1. Basic APK Extraction
For Android pentesting, I first pull the APK from the mobile device after installing it:
adb shell pm list packages | grep <package_name>
adb shell pm path <package_name>
adb pull <copied_path>2. Handling Split APKs
If I notice fewer features or functions are missed in the decompiled APK, or if the APK does not install correctly, it might be a split APK.
In that case, I use APK Editor to merge the split APKs.
3. Dumping dex
After extraction, I inspect classes and resources before continuing deeper analysis.