mobile-overview

# Mobile Operator Skill Catalog Mobile is 40% of modern bug-bounty programs and is conspicuously absent from Strix and XBOW commercial. This catalog covers both platforms with shared Frida tooling for runtime work. ## Playbooks — Android > **Inline technique reference — not separately loadable skills.** The entries below > are summarized here for direct use; there is no separate `SKILL.md` to open for > each. Do NOT call the skill loader on them — apply the technique with your tools > using this summary and the Workflow in this file. | Technique | Use for | |---|---| | **apk-triage** | apktool decode + jadx -d for source recovery | | **manifest-analysis** | exported components, permissions, deeplinks | | **insecure-storage** | SharedPreferences / SQLite / external storage scans | | **intent-redirection** | Intent forwarding / pendingIntent abuse | | **webview-flaws** | JavaScriptInterface, file:// access, mixed content | | **frida-ssl-pin-bypass** | OkHttp / TrustKit / Cordova pin-bypass scripts | | **root-detect-bypass** | Common root-detection libraries and their bypasses | ## Playbooks — iOS | Technique | Use for | |---|---| | **ipa-triage** | class-dump-z + Hopper; Mach-O headers; entitlements | | **keychain-acl** | Keychain ACL misconfigurations; `kSecAccessControl` flags | | **url-scheme-abuse** | Universal links + URL scheme handler attacks | | **xpc-services** | XPC interface enumeration; unauthenticated XPC services | | **frida-trust-killer** | SSL Kill Switch + Frida pin-bypass for iOS apps | | **jailbreak-detect-bypass** | DTAppJailbreakDetectorSwift, Liberty Lite, common patterns | ## Cross-platform | Technique | Use for | |---|---| | **frida-bridge** | frida-server install on emulator / jailbroken device; basic scripts | | **objection-walkthrough** | Objection cheatsheet (env, memory, sqlite, classes) | | **firebase-misconfig** | Firebase /Firestore RLS / Storage / Auth bypasses | | **mobile-api-testing** | Burp / Caido proxy → mobile API endpoint enumeration | ## Workflow 1. **Triage**: jadx for Android, class-dump for iOS. Search strings for API endpoints, Firebase config, AWS keys. 2. **Static**: AndroidManifest.xml exported components; iOS Info.plist URL schemes + entitlements. 3. **Dynamic setup**: Frida server on a rooted emulator (Android) or jailbroken physical device (iOS); Objection for quick inspection. 4. **SSL pin bypass**: Frida script; verify HTTPS now visible in Burp. 5. **API enumeration**: re-route the app through the proxy; spider reachable endpoints; export to Burp project for later web-recon-style testing. 6. **Insecure storage**: pull `/data/data/<pkg>/` (Android) or app container (iOS); grep for credentials, tokens, PII. 7. **Component-level attacks**: send crafted Intents (`adb shell am start ...`) or URL-scheme payloads (`xcrun simctl openurl ...`). ## Tools sandbox - adb + emulator / physical device. - jadx, apktool, dex2jar, jd-gui. - class-dump, Hopper Disassembler, IDA Free (host-side). - Frida-server (per device), frida (host), objection. - mitmproxy / Burp Suite Community / Caido (PR #304 lands the LangChain Caido tool bundle). - MobSF (`mobsf` Docker image) for automated triage when speed matters.