pentest-mobile

name	pentest-mobile
description	Android and iOS mobile application penetration testing using OWASP MASTG and MASVS. Use when the user mentions APK/IPA analysis, Frida hooking, Objection, jadx, MobSF, SSL pinning bypass, root/jailbreak detection bypass, Android exported components, iOS URL schemes / Universal Links, Keystore/Keychain, MASVS-* identifiers, or any mobile static/dynamic analysis task.

Pentest — Mobile (Android + iOS)

Apply 02-mobile/ from the pentest-templates library.

Library root

$PENTEST_LIBRARY — caminho absoluto deste repositório clonado (definido pelo instalador; veja INSTALL.md).

Read 02-mobile/00-overview.md first, then walk numbered files.

Phase order

1. 02-mobile/01-static-analysis.md — manifest, secrets, libs, signing.
2. 02-mobile/02-dynamic-analysis.md — Frida, Burp interception, runtime hooking.
3. 02-mobile/03-storage.md — MASVS-STORAGE.
4. 02-mobile/04-cryptography.md — MASVS-CRYPTO.
5. 02-mobile/05-authentication.md — MASVS-AUTH.
6. 02-mobile/06-network.md — MASVS-NETWORK, TLS, pinning.
7. 02-mobile/07-platform-android.md — IPC, intents, deep links, WebView.
8. 02-mobile/08-platform-ios.md — URL schemes, Universal Links, App Groups, WKWebView.
9. 02-mobile/09-resilience.md — root/jailbreak detection, anti-RE.
10. 02-mobile/10-code.md — build hygiene, dependency CVEs.
11. 02-mobile/11-privacy.md — data minimisation, consent.

How to operate

1. Confirm artefact (APK/AAB/IPA) hash, build flavour, target OS levels.
2. Static-first: pull manifests, signing, secrets, third-party libs from the static-analysis checklist before running dynamic.
3. Dynamic: Frida server matching desktop Frida version; Burp/mitmproxy CA installed in user store + system-CA bypass for Android 7+.
4. For each user question, locate the matching MAS-TEST item (stable ID per file) and follow its Methodology + How to test.
5. Backend API surface → also use pentest-web-api. IoT companion app → also use pentest-iot-ot.

When NOT to use

• Pure backend API → pentest-web-api.
• IoT device with companion app → use this skill for the app and pentest-iot-ot for device + radio.

Pre-conditions

• Rooted Android (Pixel + Magisk + LSPosed) and/or jailbroken iOS device.
• Frida server running on device matching desktop Frida version.
• Burp / mitmproxy with CA pinned + user-store install + system-CA bypass.

OPSEC

• Engagement-only redistribution of decrypted IPAs.
• Production user data: capture metadata only unless ROE permits sample extraction.

References inside the library

• Cheatsheet: cheatsheets/mobile.md.
• Tooling: tools/install-mobile.md, tool-mappings/02-mobile-tools.md.
• Frameworks: frameworks/owasp-masvs.md, frameworks/owasp-mastg.md, frameworks/mitre-attack-mobile.md.
• Playbook: playbooks/05-mobile-pentest-day-by-day.md.