Android Mobile Application Penetration Testing

Thin router for full MASTG-aligned Android assessments via ADB + Frida + Mobile MCP. Load workflow / methodology / reference files on demand; do not attempt to memorise the whole skill up front.

When to Use

• Start a new Android app security assessment
• Bypass SSL pinning, root detection, anti-tamper, or biometric checks
• Extract/triage local storage (SharedPreferences, DBs, files, logs)
• Test exported activities, services, providers, receivers, deep links
• Hook crypto / auth / session / keystore at runtime
• Map a build to OWASP MASVS / MASTG for compliance evidence
• Produce structured findings + remediation guidance

Trigger Phrases

"pentest this Android app" • "security test the APK" • "bypass SSL pinning on <app>" • "extract data from <app>" • "test Android authentication" • "fuzz Android intents" • "MASTG testing for <app>" • "mobile app security assessment"

When NOT to Use This Skill

• iOS apps → use ios-pentest (if available) or generic mobile skill
• Server-side API fuzzing of mobile backends → use api-security / web-pentest
• Decompiling Android malware for IR → use malware-analysis, not this pentest-focused skill
• Supply-chain / SCA on third-party SDKs → use sca / dependency-audit
• Cloud backend of the mobile app → use cloud-pentest

Decision Tree

Do you have the APK or only package name?
├─ package only → get_app_info + pull_apk (parallel), then branch on protections
└─ APK on disk  → static analysis first (jadx, apktool), then dynamic
                 └─ App runs? → frida_spawn → bypass_ssl → bypass_root → proxy
                 └─ App crashes on root? → see references/troubleshooting.md (Root detection)
                 └─ TLS still not decrypted? → workflows/ssl_pinning_bypass.md Methods 2→3

What's the objective?
├─ Full assessment          → workflows/complete_assessment.md
├─ SSL pinning only         → workflows/ssl_pinning_bypass.md
├─ Auth / session           → workflows/auth_testing.md
├─ Deep links / IPC / fuzz  → workflows/deeplink_intent_testing.md
├─ Crypto audit             → workflows/crypto_analysis.md
└─ Data storage / exfil     → workflows/data_exfiltration.md

Parallelism Hints

Run concurrently (independent, same device):

• getappinfo + pullapk + listexported_components
• dumpdatabases + dumpsharedprefs + dumpinternalstorage + dumpexternalstorage + getlogcat
• Multiple fridarunscript calls against the same PID (cryptohooks.js ∥ credentialhooks.js ∥ intent_monitor.js)
• Static APK analysis (decompile, secrets scan) ∥ dynamic runtime hooks

Must be sequential:

• fridaspawn → fridabypassssl → fridabypass_root (scripts need the PID and must attach before the app finishes its protection init)
• setup_proxy before any traffic-capture or network workflow
• installcacert before setup_proxy on a fresh device
• capturetrafficstart → drive app → capturetrafficstop

Sub-Agent Delegation

• Spawn a static-analysis sub-agent on the pulled APK (jadx decompile → secrets grep → manifest review → native-lib inventory) while the main agent runs dynamic Frida hooks. Rejoin before reporting.
• Spawn a per-component sub-agent when fuzzing many exported components: one agent per activity/provider/service batch; each owns its own Frida PID and logcat filter. Avoids cross-contamination of hook state.
• Spawn a reporting sub-agent to normalise findings into schemas/finding.json and render templates once the main testing pass completes.

Reasoning Budget

• Extended thinking (high): triaging findings across evidence, classifying severity, writing CWE/MASTG mappings, designing custom Frida hooks for obfuscated classes, reverse-engineering native SSL-pinning paths.
• Low / no extended thinking: repetitive Frida hook runs, standard dumps, canned payload fuzzing, applying the universal SSL bypass, invoking known MCP tool sequences.
• Don't burn tokens reasoning about which universal bypass to try first — just run fridabypassssl(pid) and escalate on failure.

Multimodal Hooks

• Use Mobile MCP getscreenstate + screenshot for UI-driven auth flows (biometric prompts, OAuth redirects, MFA steps). Attach screenshots as evidence.screenshot on the finding.
• Capture a screenshot at the point of bypass (e.g., authenticated home screen after biometric spoof) — visual evidence strengthens severity justification.
• For deep-link repros, screenshot the resulting activity to prove the unintended state is reachable.

Structured Output

All findings MUST validate against [schemas/finding.json](schemas/finding.json). Android-specific required/common fields: packagename, appversion, targetsdk, deviceid, fridapid, mastgid, masvscontrol, component.{type,classname,exported}, evidence.{logcat,frida_output,screenshot,pcap}.

Workflow Index

Methodology Index

Payloads Index

Examples Index

References Index

Checklists

Templates

MCP Tool Reference

Device interaction

Frida instrumentation

Network

Data extraction

Components

App management

Frida Script Library (scripts/)

sslpinningbypass.js, rootbypass.js, cryptohooks.js, credentialhooks.js, networkhooks.js, biometricbypass.js, antitamperingbypass.js, intentmonitor.js, webviewhooks.js, dynamicdexhooks.js, keystorehooks.js, method_tracer.js.

Tools

Setup scripts: setup/setuppentestenv.sh, setup/setupphysicaldevice.sh, setup/setupemulator.py, setup/fridaservermanager.py, setup/burpcertinstaller.sh, setup/checkenvironment.py.

MCP servers expected: android-pentest (Android Dynamic MCP), mobile-mcp (mobile-next for UI). Configure in ~/.claude/mcp.json.

Related Resources

• OWASP MASTG • OWASP MASVS • Frida docs • Android Security Bulletin

Last Validated

2026-04 — minimum versions: Frida ≥16.4, apktool ≥2.9, jadx ≥1.5, Android platform-tools ≥35.