mobile-pentest
starsforks
How to install mobile-pentest?
hypnguyen1209/offensive-claude/mobile-pentest
$npx -y skills add hypnguyen1209/offensive-claude --skill mobile-pentestUse when pentesting an Android/iOS app — Frida 17 instrumentation, SSL-pinning & root/jailbreak bypass, Android 14/15 CA injection, exported-component/content-provider abuse, deep-link/WebView chains, biometric bypass, Flutter/React-Native RE
SKILL.md
| 1 | # Mobile Application Penetration Testing |
| 2 | |
| 3 | ## When to Activate |
| 4 | |
| 5 | - Android/iOS application security assessment, bug-bounty mobile triage, or app-store reconnaissance |
| 6 | - Need to intercept TLS traffic (SSL/cert pinning, Android 14/15 Conscrypt-APEX trust store, Flutter/RN stacks) |
| 7 | - Bypass root/jailbreak or biometric-gating controls during dynamic analysis |
| 8 | - Enumerate and exploit exported components, content providers, deep links, and WebViews |
| 9 | - Extract secrets from insecure storage (SharedPrefs, SQLite, Keychain, Keystore) and reverse hybrid apps |
| 10 | |
| 11 | ## Technique Map |
| 12 | |
| 13 | | Technique | ATT&CK | CWE | Reference | Script | |
| 14 | |-----------|--------|-----|-----------|--------| |
| 15 | | Lab build + Frida 17 server/gadget | T1635 | CWE-1188 | references/environment-interception.md | - | |
| 16 | | Android 14/15 Conscrypt-APEX CA injection | T1521.001 | CWE-295 | references/environment-interception.md | scripts/android_ca_inject.sh | |
| 17 | | SSL/cert-pinning bypass (Java TM/OkHttp/native) | T1521.001 | CWE-295 | references/environment-interception.md | scripts/universal_unpin.js | |
| 18 | | Root detection bypass (RootBeer/native stat) | T1633.001 | CWE-693 | references/environment-interception.md | scripts/universal_unpin.js | |
| 19 | | Exported activity/service/receiver abuse | T1626.001 | CWE-926 | references/android-component-attacks.md | scripts/manifest_attack_surface.py | |
| 20 | | Content-provider SQLi / path traversal (CVE-2025-48609) | T1409 | CWE-22, CWE-89 | references/android-component-attacks.md | scripts/component_fuzz.sh | |
| 21 | | Task hijacking / StrandHogg / TapTrap (USENIX '25) | T1517 | CWE-1021 | references/android-component-attacks.md | scripts/manifest_attack_surface.py | |
| 22 | | Deep-link / intent-redirect / scheme hijack | T1635, T1577 | CWE-939 | references/webview-deeplink-exploitation.md | scripts/component_fuzz.sh | |
| 23 | | WebView JS-interface RCE + file:// theft | T1577 | CWE-749 | references/webview-deeplink-exploitation.md | scripts/component_fuzz.sh | |
| 24 | | OAuth custom-scheme callback interception | T1635 | CWE-940 | references/webview-deeplink-exploitation.md | - | |
| 25 | | Insecure storage (SharedPrefs/SQLite/external) | T1409 | CWE-312 | references/insecure-storage-crypto.md | scripts/manifest_attack_surface.py | |
| 26 | | Keystore/Keychain misuse + dumping | T1634 | CWE-522 | references/insecure-storage-crypto.md | scripts/ios_bypass_suite.js | |
| 27 | | Biometric bypass (BiometricPrompt/LAContext) | T1634 | CWE-287 | references/insecure-storage-crypto.md | scripts/ios_bypass_suite.js | |
| 28 | | iOS jailbreak + JB-detection bypass | T1635 | CWE-693 | references/ios-offensive.md | scripts/ios_bypass_suite.js | |
| 29 | | IPA decrypt / class-dump / URL-scheme abuse | T1409, T1635 | CWE-200 | references/ios-offensive.md | scripts/ios_bypass_suite.js | |
| 30 | | Flutter RE / reFlutter pinning bypass | T1521.001 | CWE-295 | references/crossplatform-re-instrumentation.md | scripts/hermes_triage.py | |
| 31 | | React Native Hermes bytecode decompile | T1640 | CWE-656 | references/crossplatform-re-instrumentation.md | scripts/hermes_triage.py | |
| 32 | |
| 33 | ## Quick Start |
| 34 | |
| 35 | ```bash |
| 36 | # ---- ANDROID ---- |
| 37 | # 0. Pull + statically triage the APK (manifest, secrets, exported surface, framework ID) |
| 38 | adb shell pm path com.target.app # locate split APKs |
| 39 | adb pull /data/app/.../base.apk . |
| 40 | python3 scripts/manifest_attack_surface.py base.apk -o surface.json |
| 41 | jadx -d src base.apk & apktool d base.apk -o decoded |
| 42 | |
| 43 | # 1. Frida 17: match server to host tools; push + run |
| 44 | frida --version # e.g. 17.x -> use matc |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
