> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pensar.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pensar.dev/_mcp/server.

# Android app pentesting

> Upload an Android APK and run an autonomous pentest against the installed application

Upload an Android APK to the attack surface, launch a pentest against that build, and review results as application tests.

> **Info**
>
> iOS IPA files can still be uploaded and kept with the application. They are
> not launched as automated pentests.

## Add an Android app

1. Open **Attack surface** and choose **Add mobile app**.
2. Select the APK. A linked domain or repository is optional context, not a requirement.
3. After processing, the console shows the detected platform, version, native ABIs, and whether the build can be tested.

Compatible APKs offer **Launch Android pentest**. You can also open the application and launch from there, or upload a new version of the same app.

APKs that only include arm64 native libraries cannot be tested yet.

## Launch

From the application, or from **Pentests** → **Launch pentest**, select Android APK applications and continue through the wizard.

* A workspace that only has Android apps can launch without a linked domain.
* One pentest is either web applications or Android APKs, not both.
* Custom Test does not include Android APKs.
* Billing is credits for the application run. There is no per-endpoint timeout or web rate-limit step.

Scheduled pentests can target the same Android scope. iOS applications stay manual.

## During the run

Each Android target is an application test for the pinned APK (package, version, and ABI). Pause, resume, and restart apply to that application test. Agent logs remain on the test detail page.

## Reports

An Android-only pentest report lists **Applications tested** and names those apps. It does not claim hosts or HTTP endpoints were in scope. Web pentest reports are unchanged.

## Current limits

* Arm64-only APKs are not launched.
* Custom Test does not support Android APKs.
* Web and Android applications cannot share a pentest.
* iOS IPA uploads are retained only; they are not launched automatically.