android-pentest

Android Mobile Application Penetration Testing

Thin router for full MASTG-aligned Android assessments via ADB + Frida + Mobile MCP. Load workflow / methodology / reference files on demand; do not attempt to memorise the whole skill up front.

When to Use

• Start a new Android app security assessment
• Bypass SSL pinning, root detection, anti-tamper, or biometric checks
• Extract/triage local storage (SharedPreferences, DBs, files, logs)
• Test exported activities, services, providers, receivers, deep links
• Hook crypto / auth / session / keystore at runtime
• Map a build to OWASP MASVS / MASTG for compliance evidence
• Produce structured findings + remediation guidance

Trigger Phrases

"pentest this Android app" • "security test the APK" • "bypass SSL pinning on " • "extract data from " • "test Android authentication" • "fuzz Android intents" • "MASTG testing for " • "mobile app security assessment"

When NOT to Use This Skill

• iOS apps → use ios-pentest (if available) or generic mobile skill
• Server-side API fuzzing of mobile backends → use api-security / web-pentest
• Decompiling Android malware for IR → use malware-analysis, not this pentest-focused skill
• Supply-chain / SCA on third-party SDKs → use sca / dependency-audit
• Cloud backend of the mobile app → use cloud-pentest

Decision Tree

Do you have the APK or only package name?
├─ package only → get_app_info + pull_apk (parallel), then branch on protections
└─ APK on disk  → static analysis first (jadx, apktool), then dynamic
                 └─ App runs? → frida_spawn → bypass_ssl → bypass_root → proxy
                 └─ App crashes on root? → see references/troubleshooting.md (Root detection)
                 └─ TLS still not decrypted? → workflows/ssl_pinning_bypass.md Methods 2→3

What's the objective?
├─ Full assessment          → workflows/complete_assessment.md
├─ SSL pinning only         → workflows/ssl_pinning_bypass.md
├─ Auth / session           → workflows/auth_testing.md
├─ Deep links / IPC / fuzz  → workflows/deeplink_intent_testing.md
├─ Crypto audit             → workflows/crypto_analysis.md
└─ Data storage / exfil     → workflows/data_exfiltration.md