How to Turn an Android Smartphone into a Portable Pentesting Tool

Carrying a laptop to every field trip or Wi-Fi security check in the office isn't always convenient. When you need to quickly peek at a local network or check an access point, a phone works much better. For a long time, Kali NetHunter remained the standard in this niche, but installing it usually turns into a quest involving kernel recompilation and finding the right custom firmware.

Recently I came across the StrykerOSS repository by developer zalexdev. It's a free security auditing toolkit for Android that combines command-line utilities like Nmap, Metasploit, and Nuclei into a single graphical interface.

How StrykerOSS Works Under the Hood

Instead of rewriting well-known utilities for Android, the author took a simple and logical approach. On first launch, the app downloads and deploys an Alpine Linux environment in a chroot at /data/local/stryker/release.

Inside this environment run full-fledged versions of Nmap, Metasploit, Nuclei, Hydra, and SearchSploit.

At the top level sits a regular Android app written in Java. The GUI is built in Material 3 style. When you press a button in the menu (for example, to launch a port scan), Stryker builds the appropriate command and sends it to the chroot via root access. If you need direct console access, the side menu has a built-in terminal emulator that drops the session directly into Alpine Linux.

Breaking Down the Main Features

The developer divided the functionality into several logical modules. Let's see what's available here.

Wireless Networks and Wi-Fi

The Wi-Fi module can scan the air, capture handshakes, perform deauthentication, and attack WPS (including Pixie Dust and PIN code brute-forcing).

Captured handshakes are saved locally. They can be exported to the OnlineHashCrack service or you can try to crack them directly on the phone using Hashcat. There's also a GeoMac module that plots discovered BSSIDs on an OpenStreetMap and exports points in KML or CSV format.

For wireless attacks, the built-in Wi-Fi chip of a smartphone usually won't cut it. The app requires an external USB Wi-Fi adapter with monitor mode support, connected via an OTG cable. The description recommends adapters based on Atheros AR9271 or Realtek RTL88XXAU chips.

USB Attacks and Device Emulation

If your smartphone's kernel supports the configfs subsystem, Stryker turns into a hardware tool for USB device emulation.

• In HID Attacks mode, the phone pretends to be a USB keyboard and executes scripts in DuckyScript language. The app includes a parser with keyboard layout support for 7 languages, including Russian, and ships with a ready-made set of payloads.
• In the USB Arsenal module, you can change the device VID/PID on the fly, emulate a network card (RNDIS/ECM), or mount an image .iso as a regular flash drive.

Network Scanning and Vulnerability Discovery

For working with IP networks, Stryker includes a full-featured Nmap interface with NSE script support and report export.

The web scanner based on Nuclei groups discovered issues by severity level and shows proof of vulnerability for each finding. The RouterScan module helps brute-force credentials on routers, and the built-in Arsenal database lets you create your own scan templates with IP, port, and MAC address parameter substitution.

Something fresh and interesting: the project added a WhisperPair module for working with Bluetooth Low Energy. It checks devices for CVE-2025-36911 vulnerability in the Google Fast Pair protocol and can intercept HFP audio streams.

For fans of total freedom, the app even includes launching an XFCE desktop inside the chroot with output via VNC.

What You Need to Run It

You won't be able to run StrykerOSS on just any phone from a store. The project requires specific permissions and environment:

1. Root access (Magisk or KernelSU will work).
2. About 1 GB of free space in internal storage for unpacking the Alpine chroot and utilities.
3. An external Wi-Fi card for capturing handshakes and attacking wireless networks.
4. USB Gadget support in the kernel for DuckyScript and storage emulation to work.

What's Inside the Source Code

The project is written in Java using the Native Development Kit (NDK) for building C components. SQLite and SharedPreferences are used as databases.

The source structure in folder app/src/main/java/com/zalexdev/stryker/ is split by modules. Each tool has its own directory: nmap, metasploit, nuclei, hid, wpair, and so on. System command calls are unified through the Core.java class and Core.generateSuProcess() method, which eliminates code duplication when working with su.

An interesting point in the build configuration: the project uses targetSdk = 28 (Android 9.0). This was done deliberately to avoid hitting strict restrictions on file system access and background processes that appeared in newer Android versions.

Final Impressions

StrykerOSS doesn't try to position itself as a magic button. It's more like a neat Swiss Army knife that saves you from having to type long console commands on a tiny phone screen.

The project will be useful for security professionals and system administrators who prefer keeping a set of network utilities in a single mobile device. If you already have a phone with root access and a compatible kernel, StrykerOSS will save a ton of time setting up a console environment.