# Pentesting Android Apps

Aikido Pentest assesses native and hybrid Android apps on a **Mobile Application** assessment. Testing is whitebox, so connect the repository that contains the Android app source code.

You can watch the walkthrough below, or follow the step-by-step guide further down.

{% embed url="https://www.youtube.com/watch?v=EGzGZIr2rn4" %}

## Test one app or both

On the **Scope** step, upload the mobile apps this assessment should cover and add the web app or API they call.

| What you include | What Aikido tests |
| --- | --- |
| IPA and the web URL | The iOS app and that web app or API. See [Pentesting iOS Apps](https://help.aikidogov.us/pentests/configure-a-pentest/ios-pentesting). |
| APK and the web URL | The Android app and that web app or API |
| APK, IPA, and the web URL | Both apps and the shared web app or API |

Add the web URL when the app has a backend. Upload both apps when you have Android and iOS, so one assessment tests that shared web app or API once and covers both clients. Separate assessments repeat that work.

A website or API with no mobile app is a **Web Application** assessment. See [How to Setup a Pentest](https://help.aikidogov.us/pentests/configure-a-pentest/starting-an-assessment).

{% hint style="warning" %}
Run the assessment against a test environment that closely mirrors production. Don't use production data or accounts.
{% endhint %}

## Prerequisites

* **Manage Pentests** [permission](https://help.aikidogov.us/getting-started/automated-user-management/setting-roles-and-permissions)
* **Sufficient credits** in your [wallet](https://help.aikidogov.us/miscellaneous-info/wallet-and-credits)
* **Your Android app source code** in a repository you can connect to Aikido
* **A test APK** (500 MB max) with no certificate pinning, root detection, or emulator detection

## Prepare the APK

Upload a test APK of the app you want assessed (500 MB max).

In that test build:

* Turn off certificate pinning.
* Turn off root detection and emulator detection.

## Create an Android assessment

{% stepper %}
{% step %}
### Select Mobile Application

Go to **Pentests**, open your **Project**, and click **Create Assessment**. On the **Select Pentest Target** step, select **Mobile Application**.

<div data-with-frame="true"><figure><img src="https://help.aikidogov.us/_assets/f7b4f1ba7041/Screenshot-2026-07-13-at-18.01.39.png" alt="Select Pentest Target step with Mobile Application available"><figcaption></figcaption></figure></div>
{% endstep %}

{% step %}
### Define test scope

On the **Scope** step, add the web app or API URL (for example, `https://api.application.com`) so Aikido can test those endpoints.

Under **Android Application**, upload the APK (500 MB max). Aikido reads the package name from the file. The APK must not use certificate pinning, root detection, or emulator detection.

Upload the APK on its own for an Android-only run. Upload the IPA on this step as well when the assessment should cover both apps. See [Pentesting iOS Apps](https://help.aikidogov.us/pentests/configure-a-pentest/ios-pentesting).

Choose **Test entire application** or **Test specific parts only**.

<div data-with-frame="true"><figure><img src="https://help.aikidogov.us/_assets/3361c406f7c8/Screenshot-2026-07-13-at-18.02.22.png" alt="Scope step with the Android app upload and application scope"><figcaption></figcaption></figure></div>
{% endstep %}

{% step %}
### Add test users

Add a test user for each role you want Aikido to test, such as an admin, a standard user, or a user from another tenant.

If the assessment includes both apps, set **Platform** to **Android** for the Android user. For username and password authentication, Aikido uses the package name instead of a login URL.

You can run the login preflight check before you launch. See [Setting Up Test Users](https://help.aikidogov.us/pentests/configure-a-pentest/setting-up-authenticated-testing).

<div data-with-frame="true"><figure><img src="https://help.aikidogov.us/_assets/896e40efa166/Screenshot-2026-07-13-at-18.06.13.png" alt="Test users step for a mobile assessment"><figcaption></figcaption></figure></div>
{% endstep %}

{% step %}
### Configure access, context, and safety

Configure the remaining steps in the wizard:

* **Allowed Domains:** Allow domains that the app needs to reach during testing.
* **Code & Documentation:** Connect the repository that contains the Android app source code. Aikido only supports whitebox testing for mobile apps, so the assessment needs that repository. You can also link backend repositories and add documentation. See [Leveraging Code and Documentation](https://help.aikidogov.us/pentests/configure-a-pentest/leveraging-code-and-documentation).
* **Safety Check:** Set the request rate and permitted testing hours. See [Safety Measures](https://help.aikidogov.us/pentests/configure-a-pentest/safety-measures).
* **Pricing:** Select the assessment profile and review the credit cost. See [Pentest Pricing](https://help.aikidogov.us/pentests/pentest-pricing).
{% endstep %}

{% step %}
### Review and launch

On the **Summary** step, confirm the **Android App** package name and the rest of the configuration, then click **Run Assessment**.
{% endstep %}
{% endstepper %}

## Review results

Open the assessment to follow progress and review its **Issues** tab. Android findings can cover sensitive data handling, network security, platform interactions, WebView security, client-side authentication, cryptography, and build configuration.

When the assessment is complete, download a PDF from the assessment. See [Pentest Reports](https://help.aikidogov.us/pentests/coverage-and-findings/pentest-reports).

Before you retest a finding in the app, upload a new APK from the assessment overview. See [Retest Pentest Findings](https://help.aikidogov.us/pentests/coverage-and-findings/retest-pentest-findings).

## Related

{% content-ref url="ios-pentesting.md" %}
[Pentesting iOS Apps](https://help.aikidogov.us/pentests/configure-a-pentest/ios-pentesting)
{% endcontent-ref %}

{% content-ref url="setting-up-authenticated-testing/" %}
[Setting Up Test Users](https://help.aikidogov.us/pentests/configure-a-pentest/setting-up-authenticated-testing)
{% endcontent-ref %}

{% content-ref url="leveraging-code-and-documentation.md" %}
[Leveraging Code and Documentation](https://help.aikidogov.us/pentests/configure-a-pentest/leveraging-code-and-documentation)
{% endcontent-ref %}