AndroHunter

src/mobile-pentesting/android-app-pentesting/README.md

@@ -64,6 +64,23 @@ java -jar uber-apk-signer.jar -a merged.apk --allowResign -o merged_signed
 - Endpoints: `http://<device-ip>:8080/` (UI), `http://<device-ip>:8080/api/json` (API listing), `http://<device-ip>:8080/api/swagger` (Swagger).
 - Emulator port-forward to reach UI/API from the host: `adb forward tcp:8080 tcp:8080` then browse `http://localhost:8080`.
 
+
+## On-device Android pentest toolchains (AndroHunter)
+
+- Android on-device toolkit focused on **exported component abuse**, **ContentProvider exposure/SQLi**, **FileProvider path misconfigurations**, **SSL pinning bypass**, and **runtime instrumentation**. Designed to work **without root** for most features.
+- Static mapping: **Manifest** parsing (exported components, deep links, permissions) and **DEX string scanning** for hardcoded secrets to pivot into dynamic tests.
+- Dynamic modules: **Intent/Activity/Broadcast fuzzers**, **ContentProvider SQLi probes**, **FileProvider path analysis + traversal tester** (real reads via ContentResolver), and a **shared preferences reader** (`run-as` when debuggable, `dumpsys` fallback).
+- Runtime helpers: **Frida script generator** (SSL pinning, root checks, crypto/SQL/HTTP monitoring) and a multi‑method SSL pinning bypass guide.
+- Built‑in HTTP proxy on `127.0.0.1:8877` with request capture and **curl** replay generation.
+
+Examples of generated reproduction commands:
+
+```bash
+adb shell am start -n com.target/.ExportedActivity --es data "payload"
+adb shell content read --uri "content://com.target.provider/path"
+frida -U -f com.target.app -l script.js --no-pause
+```
+
 ## Android Enterprise & Work Profile Attacks
 
 {{#ref}}
@@ -900,5 +917,6 @@ AndroL4b is an Android security virtual machine based on ubuntu-mate includes th
 - [Build a Repeatable Android Bug Bounty Lab: Emulator vs Magisk, Burp, Frida, and Medusa](https://www.yeswehack.com/learn-bug-bounty/android-lab-mobile-hacking-tools)
 - [CoRPhone — Android in-memory JNI execution and packaging pipeline](https://github.com/0xdevil/corphone)
 - [Jezail rooted Android pentesting toolkit (REST API + Flutter UI)](https://github.com/zahidaz/jezail)
+- [AndroHunter](https://github.com/ynsmroztas/AndroHunter)
 
 {{#include ../../banners/hacktricks-training.md}}