mobile-security

Name: mobile-security
Author: transilienceai

423stars74forks

How to install mobile-security?

transilienceai/communitytools/mobile-security

$npx -y skills add transilienceai/communitytools --skill mobile-security

Installs into the current project.

Summary

Mobile application security testing (Android + iOS) mapped to OWASP MASVS/MASTG — static reversing (Flutter AOT, Unity IL2CPP, React Native/Hermes, native ARM64, Mach-O/Swift), SAST (manifest/IPC, storage, crypto, signing), dynamic analysis (Frida/objection, TLS-pinning + root/ja

Files · 1

View on GitHub

SKILL.md

1	# Mobile Security
2
3	## Scope
4
5	End-to-end mobile application VAPT for Android (APK/AAB) and iOS (IPA), aligned to the OWASP MASVS v2.x control groups and the MASTG testing process. Four complementary tiers:
6
7	1. Static reverse engineering of compiled artifacts — Dart AOT snapshots, Unity IL2CPP, React Native/Hermes bytecode, native ARM64 `.so`/Mach-O, smali. Recover secrets, endpoints, and the crypto contract without a device.
8	2. SAST — manifest / `Info.plist`, exported-component & IPC surface, WebView, local storage, cryptographic-primitive weakness, code-signing, and automated baseline (MobSF/apkid/apkleaks) → then manual deep-dive.
9	3. Dynamic analysis (DAST) — Frida/objection instrumentation, traffic interception, TLS-pinning bypass across stacks, Keychain/Keystore runtime dumps, IPC probing, and root/jailbreak/anti-tamper defeat for MAS-L2 / MASA scope.
10	4. Privacy — data-collection inventory, tracker/SDK enumeration, PII leakage, declared-vs-actual (Play Data Safety / Apple Privacy Manifest).
11
12	Static dump first (faster, no device); dynamic is a first-class phase whenever a control can only be proven at runtime (enforced pinning, Keystore-backed keys, root reaction, IPC guards). Cross-asset stitching, scoring, and reporting are owned by sibling skills — this skill produces MASVS/MASTG-tagged findings and hands them off.
13
14	## When to use
15
16	- Target ships an Android APK/AAB or iOS IPA — extract and inspect before any runtime testing.
17	- Built with Flutter (`lib/arm64-v8a/libapp.so` / iOS `App.framework`), Unity (`libil2cpp.so` + `global-metadata.dat`), or React Native + Hermes (`libhermes.so` + `index.android.bundle`) — needs a runtime-aware decompiler, not just jadx.
18	- Stock Android/iOS app — you need the manifest/IPC/storage/crypto/signing attack surface (SAST) and, where a control is runtime-only, dynamic confirmation.
19	- App uses encrypted API envelopes (KEY/IV/SALT/SIGNATURE headers) and you need to reverse the crypto contract, then replay against the live API.
20	- TLS pinning / root / jailbreak detection blocks testing — bypass it dynamically (or defeat it statically) and demonstrate the protected flow.
21	- You suspect IDOR / mass assignment / business-logic flaws easier to find in the dumped client, then confirmed server-side.
22	- You need a MASVS-PRIVACY pass (trackers, over-collection, PII leakage, declared-vs-actual).
23
24	## Methodology
25
26	Start at [reference/methodology.md](reference/methodology.md) — the phase backbone (ACQUIRE → TRIAGE → STATIC → DYNAMIC → NETWORK → STORAGE → PLATFORM/IPC → BACKEND PIVOT → REPORT), app acquisition + evidence integrity, the MASVS→file coverage map, finding-tagging convention, and the client→API pivot. It routes to every reference below. Do preflight ([../coordination/reference/preflight-checklist.md](../coordination/reference/preflight-checklist.md)) first.
27
28	## References
29
30	Cross-cutting
31	- [reference/methodology.md](reference/methodology.md) — the hub: phases, acquisition (adb pull / bundletool / ipatool), MASVS/MASTG tagging, backend pivot.
32	- [reference/privacy-testing.md](reference/privacy-testing.md) — MASVS-PRIVACY for both platforms: trackers/SDKs, PII channels, declared-vs-actual.
33
34	Android
35	- [reference/android-static-analysis.md](reference/android-static-analysis.md) — SAST: MobSF/apkid/apkleaks baseline, manifest & exported-component/IPC, ContentProvider SQLi/traversal, PendingIntent, deep links, native WebView RCE, storage & Keystore review, crypto-primitive weakness pass, NSC, apksigner/Janus, SBOM.
36	- [reference/android-dynamic-analysis.md](reference/android-dynamic-analysis.md) — DAST: device/Magisk/Zygisk setup, frida-server bring-up, objection recipes, interception + Android-7 user-CA workarounds, cross-stack pinning bypass (OkHttp/BoringSSL-Flutter/RN), drozer IPC, runtime storage, RESILIENCE active bypass + repack/resign.
37
38	iOS
39	- [reference/ios-static-analysis.md](reference/ios-static-analysis.md) — SAST: IPA acquisition + FairPlay decrypt (cryptid), Mach-O/ObjC/Swift RE, ATS, entitlements/provisioning, binary hardening, Keychain accessibility + Data Protection, URL schemes/Universal Links, WKWebView, pasteboard/snapshot, MobSF/SBOM.
40	- [reference/ios-dynamic-analysis.md](reference/ios-dynamic-analysis.md) — DAST: jailbroken vs non-JB (objection patchipa / frida-gadget) bring-up, objection/Frida on iOS, SSL Kill Switch / SecTrust pinning bypass, Keychain dump, LAContext biometric bypass, jailbreak/anti-debug defeat, method tracing.
41
42	Framework-specific reverse engineering
43	- [reference/flutter-aot-rever

