trigger Phrases

"pentest this Android app" • "security test the APK" • "bypass SSL pinning on <app>" • "extract data from <app>" • "test Android authentication" • "fuzz Android intents" • "MASTG testing for <app>" • "mobile app security assessment"

When NOT to Use This Skill

• iOS apps → use ios-pentest (if available) or generic mobile skill
• Server-side API fuzzing of mobile backends → use api-security / web-pentest
• Decompiling Android malware for IR → use malware-analysis, not this pentest-focused skill
• Supply-chain / SCA on third-party SDKs → use sca / dependency-audit
• Cloud backend of the mobile app → use cloud-pentest

Decision Tree

Do you have the APK or only package name?
├─ package only → get_app_info + pull_apk (parallel), then branch on protections
└─ APK on disk  → static analysis first (jadx, apktool), then dynamic
                 └─ App runs? → frida_spawn → bypass_ssl → bypass_root → proxy
                 └─ App crashes on root? → see references/troubleshooting.md (Root detection)
                 └─ TLS still not decrypted? → workflows/ssl_pinning_bypass.md Methods 2→3

What's the objective?
├─ Full assessment          → workflows/complete_assessment.md
├─ SSL pinning only         → workflows/ssl_pinning_bypass.md
├─ Auth / session           → workflows/auth_testing.md
├─ Deep links / IPC / fuzz  → workflows/deeplink_intent_testing.md
├─ Crypto audit             → workflows/crypto_analysis.md
└─ Data storage / exfil     → workflows/data_exfiltration.md

Parallelism Hints

Run concurrently (independent, same device):

• get_app_info + pull_apk + list_exported_components
• dump_databases + dump_shared_prefs + dump_internal_storage + dump_external_storage + get_logcat
• Multiple frida_run_script calls against the same PID (crypto_hooks.js ∥ credential_hooks.js ∥ intent_monitor.js)
• Static APK analysis (decompile, secrets scan) ∥ dynamic runtime hooks

Must be sequential:

• frida_spawn → frida_bypass_ssl → frida_bypass_root (scripts need the PID and must attach before the app finishes its protection init)
• setup_proxy before any traffic-capture or network workflow
• install_ca_cert before setup_proxy on a fresh device
• capture_traffic_start → drive app → capture_traffic_stop

Sub-Agent Delegation

• Spawn a static-analysis sub-agent on the pulled APK (jadx decompile → secrets grep → manifest review → native-lib inventory) while the main agent runs dynamic Frida hooks. Rejoin before reporting.
• Spawn a per-component sub-agent when fuzzing many exported components: one agent per activity/provider/service batch; each owns its own Frida PID and logcat filter. Avoids cross-contamination of hook state.
• Spawn a reporting sub-agent to normalise findings into schemas/finding.json and render templates once the main testing pass completes.

Reasoning Budget

• Extended thinking (high): triaging findings across evidence, classifying severity, writing CWE/MASTG mappings, designing custom Frida hooks for obfuscated classes, reverse-engineering native SSL-pinning paths.
• Low / no extended thinking: repetitive Frida hook runs, standard dumps, canned payload fuzzing, applying the universal SSL bypass, invoking known MCP tool sequences.
• Don't burn tokens reasoning about which universal bypass to try first — just run frida_bypass_ssl(pid) and escalate on failure.

Multimodal Hooks

• Use Mobile MCP get_screen_state + screenshot for UI-driven auth flows (biometric prompts, OAuth redirects, MFA steps). Attach screenshots as evidence.screenshot on the finding.
• Capture a screenshot at the point of bypass (e.g., authenticated home screen after biometric spoof) — visual evidence strengthens severity justification.
• For deep-link repros, screenshot the resulting activity to prove the unintended state is reachable.

Structured Output

All findings MUST validate against schemas/finding.json. Android-specific required/common fields: package_name, app_version, target_sdk, device_id, frida_pid, mastg_id, masvs_control, component.{type,class_name,exported}, evidence.{logcat,frida_output,screenshot,pcap}.

Workflow Index

Methodology Index

Payloads Index

Examples Index

References Index

Checklists

Templates

MCP Tool Reference

Device interaction

Frida instrumentation

Network

Data extraction

Components

App management

Frida Script Library (scripts/)

ssl_pinning_bypass.js, root_bypass.js, crypto_hooks.js, credential_hooks.js, network_hooks.js, biometric_bypass.js, anti_tampering_bypass.js, intent_monitor.js, webview_hooks.js, dynamic_dex_hooks.js, keystore_hooks.js, method_tracer.js.

Tools

Setup scripts: setup/setup_pentest_env.sh, setup/setup_physical_device.sh, setup/setup_emulator.py, setup/frida_server_manager.py, setup/burp_cert_installer.sh, setup/check_environment.py.

MCP servers expected: android-pentest (Android Dynamic MCP), mobile-mcp (mobile-next for UI). Configure in ~/.claude/mcp.json.

Related Resources

• OWASP MASTG • OWASP MASVS • Frida docs • Android Security Bulletin

Last Validated

2026-04 — minimum versions: Frida ≥16.4, apktool ≥2.9, jadx ≥1.5, Android platform-tools ≥35.