Most Important Tool for Pentesters & Security Professionals in Android Penetration Testing

Android Penetration

Security monitoring by Android security companies is more commonly used to check Android vulnerabilities. Here you can find the comprehensive tools and resource list for Android Penetration Testing in Android Mobiles. You can find them here.

Online Analyzers

  1. NowSecure Lab Automated – a mobile app security testing enterprise tool that tests both Android and iOS mobile apps. Lab Automated delivers dynamic and static analysis on real cloud devices to produce results in minutes. Not free
  2. AppCritique – Upload and receive full free security assessments your Android APKs
  3. Visual Threat
  4. Mobile Malware Sandbox
  5. Appknox – not free
  6. AndroTotal
  7. IBM Security AppScan Mobile Analyzer – not free
  8. NVISO ApkScan
  9. AVC UnDroid
  10. habo 10/day
  11. Virustotal-max 128MB
  12. Fraunhofer App-ray – not free

Static Analysis Tools

  1. CFGScanDroid–CFG scans and compares malicious applications against CFG.
  2. Madrolyzer-extracts operating data such as C&C, telephone number etc.
  3. SPARTA–Checks (proves) that the app complies with a security information flow policy based on the Checker Framework.
  4. ConDroid–Conducts a symbolic + concrete application execution combination.
  5. DroidRA.
  6. RiskInDroid–A tool that allows Android apps to calculate their risk using an online demo.
  7. SUPER–Android analyzer stable, unified, powerful and extensible rust.
  8. ClassyShark–Standalone binary inspection tool to browse and display important information about every Android executable.

Android Security App Vulnerability Scanners

  1. QARK–LinkedIn’s QARK is an application developer that checks security issues.
  2. AndroBugs.
  3. Nogotofail.
  4. Devknox–Fixed Android Security issues like your IDE’s spell check.
  5. JAADAS–Intra-procedural and inter-procedural tool for analyzing vulnerabilities in Android Soot and Scala-based applications.

Dynamic Analysis Tools

  1. Android DBI framework.
  2. Androl4b–A virtual computer for Android, Reverse Engineering and Analysis applications.
  3. Android Malware Analysis Toolkit –(Linux distro) In the past,
  4. Mobile-Security-Framework (MobSF) is a mobile, all-in – one, mobile open source (Android / iOS) automated pen testing system that performs static, dynamic analysis and web testing.
  5. AppUse–custom-built for pentesting
  6. Cobradroid –customized image for malware analysis
  7. Droidbox Drozer Xposed–equivalent to injecting Stub based code with API hooks, start unexported activities, and more, without any modifications to the binary inspection, Android Package Inspector. (Xposed Module)
  8. Android Hooker–Dynamic Java code instruments (needs a Substrate System)
  9. ProbeDroid–Dynamic Java application instrumentation
  10. Android Tamer–Virtual / Live Android Security Professional Platform
  11. DECAF–QEMU based Executable Coding Framework (DroidScope is now a DECAF extension)
  12. Android Linux kernel modules
  13. Appie is a pre-configured software package for Android Pentesting Environment. It is fully portable and can be transported on a USB stick or on a smartphone. This is a one-stop response to all the tools needed in Android Application Security Assessments as well as a great alternative to virtual machinery.
  14. StaDynA–a safety application analysis system that supports dynamic code update functions (loading and reflection of dynamic class). This tool combines static and dynamic analysis of Android applications to reveal hidden / updated behavior and to add this information to static analysis results.
  15. Vezir Project–Virtual Machine for Mobile Application Pentesting and Mobile Malware Analysis
  16. MARA- Mobile Application Reverse Engineering and Analysis Framework
  17. Mobile Application Reverse Engineering and Analysis System
  18. Taintdroid- includes AOSP compilation.

Reverse Engineering


  1. IntentSniffer
  2. Introspy
  3. Jad – Java decompiler
  4. JD-GUI – Java decompiler
  5. CFR – Java decompiler
  6. Krakatau – Java decompiler
  7. Procyon – Java decompiler
  8. FernFlower – Java decompiler
  9. Redexer – apk manipulation
  10. Smali viewer
  11. Simplify Android deobfuscator
  12. Bytecode viewer
  13. Radare2
  14. Smali/Baksmali – apk decompilation
  15. emacs syntax coloring for smali files
  16. vim syntax coloring for smali files
  17. AndBug
  18. Androguard – powerful, integrates well with other tools
  19. Apktool – really useful for compilation/decompilation (uses smali)
  20. Android Framework for Exploitation
  21. Bypass signature and permission checks for IPCs
  22. Android OpenDebug – make any application on device debuggable (using cydia substrate).
  23. Dare – .dex to .class converter
  24. Dex2Jar – dex to jar converter
  25. Enjarify – dex to jar converter from Google
  26. Dedexer
  27. Fino
  28. Frida – inject javascript to explore applications and a GUI tool for it
  29. Indroid – thread injection kit

Fuzz Testing


  1. Honggfuzz
  2. An Android port of the melkor ELF fuzzer
  3. Media Fuzzing Framework for Android
  4. AndroFuzz
  5. IntentFuzzer
  6. Radamsa Fuzzer

App Repackaging Detectors

  1. FSquaDRA – a Android Security tool for detection of repackaged Android applications based on app resources hash comparison.

Market Crawlers

  1. Google play crawler (Java)
  2. Google play crawler (Python)
  3. Google play crawler (Node) – get app details and download apps from official Google Play Store.
  4. Aptoide downloader (Node) – download apps from Aptoide third-party Android market
  5. Appland downloader (Node) – download apps from Appland third-party Android market

Misc Tools

  1. adb autocomplete
  2. Dalvik opcodes
  3. Opcodes table for quick reference
  4. ExploitMe Android Labs – for practice
  5. GoatDroid – for practice
  6. mitmproxy
  7. dockerfile/androguard
  8. smalihook
  9. APK-Downloader
  10. AXMLPrinter2 – to convert binary XML files to human-readable XML files
  11. Android Vulnerability Test Suite – android-vts scans a device for set of vulnerabilities
  12. AppMon– AppMon is an automated framework for monitoring and tampering system API calls of native macOS, iOS and android apps. It is based on Frida.

Also Read: fsociety’s Full Hacking Tools Pack the Security Platform for Penetration Testing





Mark Funk
Mark Funk is an experienced information security specialist who works with enterprises to mature and improve their enterprise security programs. Previously, he worked as a security news reporter.