How to test an APK without the source code

You do not need the source code to test an Android app for security. The shipped APK is the same file an attacker downloads, and it contains everything they would work from: the code, the manifest, the resources and the bundled libraries. This guide shows how to test from the build alone. Only test apps you are authorised to test.

Why testing without source is realistic

An attacker never has your source code, only your shipped app. Testing the APK matches that reality. It also catches things source review misses: third-party SDKs, merged manifests, obfuscated classes and native code that never appears in your repository. That is where a lot of real exposure lives.

What you need

• The APK or AAB your pipeline produces.
• A decompiler such as the open-source jadx for readable code, and apktool for resources and the manifest.
• A test device or emulator for the dynamic part, ideally one you can instrument.

The steps

• Unpack and read the package. An APK is a zip. Decompile it and read the manifest, resources and code.
• Run a static pass. Look for hardcoded secrets, exposed configuration, exported components, weak crypto and cleartext settings. This is static analysis.
• Run it on a device. Watch the traffic, on-device storage and whether defences such as certificate checks hold. This is dynamic analysis, often with tools like Frida and a MITM proxy.
• Inventory the libraries. Build a software bill of materials and check the bundled SDKs against known vulnerabilities.

Doing it at scale

Done by hand, this is slow and easy to do unevenly across releases. Automating the static, dynamic and supply-chain passes on every build is how teams get consistent coverage and a finding trail they can act on. Mobexa runs the full chain on the exact APK or AAB you ship and maps each finding to the OWASP MASVS control behind it.

For the bigger picture, read what is mobile application security.

Common questions