offensive-mobile

Name: offensive-mobile
Author: SnailSploit

37installs447forks

How to install offensive-mobile?

snailsploit/claude-red/offensive-mobile

$npx -y skills add SnailSploit/Claude-Red --skill offensive-mobile

Installs into the current project.

Summary

Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-

Files · 1

View on GitHub

SKILL.md

1	# Mobile (Android + iOS) — Offensive Testing Methodology
2
3	## Quick Workflow
4
5	1. Static: pull the IPA/APK, decompile, dump resources/strings, identify endpoints
6	2. Dynamic: install on rooted/jailbroken device, hook with Frida, intercept TLS
7	3. Map exported attack surface: deep links, URL schemes, exported components
8	4. Storage / Keystore audit: where do secrets live, what protects them
9	5. API: every backend the app talks to is your scope — test like a web app
10
11	---
12
13	## Lab Setup
14
15	### Android
16	- Rooted device or Genymotion / Android Studio AVD with `userdebug` build
17	- Magisk for systemless root; LSPosed for hooks; Frida server matching device arch
18	- Burp / Mitmproxy with system-trusted CA via Magisk module (`MagiskTrustUserCerts`)
19
20	### iOS
21	- Jailbroken device (palera1n / checkra1n / Dopamine depending on iOS version)
22	- Frida + Objection + Filza + SSH via USB (iproxy 2222 22)
23	- Burp CA installed via Settings → General → Device Management → Certificate Trust Settings
24
25	---
26
27	## Static Analysis
28
29	### Android
30
31	```bash
32	# Decode resources + smali
33	apktool d app.apk -o app
34
35	# Decompile to Java
36	jadx -d app_src app.apk
37
38	# Manifest review
39	xmllint --format app/AndroidManifest.xml \| less
40	# Look for: android:exported="true", intent-filters, custom permissions, debuggable, allowBackup, networkSecurityConfig
41	```
42
43	```bash
44	# Secrets and endpoints
45	grep -rE '(https?://[a-z0-9.-]+\|api[_-]?key\|secret\|token\|firebase\|amazonaws\|appspot)' app_src/
46	grep -r "Log\.[dwief]" app_src/ # leftover debug logs
47
48	# Native libs
49	file app/lib//.so
50	# RE in Ghidra/IDA; look for JNI_OnLoad and exported Java_* functions
51	```
52
53	### iOS
54
55	```bash
56	# Pull IPA from device
57	frida-ios-dump -o app.ipa "com.vendor.app"
58
59	# Or via App Store via 3rd-party tools (Apple Configurator with paid acct, etc.)
60	unzip app.ipa
61	# Decrypt if needed (jailbroken device): bagbak / clutch
62	bagbak com.vendor.app
63
64	# Class dump
65	class-dump-dyld -H Payload/App.app/App -o headers/
66	# Or for Swift symbols, use Hopper / IDA
67
68	# Strings / endpoints
69	strings -a Payload/App.app/App \| grep -E '(https?://\|key\|secret\|api)'
70	```
71
72	```bash
73	# Info.plist analysis
74	plutil -p Payload/App.app/Info.plist
75	# Look for: NSAppTransportSecurity exceptions, CFBundleURLTypes (URL schemes),
76	# associated-domains entitlements, UIFileSharingEnabled, ATS exemptions
77	```
78
79	---
80
81	## Dynamic Analysis & Frida
82
83	### Common Hooks
84
85	```javascript
86	// Bypass SSL pinning (Android — generic OkHttp/CertificatePinner/TrustManager)
87	Java.perform(() => {
88	const X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
89	const TrustManagerFactory = Java.use('javax.net.ssl.TrustManagerFactory');
90	// ... full bypass scripts: codeshare.frida.re/@pcipolloni/universal-android-ssl-pinning-bypass-with-frida
91	});
92
93	// Bypass root detection
94	Java.perform(() => {
95	const File = Java.use('java.io.File');
96	File.exists.implementation = function () {
97	const path = this.getAbsolutePath();
98	if (path.includes('su') \|\| path.includes('Magisk')) return false;
99	return this.exists();
100	};
101	});
102
103	// iOS — bypass jailbreak detection
104	const stat = Module.findExportByName(null, 'stat');
105	Interceptor.attach(stat, {
106	onEnter(args) {
107	const path = args[0].readUtf8String();
108	if (/Cydia\|jailbreak\|substrate\|frida/i.test(path)) {
109	args[0] = Memory.allocUtf8String('/nonexistent');
110	}
111	}
112	});
113	```
114
115	### Objection (Frida-based shortcuts)
116
117	```bash
118	objection -g com.vendor.app explore
119	# Then inside:
120	android sslpinning disable
121	android root disable
122	android hooking list activities
123	android intent launch_activity com.vendor.app/.SecretActivity
124	ios sslpinning disable
125	ios jailbreak disable
126	ios keychain dump
127	```
128
129	---
130
131	## SSL / TLS Interception
132
133	### Android Network Security Config
134
135	App with `<network-security-config>` requiring its own pinned CA: edit `res/xml/network_security_config.xml`, repack:
136
137	```bash
138	apktool b app -o app-patched.apk
139	apksigner sign --ks debug.keystore app-patched.apk
140	```
141
142	Or live-bypass with Frida (preferred — no recompile).
143
144	### iOS ATS / Pinning
145
146	For pinning, use Frida hooks against `SecTrustEvaluate*` / `NSURLSession` delegate method

