Pentesting Android Apps

Set up Aikido Pentest to test a native or hybrid Android app.

Aikido Pentest can assess native and hybrid Android apps through whitebox testing. Blackbox Android pentests aren't supported yet, so you must connect the repository that contains your Android app source code.

You can watch the walkthrough below, or follow the step-by-step guide further down.

Run your assessment against a test environment that closely mirrors production. Don't use production data or accounts.

Whitebox only: Aikido currently runs Android pentests against your app source code, not the APK alone. Attach your Android app repository in the Code & Documentation step before you launch the assessment.

Prerequisites

Before starting, ensure you have:

• Manage Pentests permission
• Sufficient credits in your wallet
• Your Android app source code in a repository you can connect to Aikido (required for whitebox testing)
• A test APK ready to upload (500 MB max, no certificate pinning, root detection, or emulator detection)

Create an Android assessment

1

Select Android

Go to Pentests, open your Project, and click Create Assessment. On the What Are You Pentesting? step, select Android.

2

Define test scope

On the Scope step, if your app has a backend API, add its URL (for example, https://api.application.com) so Aikido can test the endpoints your app uses and ensure proper coverage. Then upload your APK (500 MB max). The app must not use certificate pinning, root detection, or emulator detection. Aikido extracts the package name automatically.

Choose Test entire application or Test specific parts only, depending on how much of the app you want assessed.

3

Add test users

Add test users for each role you want Aikido to test, such as an admin, standard user, or user from another tenant. For username and password authentication, Aikido uses your Android app's package name instead of a login URL.

You can use the login preflight check to verify that Aikido can access the app before you launch the assessment. For detailed guidance, see Setting Up Test Users.

4

Configure access, context, and safety

Configure the remaining steps in the wizard:

• Allowed Domains – Allow domains that the app needs to reach during testing.
• Code & Documentation – Required: Connect the repository that contains your Android app source code. Aikido only supports whitebox Android pentests, so the assessment can't run without your codebase attached. You can also link backend repositories and add documentation for additional context. See Leveraging Code and Documentation.
• Safety Check – Set the request rate and permitted testing hours. See Safety Measures.
• Pricing – Select the assessment profile and review the credit cost. See Pentest Pricing.

5

Review and launch

On the Summary step, confirm the Android App package name and the rest of your configuration, then click Run Assessment.

Review results

Open the assessment to monitor progress and review its Issues tab. Android findings can cover areas such as sensitive data handling, network security, platform interactions, WebView security, client-side authentication, cryptography, and build configuration.

When the assessment is complete, you can download a PDF from the assessment. See Pentest Reports for the available report types.

Need help?

If you're unsure whether your app can be tested or need help setting up access, open the Intercom chat in the bottom right corner. Our team is here to help!