Menu
Mobile application red team category โ Android (APK) and iOS (IPA) pentest. Routing skill: identifies the platform + attack surface, then loads the matching sub-skill.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Benchmark mode marker โ engagement objective is flag capture. Generic engagement rules apply unchanged.
Exploit Active Directory Certificate Services ESC1 โ vulnerable template allows arbitrary SAN, enabling user impersonation up to domain admin.
BloodHound ingestion + canonical Cypher queries for AD attack-path enumeration. Run after collector dumps zip; promotes findings into the knowledge graph.
NetExec (CrackMapExec successor) โ unified SMB/LDAP/MSSQL/WinRM/RDP/SSH/FTP/VNC protocol auth + post-auth modules. 200+ modules incl. BloodHound auto-ingest, ESC1-15 scanning, PrintNightmare, LDAP relay.
Active Directory attack lane โ BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync, LAPS extraction.
Red team engagement lifecycle management โ initiation, phase transitions, go/no-go gates, deconfliction, emergency procedures, completion.
| name | mobile |
| description | Mobile application red team category โ Android (APK) and iOS (IPA) pentest. Routing skill: identifies the platform + attack surface, then loads the matching sub-skill. |
| allowed-tools | Bash Read Write |
| metadata | {"subdomain":"mobile","when_to_use":"mobile, android, ios, apk, ipa, app, smartphone, frida, objection, jadx, apktool, mobsf, ssl pinning, root detection, jailbreak, intent, deep link, url scheme, mobile pentest","tags":"mobile, android, ios, frida, jadx, apktool","mitre_attack":"T1517, T1640, T1418, T1409"} |
This is a routing skill. Identify the target platform and the relevant attack surface, then load the specialized sub-skill.
| Sub-Skill | Covers | When to Load |
|---|---|---|
| android | APK static (apktool/jadx) + dynamic (Frida/Objection), SSL pinning bypass, root detection bypass, intent fuzzing, keystore extraction, exported components | Android .apk file in scope, Play-Store target, MDM-managed Android device |
adb shell pm path <pkg>), or device pull (adb pull)standard/exploit/web/ once you have endpoints and tokens| Tool | Use |
|---|---|
apktool | Smali decompile / recompile / re-sign |
jadx | Java pseudocode from DEX |
frida / frida-tools | Runtime instrumentation |
objection | Frida wrapper โ ready-made bypass scripts |
mobsf | Automated SAST+DAST first-pass triage |
drozer | IPC / exported-component fuzzer |
apksigner / zipalign | Re-sign modified APKs for re-install |
frida-ssl-pin-bypass | Universal SSL-pinning patches |
nox / genymotion / android-studio AVD | Emulators (x86_64 for speed) |
ios/) is on the roadmap โ for iOS work today, leverage the same dynamic patterns (Frida + Objection) and load android/SKILL.md for the methodology since the analytical workflow is platform-agnostic./skills/standard/exploit/web/SKILL.md.