> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/pentests/configure-a-pentest/android-pentesting.md).
# Pentesting Android Apps
Aikido Pentest can assess native and hybrid Android apps through **whitebox testing**. You must connect the repository that contains your Android app source code — blackbox Android pentests aren't supported yet. If you don't have access to **Android** on the application type step yet, open the **Intercom chat** in the bottom right corner — our team can enable early access for your workspace.
{% hint style="warning" %}
Run your assessment against a test environment that closely mirrors production. Don't use production data or accounts.
{% endhint %}
{% hint style="info" %}
**Whitebox only** — Aikido currently runs Android pentests against your app source code, not the APK alone. Attach your Android app repository in the **Code & Documentation** step before you launch the assessment.
{% endhint %}
### Prerequisites
Before starting, ensure you have:
* **Manage Pentests** [permission](/getting-started/automated-user-management/setting-roles-and-permissions.md)
* **Sufficient credits** in your [wallet](/miscellaneous-info/wallet-and-credits.md)
* **Your Android app source code** in a repository you can connect to Aikido (required for whitebox testing)
* **A test APK** ready to upload (500 MB max, no certificate pinning, root detection, or emulator detection)
## Create an Android assessment
{% stepper %}
{% step %}
### Select Android
Go to **Pentests**, open your **Project**, and click **Create Assessment**. On the **What Are You Pentesting?** step, select **Android**.
{% endstep %}
{% step %}
### Define test scope
On the **Scope** step, if your app has a backend API, add its URL (for example, `https://api.application.com`) so Aikido can test the endpoints your app uses and ensure proper coverage. Then upload your APK (500 MB max). The app must not use certificate pinning, root detection, or emulator detection. Aikido extracts the package name automatically.
Choose **Test entire application** or **Test specific parts only**, depending on how much of the app you want assessed.
{% endstep %}
{% step %}
### Add test users
Add test users for each role you want Aikido to test, such as an admin, standard user, or user from another tenant. For username and password authentication, Aikido uses your Android app's package name instead of a login URL.
You can use the login preflight check to verify that Aikido can access the app before you launch the assessment. For detailed guidance, see [Setting Up Test Users](/pentests/configure-a-pentest/setting-up-authenticated-testing.md).
{% endstep %}
{% step %}
### Configure access, context, and safety
Configure the remaining steps in the wizard:
* **Allowed Domains** – Allow domains that the app needs to reach during testing.
* **Code & Documentation** – **Required:** Connect the repository that contains your Android app source code. Aikido only supports whitebox Android pentests, so the assessment can't run without your codebase attached. You can also link backend repositories and add documentation for additional context. See [Leveraging Code and Documentation](/pentests/configure-a-pentest/leveraging-code-and-documentation.md).
* **Safety Check** – Set the request rate and permitted testing hours. See [Safety Measures](/pentests/configure-a-pentest/safety-measures.md).
* **Pricing** – Select the assessment profile and review the credit cost. See [Pentest Pricing](/pentests/pentest-pricing.md).
{% endstep %}
{% step %}
### Review and launch
On the **Summary** step, confirm the **Android App** package name and the rest of your configuration, then click **Run Assessment**.
{% endstep %}
{% endstepper %}
## Review results
Open the assessment to monitor progress and review its **Issues** tab. Android findings can cover areas such as sensitive data handling, network security, platform interactions, WebView security, client-side authentication, cryptography, and build configuration.
When the assessment is complete, you can download a PDF from the assessment. See [Pentest Reports](/pentests/coverage-and-findings/pentest-reports.md) for the available report types.
## Need help?
If you're unsure whether your app can be tested or need help setting up access, open the **Intercom chat** in the bottom right corner. Our team is here to help!
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://help.aikido.dev/pentests/configure-a-pentest/android-pentesting.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.