People who liked this also viewed

6 picks

Type

offensive-mobile

37installs447forks

View on GitHub

How to install offensive-mobile?

snailsploit/claude-red/offensive-mobile

$npx -y skills add SnailSploit/Claude-Red --skill offensive-mobile

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Mobile (Android + iOS) — Offensive Testing Methodology
2
3	## Quick Workflow
4
5	1. Static: pull the IPA/APK, decompile, dump resources/strings, identify endpoints
6	2. Dynamic: install on rooted/jailbroken device, hook with Frida, intercept TLS
7	3. Map exported attack surface: deep links, URL schemes, exported components
8	4. Storage / Keystore audit: where do secrets live, what protects them
9	5. API: every backend the app talks to is your scope — test like a web app
10
11	---
12
13	## Lab Setup
14
15	### Android
16	- Rooted device or Genymotion / Android Studio AVD with `userdebug` build
17	- Magisk for systemless root; LSPosed for hooks; Frida server matching device arch
18	- Burp / Mitmproxy with system-trusted CA via Magisk module (`MagiskTrustUserCerts`)
19
20	### iOS
21	- Jailbroken device (palera1n / checkra1n / Dopamine depending on iOS version)
22	- Frida + Objection + Filza + SSH via USB (iproxy 2222 22)
23	- Burp CA installed via Settings → General → Device Management → Certificate Trust Settings
24
25	---
26
27	## Static Analysis
28
29	### Android
30
31	```bash
32	# Decode resources + smali
33	apktool d app.apk -o app
34
35	# Decompile to Java
36	jadx -d app_src app.apk
37
38	# Manifest review
39	xmllint --format app/AndroidManifest.xml \| less
40	# Look for: android:exported="true", intent-filters, custom permissions, debuggable, allowBackup, networkSecurityConfig
41	```
42
43	```bash
44	# Secrets and endpoints
45	grep -rE '(https?://[a-z0-9.-]+\|api[_-]?key\|secret\|token\|firebase\|amazonaws\|appspot)' app_src/
46	grep -r "Log\.[dwief]" app_src/ # leftover debug logs
47
48	# Native libs
49	file app/lib//.so
50	# RE in Ghidra/IDA; look for JNI_OnLoad and exported Java_* functions
51	```
52
53	### iOS
54
55	```bash
56	# Pull IPA from device
57	frida-ios-dump -o app.ipa "com.vendor.app"
58
59	# Or via App Store via 3rd-party tools (Apple Configurator with paid acct, etc.)
60	unzip app.ipa
61	# Decrypt if needed (jailbroken device): bagbak / clutch
62	bagbak com.vendor.app
63
64	# Class dump
65	class-dump-dyld -H Payload/App.app/App -o headers/
66	# Or for Swift symbols, use Hopper / IDA
67
68	# Strings / endpoints
69	strings -a Payload/App.app/App \| grep -E '(https?://\|key\|secret\|api)'
70	```
71
72	```bash
73	# Info.plist analysis
74	plutil -p Payload/App.app/Info.plist
75	# Look for: NSAppTransportSecurity exceptions, CFBundleURLTypes (URL schemes),
76	# associated-domains entitlements, UIFileSharingEnabled, ATS exemptions
77	```
78
79	---
80
81	## Dynamic Analysis & Frida
82
83	### Common Hooks
84
85	```javascript
86	// Bypass SSL pinning (Android — generic OkHttp/CertificatePinner/TrustManager)
87	Java.perform(() => {
88	const X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
89	const TrustManagerFactory = Java.use('javax.net.ssl.TrustManagerFactory');
90	// ... full bypass scripts: codeshare.frida.re/@pcipolloni/universal-android-ssl-pinning-bypass-with-frida
91	});
92
93	// Bypass root detection
94	Java.perform(() => {
95	const File = Java.use('java.io.File');
96	File.exists.implementation = function () {
97	const path = this.getAbsolutePath();
98	if (path.includes('su') \|\| path.includes('Magisk')) return false;
99	return this.exists();
100	};
101	});
102
103	// iOS — bypass jailbreak detection
104	const stat = Module.findExportByName(null, 'stat');
105	Interceptor.attach(stat, {
106	onEnter(args) {
107	const path = args[0].readUtf8String();
108	if (/Cydia\|jailbreak\|substrate\|frida/i.test(path)) {
109	args[0] = Memory.allocUtf8String('/nonexistent');
110	}
111	}
112	});
113	```
114
115	### Objection (Frida-based shortcuts)
116
117	```bash
118	objection -g com.vendor.app explore
119	# Then inside:
120	android sslpinning disable
121	android root disable
122	android hooking list activities
123	android intent launch_activity com.vendor.app/.SecretActivity
124	ios sslpinning disable
125	ios jailbreak disable
126	ios keychain dump
127	```
128
129	---
130
131	## SSL / TLS Interception
132
133	### Android Network Security Config
134
135	App with `<network-security-config>` requiring its own pinned CA: edit `res/xml/network_security_config.xml`, repack:
136
137	```bash
138	apktool b app -o app-patched.apk
139	apksigner sign --ks debug.keystore app-patched.apk
140	```
141
142	Or live-bypass with Frida (preferred — no recompile).
143
144	### iOS ATS / Pinning
145
146	For pinning, use Frida hooks against `SecTrustEvaluate*` / `NSURLSession` delegate method

People who liked this also viewed

6 picks

Type