mobile-pentest

Use when pentesting an Android/iOS app — Frida 17 instrumentation, SSL-pinning & root/jailbreak bypass, Android 14/15 CA injection, exported-component/content-provider abuse, deep-link/WebView chains, biometric bypass, Flutter/React-Native RE

Jump to install

Repository: hypnguyen1209/offensive-claude
Last source activity: June 29, 2026 at 07:22
Detected SKILL.md language: English
Stars: 343
Forks: 59

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill mobile-pentest

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

13 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

2026-06-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

View all from this repository

Mobile Application Penetration Testing

When to Activate

Android/iOS application security assessment, bug-bounty mobile triage, or app-store reconnaissance

Need to intercept TLS traffic (SSL/cert pinning, Android 14/15 Conscrypt-APEX trust store, Flutter/RN stacks)

Bypass root/jailbreak or biometric-gating controls during dynamic analysis

Enumerate and exploit exported components, content providers, deep links, and WebViews

Extract secrets from insecure storage (SharedPrefs, SQLite, Keychain, Keystore) and reverse hybrid apps

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Lab build + Frida 17 server/gadget

T1635

CWE-1188

references/environment-interception.md

Android 14/15 Conscrypt-APEX CA injection

T1521.001

CWE-295

references/environment-interception.md

scripts/android_ca_inject.sh

SSL/cert-pinning bypass (Java TM/OkHttp/native)

T1521.001

CWE-295

references/environment-interception.md

scripts/universal_unpin.js

Root detection bypass (RootBeer/native stat)

T1633.001

CWE-693

references/environment-interception.md

scripts/universal_unpin.js

Exported activity/service/receiver abuse

T1626.001

CWE-926

references/android-component-attacks.md

scripts/manifest_attack_surface.py

Content-provider SQLi / path traversal (CVE-2025-48609)

T1409

CWE-22, CWE-89

references/android-component-attacks.md

scripts/component_fuzz.sh

Task hijacking / StrandHogg / TapTrap (USENIX '25)

T1517

CWE-1021

references/android-component-attacks.md

scripts/manifest_attack_surface.py

Deep-link / intent-redirect / scheme hijack

T1635, T1577

CWE-939

references/webview-deeplink-exploitation.md

scripts/component_fuzz.sh

WebView JS-interface RCE + file:// theft

T1577

CWE-749

references/webview-deeplink-exploitation.md

scripts/component_fuzz.sh

Mobile Application Penetration Testing

When to Activate

Android/iOS application security assessment, bug-bounty mobile triage, or app-store reconnaissance

Need to intercept TLS traffic (SSL/cert pinning, Android 14/15 Conscrypt-APEX trust store, Flutter/RN stacks)

Bypass root/jailbreak or biometric-gating controls during dynamic analysis

Enumerate and exploit exported components, content providers, deep links, and WebViews

Extract secrets from insecure storage (SharedPrefs, SQLite, Keychain, Keystore) and reverse hybrid apps

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Lab build + Frida 17 server/gadget

T1635

CWE-1188

references/environment-interception.md

Android 14/15 Conscrypt-APEX CA injection

T1521.001

CWE-295

references/environment-interception.md

scripts/android_ca_inject.sh

SSL/cert-pinning bypass (Java TM/OkHttp/native)

T1521.001

CWE-295

references/environment-interception.md

scripts/universal_unpin.js

Root detection bypass (RootBeer/native stat)

T1633.001

CWE-693

references/environment-interception.md

scripts/universal_unpin.js

Exported activity/service/receiver abuse

T1626.001

CWE-926

references/android-component-attacks.md

scripts/manifest_attack_surface.py

Content-provider SQLi / path traversal (CVE-2025-48609)

T1409

CWE-22, CWE-89

references/android-component-attacks.md

scripts/component_fuzz.sh

Task hijacking / StrandHogg / TapTrap (USENIX '25)

T1517

CWE-1021

references/android-component-attacks.md

scripts/manifest_attack_surface.py

Deep-link / intent-redirect / scheme hijack

T1635, T1577

CWE-939

references/webview-deeplink-exploitation.md

scripts/component_fuzz.sh

WebView JS-interface RCE + file:// theft

T1577

CWE-749

references/webview-deeplink-exploitation.md

scripts/component_fuzz.sh

Technique

Telemetry / IOC

Detection (Sigma / app-side)

OPSEC note

Frida instrumentation

frida-server/gadget ports (27042), re.frida.server, suspicious maps regions, named pipes linjector

App scans /proc/self/maps for frida, checks D-Bus port, thread gum-js-loop; Play Integrity

Use frida-gadget renamed lib, custom port frida-server -l 0.0.0.0:1337, magisk-hide / Shamiko

CA injection (APEX)

New trust anchor in process trust store; cert CN mismatch on pinned hosts

Network Security Config <trust-anchors> excludes user store; pinning catches it

Mount lives only in Zygote ns, vanishes on Zygote crash — re-inject; nothing written to /system

SSL-pinning bypass

TLS handshake to proxy IP; cert chain not app-pinned cert

App-side pin failure callbacks fire (if logged); telemetry SDK sees proxy cert

Hook before first request; for Flutter prefer reFlutter patch over runtime to avoid crash loops

