| name | mobile-security |
| description | Mobile security covers the complete attack/defense chain of Android/iOS application security testing, APK/IPA reverse engineering, runtime manipulation, certificate pinning bypass, and mobile data protection. |
| origin | openclaw |
| version | 0.2.0.2 |
| compatibility | ["openclaw","claude-code","cursor","windsurf"] |
| allowed-tools | ["Bash","Read","Write","Edit","WebSearch","WebFetch"] |
| metadata | {"domain":"mobile","tool_count":6,"guide_count":5,"last_reviewed":"2026-07-26"} |
Skill: Mobile Security
Supplementary Files:
payloads.md — Complete mobile security attack/defense chain payloads (APK/IPA analysis, Frida hooks, SSL bypass, storage extraction, Intent attacks, etc.)test-cases.md — Structured test cases (static analysis, dynamic analysis, runtime manipulation, network testing, data protection)
Summary
Mobile Security skill domain covering mobile operations.
Tools: frida, objection, apktool, jadx, mobsf, drozer
Domain: mobile
Description
Mobile security covers the complete attack/defense chain of Android/iOS application security testing, APK/IPA reverse engineering, runtime manipulation, certificate pinning bypass, and mobile data protection. The core objective is to identify security flaws in mobile applications, assess client-side defense strength, extract sensitive data, and develop hardening strategies.
Mastering this skill requires a deep understanding of Android APK structure (DEX, Manifest, Resources), iOS IPA structure (Mach-O, Info.plist), mobile sandbox mechanisms, Keychain/Keystore secure storage, and Frida dynamic instrumentation. The agent can comprehensively use tools such as apktool, jadx, Frida, objection, and MobSF to complete the full workflow from application decompilation to runtime manipulation.
Use Cases
- Android/iOS Application Penetration Testing - Perform security assessments on target mobile applications, discovering vulnerabilities such as data leakage, insecure storage, and exposed components
- APK Reverse Engineering and Code Audit - Decompile Android applications, auditing source code for hardcoded credentials, insecure API calls, and logic flaws
- SSL Pinning Bypass - Bypass application certificate pinning mechanisms to intercept and analyze encrypted HTTPS traffic
- Runtime Hooking and Data Extraction - Use Frida for dynamic instrumentation of running applications, hooking encryption functions, bypassing security checks, and extracting sensitive data from memory
- Mobile Malware Analysis - Analyze behavioral characteristics of suspicious APKs/IPAs, extract IoCs, and assess threat levels
Core Tools
| Tool | Purpose | Command Example |
|---|
| frida | Dynamic instrumentation framework, runtime hooks, function tracing, memory read/write | frida -U -f com.target.app -l hook.js |
| objection | Frida-based mobile runtime exploration toolkit | objection -g com.target.app explore |
| apktool | APK decompilation and repackaging, restoring Manifest and smali | apktool d app.apk -o app_source |
| jadx | DEX decompilation to readable Java source code | jadx app.apk -d app_java |
| mobsf | Mobile application automated security analysis framework (static + dynamic) | docker run -p 8000:8000 opensecurity/mobsf |
| drozer | Android IPC vulnerability scanning and exploitation framework | drozer console connect |
Methodology
Attack Chain
App Decompilation Static Analysis Dynamic Analysis Runtime Manipulation
(apktool, jadx) (Code audit, Manifest) (Proxy, traffic) (Frida, objection)
| | | |
v v v v
Information Vulnerability Communication Data Extraction
Collection Identification Analysis & Exploitation
(Package name, (Hardcoded (API endpoints, (Sensitive data
components, credentials, authentication export,
permissions, SDK) exported mechanisms, auth bypass,
components, SSL Pinning) security check
insecure bypass)
storage)
- App Decompilation - apktool restores Manifest and smali code, jadx decompiles to readable Java, obtaining complete application structure
- Static Analysis - Audit AndroidManifest.xml (exported components, permissions, debuggable flag), scan for hardcoded credentials and API keys
- Dynamic Analysis - Configure proxy to intercept network traffic, analyze API communication patterns and authentication mechanisms, identify certificate pinning implementations
- Runtime Manipulation - Use Frida to hook key functions (encryption, authentication, checks), bypass security protections, extract runtime sensitive data
- Data Extraction and Exploitation - Export plaintext data from SharedPreferences/SQLite, exploit exported component vulnerabilities, construct Intent attack chains
Defense Perspective
| Defense Measure | Purpose | Bypass Approach |
|---|
| Code Obfuscation | ProGuard/R8 obfuscate code, increasing reverse engineering difficulty | Spend time analyzing obfuscation mappings, dynamically hook to bypass static protections |
| Certificate Pinning | Pin server certificate fingerprints, preventing MITM attacks | Frida hook TrustManager / OkHttp CertificatePinner |
| Root/Jailbreak Detection | Detect whether device is rooted/jailbroken, blocking dangerous environments | Frida hook detection function return values, modify file existence checks |
| Anti-Tampering | Detect APK integrity, prevent repackaging | Modify signature verification logic, bypass integrity checks |
| Secure Storage | Use Android Keystore / iOS Keychain for sensitive data storage | Hook encryption functions to intercept plaintext before encryption / after decryption |
| Anti-Debug | Detect debugger attachment, preventing dynamic analysis | Modify anti-debugging flags, use Frida spawn mode to bypass |
Practical Steps
1. APK Decompilation and Static Analysis
Decompile APK to obtain Manifest and smali code, scan for hardcoded credentials and insecure storage patterns.
2. Frida Hook Basics
Use Frida Java.perform to hook login methods for credential interception, hook encryption functions to intercept plaintext data.
3. SSL Pinning Bypass
Bypass certificate pinning through Frida hooking OkHttp CertificatePinner or replacing TrustManager. Shortcut: objection -g com.target.app explore -> android sslpinning disable.
4. Data Storage Analysis
Check SharedPreferences plaintext storage, SQLite database contents, external storage leakage, exploit allowBackup to extract application data.
5. Intent Exploitation and Component Attacks
Use drozer to discover exported components, construct malicious Intents via adb to attack exported Activities, Content Providers, Broadcast Receivers, and Deep Links.
Detailed payloads in payloads.md, complete test checklist in test-cases.md.
Cross-Platform Mobile Testing
Modern mobile apps increasingly use cross-platform frameworks that introduce unique attack surfaces:
| Framework | Key Attack Surface | Primary Tools |
|---|
| React Native | JS bundle extraction, WebView bridges, AsyncStorage | jadx, Frida, Burp |
| Flutter | Dart snapshot, libapp.so, platform channels | Ghidra, Frida, reFlutter |
| Xamarin | DLL extraction, AOT compilation | dnSpy, ILDasm |
| Capacitor/Ionic | WebView exposure, plugin API | Chrome DevTools, Burp |
See guides/react-native-flutter-security.md for framework-specific testing methodology.
Mobile-Cloud Integration Testing
Mobile apps connect to cloud backends (Firebase, AWS Amplify, custom APIs). Key test areas:
- Backend API exposure: Enumerate and test all API endpoints accessible from the app
- Cloud service misconfiguration: Firebase rules, Cognito pools, Storage buckets
- Authentication flow: OAuth 2.0/OIDC implementation flaws on mobile
- Third-party SDK security: Data collection, tracking, insecure defaults
See guides/mobile-api-security-testing.md and guides/mobile-cloud-integration.md.
Detection Methods
Mobile App Static Analysis
- Hardcoded secrets: Strings analysis revealing API keys (
AKIA...), JWT tokens, OAuth client secrets.
- Insecure storage: Credentials in
SharedPreferences (Android), NSUserDefaults (iOS) without encryption.
- Exported components (Android): Activities/services/receivers exported without permission check.
- Insecure transit: Apps not enforcing TLS; cleartext traffic allowed.
Dynamic Analysis Detection
- Runtime manipulation: Frida-instrumented app accessing sensitive functions.
- Insecure IPC: Apps sharing sensitive data via Intent (Android) / URL scheme (iOS) without verification.
- WebView abuse: JavaScript bridge (
addJavascriptInterface) exposing sensitive functions.
SIEM Detection Rules
- Splunk SPL (mobile):
index=mobile sourcetype=apk:analysis | where permission matches "android.permission.SMS"
- MobSF (Mobile Security Framework): Automated static + dynamic analysis.
- NowSecure / Veracode Mobile: Commercial mobile app scanning.
Defense Evasion Techniques
Mobile Exploit Stealth
- Single-shot exploit: One exploit per app launch; below sustained-pattern detection.
- Memory-only execution: Run from RAM; no disk artifacts in
/data/data/<package>/.
- Use legitimate intents: Abuse exported components that look legitimate (e.g., share, profile).
Anti-Analysis
- Root/Jailbreak detection: Detect and exit if compromised (defender-side; red team needs to bypass).
- Frida/Xposed detection: Check for Frida server on port 27042; check for Xposed hooks.
- Emulator detection: Check for emulator-specific properties (
ro.kernel.qemu, iSimulator).
- SafetyNet / Play Integrity: Google's remote attestation; harder to bypass.
Persistence Stealth
- Device admin (Android): Use Device Admin for persistence; harder to remove.
- Accessibility service (Android): Use Accessibility for persistence; powerful and persistent.
- Background app refresh (iOS): Use Background App Refresh; killed less often.
Network Stealth
- Domain fronting: Use legitimate CDN for C2; appears as legitimate traffic.
- Protocol mimicry: C2 over legitimate-looking API (e.g., JSON to attacker's "analytics" endpoint).
- TLS fingerprinting: Match
okhttp / URLSession JA3 signature.
Orchestration
ECC Loop Pattern
- Pattern: Sequential Pipeline
- Rationale: Mobile security testing follows a sequential approach — decompile → analyze → hook → verify — where each phase builds on the previous
- Integration: codebase-onboarding (app structure understanding), browser-qa (WebView testing), verification-loop (finding confirmation)
Cross-Skill Pipeline
codebase-onboarding → mobile-security → verification-loop → article-writing
Quality Gate
- Pre-condition: Target APK/IPA available, testing environment configured
- Post-condition: All attack surfaces documented, findings independently verified
- Verification: Use verification-loop Phase 4 (independent confirmation with different tool)
Hacker Laws
| Law | Application in Mobile Security |
|---|
| First Principles | Don't rely on tools for one-click results; understand APK internal structure (DEX, Manifest, Resources) and Android runtime mechanisms. Only by understanding the underlying principles of Frida instrumentation can you write precise hook scripts |
| Trust but Verify | All client-side security checks can be bypassed. Root Detection, SSL Pinning, and Anti-Debug are delays, not barriers, to attackers. Defense design must assume the client has been fully compromised |
| Minimize Attack Surface | Every exported=true component is an entry point. Follow the principle of least privilege: disable unnecessary exported components, remove debuggable flags, prohibit cleartext traffic, and implement Certificate Pinning |
Learning Resources
This skill's supplementary files: payloads.md, test-cases.md
Related skills: skills/binary-reverse/SKILL.md, skills/web-xss/SKILL.md
External resources:
