Skip to navigation
Features

Android app pentesting

Upload an Android APK to the attack surface, launch a pentest against that build, and review results as application tests.

iOS IPA files can still be uploaded and kept with the application. They are not launched as automated pentests.

Add an Android app

  1. Open Attack surface and choose Add mobile app.
  2. Select the APK. A linked domain or repository is optional context, not a requirement.
  3. After processing, the console shows the detected platform, version, native ABIs, and whether the build can be tested.

Compatible APKs offer Launch Android pentest. You can also open the application and launch from there, or upload a new version of the same app.

APKs that only include arm64 native libraries cannot be tested yet.

Launch

From the application, or from Pentests → Launch pentest, select Android APK applications and continue through the wizard.

  • A workspace that only has Android apps can launch without a linked domain.
  • One pentest is either web applications or Android APKs, not both.
  • Custom Test does not include Android APKs.
  • Billing is credits for the application run. There is no per-endpoint timeout or web rate-limit step.

Scheduled pentests can target the same Android scope. iOS applications stay manual.

During the run

Each Android target is an application test for the pinned APK (package, version, and ABI). Pause, resume, and restart apply to that application test. Agent logs remain on the test detail page.

Reports

An Android-only pentest report lists Applications tested and names those apps. It does not claim hosts or HTTP endpoints were in scope. Web pentest reports are unchanged.

Current limits

  • Arm64-only APKs are not launched.
  • Custom Test does not support Android APKs.
  • Web and Android applications cannot share a pentest.
  • iOS IPA uploads are retained only; they are not launched automatically.