People who liked this also viewed

6 picks

Type

mobile-security

423stars74forks

View on GitHub

How to install mobile-security?

transilienceai/communitytools/mobile-security

$npx -y skills add transilienceai/communitytools --skill mobile-security

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Mobile Security
2
3	## Scope
4
5	End-to-end mobile application VAPT for Android (APK/AAB) and iOS (IPA), aligned to the OWASP MASVS v2.x control groups and the MASTG testing process. Four complementary tiers:
6
7	1. Static reverse engineering of compiled artifacts — Dart AOT snapshots, Unity IL2CPP, React Native/Hermes bytecode, native ARM64 `.so`/Mach-O, smali. Recover secrets, endpoints, and the crypto contract without a device.
8	2. SAST — manifest / `Info.plist`, exported-component & IPC surface, WebView, local storage, cryptographic-primitive weakness, code-signing, and automated baseline (MobSF/apkid/apkleaks) → then manual deep-dive.
9	3. Dynamic analysis (DAST) — Frida/objection instrumentation, traffic interception, TLS-pinning bypass across stacks, Keychain/Keystore runtime dumps, IPC probing, and root/jailbreak/anti-tamper defeat for MAS-L2 / MASA scope.
10	4. Privacy — data-collection inventory, tracker/SDK enumeration, PII leakage, declared-vs-actual (Play Data Safety / Apple Privacy Manifest).
11
12	Static dump first (faster, no device); dynamic is a first-class phase whenever a control can only be proven at runtime (enforced pinning, Keystore-backed keys, root reaction, IPC guards). Cross-asset stitching, scoring, and reporting are owned by sibling skills — this skill produces MASVS/MASTG-tagged findings and hands them off.
13
14	## When to use
15
16	- Target ships an Android APK/AAB or iOS IPA — extract and inspect before any runtime testing.
17	- Built with Flutter (`lib/arm64-v8a/libapp.so` / iOS `App.framework`), Unity (`libil2cpp.so` + `global-metadata.dat`), or React Native + Hermes (`libhermes.so` + `index.android.bundle`) — needs a runtime-aware decompiler, not just jadx.
18	- Stock Android/iOS app — you need the manifest/IPC/storage/crypto/signing attack surface (SAST) and, where a control is runtime-only, dynamic confirmation.
19	- App uses encrypted API envelopes (KEY/IV/SALT/SIGNATURE headers) and you need to reverse the crypto contract, then replay against the live API.
20	- TLS pinning / root / jailbreak detection blocks testing — bypass it dynamically (or defeat it statically) and demonstrate the protected flow.
21	- You suspect IDOR / mass assignment / business-logic flaws easier to find in the dumped client, then confirmed server-side.
22	- You need a MASVS-PRIVACY pass (trackers, over-collection, PII leakage, declared-vs-actual).
23
24	## Methodology
25
26	Start at [reference/methodology.md](reference/methodology.md) — the phase backbone (ACQUIRE → TRIAGE → STATIC → DYNAMIC → NETWORK → STORAGE → PLATFORM/IPC → BACKEND PIVOT → REPORT), app acquisition + evidence integrity, the MASVS→file coverage map, finding-tagging convention, and the client→API pivot. It routes to every reference below. Do preflight ([../coordination/reference/preflight-checklist.md](../coordination/reference/preflight-checklist.md)) first.
27
28	## References
29
30	Cross-cutting
31	- [reference/methodology.md](reference/methodology.md) — the hub: phases, acquisition (adb pull / bundletool / ipatool), MASVS/MASTG tagging, backend pivot.
32	- [reference/privacy-testing.md](reference/privacy-testing.md) — MASVS-PRIVACY for both platforms: trackers/SDKs, PII channels, declared-vs-actual.
33
34	Android
35	- [reference/android-static-analysis.md](reference/android-static-analysis.md) — SAST: MobSF/apkid/apkleaks baseline, manifest & exported-component/IPC, ContentProvider SQLi/traversal, PendingIntent, deep links, native WebView RCE, storage & Keystore review, crypto-primitive weakness pass, NSC, apksigner/Janus, SBOM.
36	- [reference/android-dynamic-analysis.md](reference/android-dynamic-analysis.md) — DAST: device/Magisk/Zygisk setup, frida-server bring-up, objection recipes, interception + Android-7 user-CA workarounds, cross-stack pinning bypass (OkHttp/BoringSSL-Flutter/RN), drozer IPC, runtime storage, RESILIENCE active bypass + repack/resign.
37
38	iOS
39	- [reference/ios-static-analysis.md](reference/ios-static-analysis.md) — SAST: IPA acquisition + FairPlay decrypt (cryptid), Mach-O/ObjC/Swift RE, ATS, entitlements/provisioning, binary hardening, Keychain accessibility + Data Protection, URL schemes/Universal Links, WKWebView, pasteboard/snapshot, MobSF/SBOM.
40	- [reference/ios-dynamic-analysis.md](reference/ios-dynamic-analysis.md) — DAST: jailbroken vs non-JB (objection patchipa / frida-gadget) bring-up, objection/Frida on iOS, SSL Kill Switch / SecTrust pinning bypass, Keychain dump, LAContext biometric bypass, jailbreak/anti-debug defeat, method tracing.
41
42	Framework-specific reverse engineering
43	- [reference/flutter-aot-rever

People who liked this also viewed

6 picks

Type