Security and privacy are very important on android devices to prevent crimes such as the theft of data and confidential information for users. There are many attack methods that can be carried out by irresponsible parties, one of which is penetration testing. The need to improve the security of android devices from cyber crimes that can occur at any time so that the security and information belonging to users are more secure. Based on this, this study offers how attackers perform penetration testing on targets using android devices using the OWASP Mobile framework based on the steps in the Security Testing Guide (OWASP MSTG) manual. The penetration testing activity is carried out in five steps. Namely, injection of backdoors on the application, finding vulnerabilities, scanning, exploiting and making reports. The results of this study obtained some information on application IOCs and other information in the form of contact data, SMS data, and audio records belonging to the attacked device. Based on this, this research can be used by security parties to patch loopholes in their applications and systems.