/android-pentest

Workflow: Complete Application Assessment

End-to-end MASTG-aligned pass. Run phases 1-2 sequentially; within each phase, batch independent calls in parallel.

Phase 1 — Reconnaissance (parallel)

get_app_info("com.target.app")
pull_apk("com.target.app")
list_exported_components("com.target.app")

Phase 2 — Bypass protections (sequential after spawn)

pid = frida_spawn("com.target.app")
frida_bypass_ssl(pid)
frida_bypass_root(pid)
setup_proxy(device_id, "192.168.1.100", 8080)

Phase 3 — Dynamic hooks (parallel scripts on same pid)

frida_run_script(pid, "crypto_hooks.js")
frida_run_script(pid, "credential_hooks.js")
frida_run_script(pid, "intent_monitor.js")

Phase 4 — Data extraction (parallel)

dump_databases("com.target.app")
dump_shared_prefs("com.target.app")
dump_internal_storage("com.target.app")
dump_external_storage("com.target.app")
get_logcat("com.target.app")

Phase 5 — Component testing

launch_activity("com.target.app", ".DeepLinkActivity",
                extras={"url": "javascript:alert(1)"})
query_content_provider("content://com.target.app.provider/users")
fuzz_intent_extra("com.target.app", ".ProcessActivity",
                  "data", ["../../../etc/passwd", "' OR '1'='1"])

Phase 6 — Network capture

capture_traffic_start("com.target.app")
# drive app through auth, transactions, profile edits
capture_traffic_stop()

Sub-agent delegation

While Phase 3/4 are running, spawn a sub-agent to run static analysis on the APK pulled in Phase 1 (jadx/apktool, secrets scan, manifest review). Rejoin findings before reporting.

References

• methodology/recon.md, methodology/dynamic_analysis.md, methodology/data_storage.md
• checklists/owasp_mastg_full.md