Menu
客户端逆向与Burp重放 — 复杂客户端签名恢复、加密还原、请求链追踪、稳定重放，适用于已授权安卓App渗透测试、浏览器JS签名、桌面客户端逆向
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Domain routing and boundary guidance for authorized Active Directory red-team security testing, including Kerberos attacks, domain privilege escalation, lateral movement, and GPO abuse. Use when a task belongs to the AD testing domain and needs scope, evidence, pivot, or exit criteria.
Domain routing and boundary guidance for authorized API security testing, including BOLA/IDOR, authentication bypass, mass assignment, missing rate limits, and GraphQL issues. Use when a task belongs to the API testing domain and needs scope, evidence, pivot, or exit criteria.
Domain routing and boundary guidance for authorized authentication, authorization, and session security testing, including password policy, JWT/token, OAuth, and MFA bypass issues. Use when a task belongs to the auth testing domain and needs scope, evidence, pivot, or exit criteria.
Domain routing and boundary guidance for authorized web cache poisoning testing, including unkeyed headers, unkeyed parameters, cache deception, and CDN-specific behavior. Use when a task belongs to the cache poisoning domain and needs scope, evidence, pivot, or exit criteria.
Domain routing and boundary guidance for authorized clickjacking testing, including missing X-Frame-Options, CSP frame-ancestors bypasses, and drag-and-drop hijacking. Use when a task belongs to the clickjacking domain and needs scope, evidence, pivot, or exit criteria.
Domain routing and boundary guidance for authorized cloud security testing, including IAM misconfiguration, exposed storage, metadata services, and serverless injection. Use when a task belongs to the cloud testing domain and needs scope, evidence, pivot, or exit criteria.
| name | client-reverse |
| description | 客户端逆向与Burp重放 — 复杂客户端签名恢复、加密还原、请求链追踪、稳定重放，适用于已授权安卓App渗透测试、浏览器JS签名、桌面客户端逆向 |
| routing | {"target_types":["client","android","mobile"],"task_types":["reverse"],"tooling":["frida","jadx","burp","scrcpy"]} |
当请求由客户端（安卓App、浏览器JS、桌面客户端）构造，且存在签名、加密、token状态、设备绑定或反自动化逻辑导致 Burp 无法直接重放时，使用本 Skill。
Packet-First：先捕获并分析真实的 HTTP/HTTPS 请求或 WebSocket 流量，确认可用性，再按需逆向阻塞点。逆向是阻塞解决步骤，不是默认入口。
不要先用 jadx、ida_pro_mcp 分析 APK，按以下顺序操作：
web-security-advanced 做 Web/API 安全测试MCP 工具链：scrcpy_vision → burp/charles → adb_mcp → jadx → frida_mcp → ida_pro_mcp
阶段模型：locate → recover → runtime → validation → replay
MCP 工具链：chrome_devtools → js_reverse → burp
MCP 工具链：everything_search → ida_pro_mcp → frida_mcp → burp
在进入 Payload 测试前，必须能回答：
references/02-client-api-reverse-and-burp.md — 客户端逆向到 Burp 重放总工作流references/android-authorized-app-pentest-sop.md — 安卓 App 渗透 SOPreferences/browser-js-signing-workflow.md — 浏览器 JS 签名工作流references/android-signing-and-crypto-workflow.md — 安卓签名与加密工作流references/android-ui-driven-observation-and-packet-loop.md — 安卓 UI 驱动观察循环references/android-external-url-runtime-first-workflow.md — 安卓外部 URL 测试references/android-network-layer-testing-quick-reference.md — 安卓网络层测试速查references/MCP.md — MCP 能力总文档references/tool-selection-map.md — 工具选型地图