Root/JB bypass

getprop ro.debuggable, su binaries, magisk paths queried

RootBeer/iXGuard SDK reports; SafetyNet/Play Integrity attestation server-side

Bypass client checks only; server-side attestation (Play Integrity / DeviceCheck) is unaffected

Exported component abuse

am start/startservice/broadcast from adb; foreign UID intent

App logs unexpected caller UID; Binder.getCallingUid() checks

Use on-device malicious app for realism; adb leaves shell history

Content-provider traversal

content query with ../; openFile on out-of-dir path

FileProvider canonical-path check; CVE-2025-48609 patched Mar 2026 SPL

URL-encode ..%2f to dodge naive filters; read-only first

TapTrap / task hijack

Transparent activity transition, taskAffinity overlap, animationScale abuse

TapTrap fixed Dec 2025 SPL; check targetSdk, taskAffinity=""

Zero-permission; works <Dec-2025 patch; user study: 100% missed at least one variant

Keychain/Keystore dump

keychain_dumper, frida memory scrape, SecItemCopyMatching hooks

Keychain items with .biometryCurrentSet resist hooking; SE-backed keys unextractable

JB device dumps keychain plaintext regardless of ACL; flag SE vs SW keys in report

Biometric bypass

LAContext evaluatePolicy / BiometricPrompt callback hook

Only works on boolean-result pattern, NOT SecAccessControl-gated crypto

Report root cause: auth result not bound to a crypto/keychain operation

name	mobile-pentest
description	Use when pentesting an Android/iOS app — Frida 17 instrumentation, SSL-pinning & root/jailbreak bypass, Android 14/15 CA injection, exported-component/content-provider abuse, deep-link/WebView chains, biometric bypass, Flutter/React-Native RE
metadata	{"type":"offensive","phase":"exploitation","tools":"frida, frida-tools, objection, jadx, apktool, reflutter, hermes-dec, hbctool, mitmproxy, burp, palera1n, dopamine, frida-ios-dump, bagbak, mobsf, drozer, nuclei","mitre":"TA0001"}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0001","TA0009","TA0006","TA0005"],"attck_techniques":["T1626","T1626.001","T1517","T1409","T1517","T1577","T1631","T1407","T1635","T1521","T1521.001","T1417","T1417.001","T1660","T1644","T1623"]}
depends_on	["recon-osint","reverse-engineering"]
feeds_into	["exploit-development","web-pentest"]
inputs	["apk_file","ipa_file","mobile_endpoint","app_package_id"]
outputs	["finding_record","mobile_vulnerability_list","intercepted_traffic","extracted_secrets"]
references	["references/environment-interception.md","references/android-component-attacks.md","references/webview-deeplink-exploitation.md","references/insecure-storage-crypto.md","references/ios-offensive.md","references/crossplatform-re-instrumentation.md"]
scripts	["scripts/universal_unpin.js","scripts/android_ca_inject.sh","scripts/manifest_attack_surface.py","scripts/component_fuzz.sh","scripts/ios_bypass_suite.js","scripts/hermes_triage.py"]

name	mobile-pentest
description	Use when pentesting an Android/iOS app — Frida 17 instrumentation, SSL-pinning & root/jailbreak bypass, Android 14/15 CA injection, exported-component/content-provider abuse, deep-link/WebView chains, biometric bypass, Flutter/React-Native RE
metadata	{"type":"offensive","phase":"exploitation","tools":"frida, frida-tools, objection, jadx, apktool, reflutter, hermes-dec, hbctool, mitmproxy, burp, palera1n, dopamine, frida-ios-dump, bagbak, mobsf, drozer, nuclei","mitre":"TA0001"}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0001","TA0009","TA0006","TA0005"],"attck_techniques":["T1626","T1626.001","T1517","T1409","T1517","T1577","T1631","T1407","T1635","T1521","T1521.001","T1417","T1417.001","T1660","T1644","T1623"]}
depends_on	["recon-osint","reverse-engineering"]
feeds_into	["exploit-development","web-pentest"]
inputs	["apk_file","ipa_file","mobile_endpoint","app_package_id"]
outputs	["finding_record","mobile_vulnerability_list","intercepted_traffic","extracted_secrets"]
references	["references/environment-interception.md","references/android-component-attacks.md","references/webview-deeplink-exploitation.md","references/insecure-storage-crypto.md","references/ios-offensive.md","references/crossplatform-re-instrumentation.md"]
scripts	["scripts/universal_unpin.js","scripts/android_ca_inject.sh","scripts/manifest_attack_surface.py","scripts/component_fuzz.sh","scripts/ios_bypass_suite.js","scripts/hermes_triage.py"]

mobile-pentest

Install options

Review the source files

Mobile Application Penetration Testing

When to Activate

Technique Map

Mobile Application Penetration Testing

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

mobile-pentest

Source facts

Install options

Review the source files

More from this repository

Mobile Application Penetration Testing

When to Activate

Technique Map

More from this repository

Mobile Application Penetration Testing

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives