security-tools-for-android-pentesting.md

🪁 Security Tools For Android Pentesting

Static Analysis Tools

1. APKTool – Decompile/modify APK (smali-level)
2. Jadx / JD-GUI – Convert DEX to readable Java code
3. MobSF – Automated static + dynamic scanner
4. Androguard – Python tool for APK/DEX/smali analysis
5. Bytecode Viewer – Reverse engineering with multiple decompilers
6. ClassyShark – Explore APK classes/methods/manifest
7. QARK – Detects security issues in APKs
8. Enjarify / dex2jar – DEX to Java JAR conversion
9. APKLeaks – Extract secrets, tokens, and URLs

Dynamic Analysis Tools

1. Frida – Hook/modify functions at runtime
2. Objection – Runtime exploitation via Frida (no root required)
3. Xposed / LSPosed – Framework for modifying app behavior
4. Burp Suite – Intercept/modify network traffic
5. Drozer – Android app attack framework
6. Magisk – Systemless root; works with LSPosed modules
7. ADB – Debugging bridge for Android device

Logging Tools

1. Logcat – Default Android logging system (adb logcat)
2. Pidcat – Filtered Logcat output by package
3. MatLog – GUI log reader (useful for non-rooted devices)
4. XLog / Timber – In-app logging libraries used in apps
5. Logd – Android logging daemon behind logcat
6. Syslog – For rooted devices to log everything (system + kernel)

💡 Contribution

Feel free to raise issues or submit PRs to add more Android bug bounty and mobile hacking resources.