Skip to main content Skills Marketplace Descubre y explora habilidades de IA creadas por la comunidad.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Mostrar detalles del prompt Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/Aradotso/security-skills --skill dragonjar-android-pentesting-skillEl comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
Descargar Zip Descargando... Ocupaciones relacionadas SOC
Basado en la clasificación ocupacional SOC
name dragonjar-android-pentesting-skill description Comprehensive Android APK security analysis with static/dynamic testing, RASP detection, Frida instrumentation, and MASVS compliance scoring triggers ["audit this Android APK for security vulnerabilities","analyze this APK with MASVS scoring and runtime defense analysis","bypass SSL pinning and root detection in this Android app","detect RASP protections and generate Frida bypass scripts","decompile this APK and find hardcoded secrets","run static and dynamic analysis on this Android application","trace data flows and validate security controls in this APK","generate a pentesting report for this Android app"]
DragonJAR Android Pentesting Skill
Skill by ara.so — Security Skills collection.
This skill provides comprehensive Android APK security analysis capabilities for AI agents, combining static analysis, dynamic instrumentation with Frida, RASP detection, authorized bypass validation, source-to-sink tracing, MASVS scoring, and professional reporting in a unified workflow.
What This Skill Does
Transforms an AI agent into an expert Android security auditor capable of:
APK Analysis : Decode APKs with APKTool, decompile with JADX, detect frameworks with APKiDStatic Security Analysis : 50+ manifest checks, 70+ Semgrep MASTG rules, secret detection, obfuscation analysisDynamic Instrumentation : 37 Frida scripts for SSL pinning bypass, root detection bypass, crypto interceptionRuntime Defense Analysis (RDA) : Detect 18 protection categories (RootBeer, SafetyNet, Frida detection, RASP, etc.)RASP Bypass : Authorized bypass runner with reusable profiles, DRY workflow
Data Flow Tracing : Source-to-sink methodology with confidence levels
MASVS Compliance : Automated scoring against OWASP MASVS controls with CVSS 4.0
APK Modification : Smali patching, repackaging, signing, validation
Installation
Prerequisites Install required tools (Linux/macOS):
brew install apktool
brew install jadx
brew install --cask android-platform-tools
pip3 install frida-tools
pip3 install objection
pip3 install apkid
brew install semgrep
Skill Installation
cd ~/.agents/skills/
git clone https://github.com/DragonJAR/Android-Pentesting-Skill dragonjar-android-pentesting
git clone https://github.com/DragonJAR/Android-Pentesting-Skill.git
Verification
cd dragonjar-android-pentesting
python3 scripts/06-setup/preflight-check.py
Core Workflows
1. Basic APK Security Audit
bash scripts/auto-audit-static.sh /path/to/app.apk --semgrep
{
"findings" : [
{
"id" : "HARD-001" ,
"severity" : "CRITICAL" ,
"title" : "Hardcoded API Key in Source Code" ,
"owasp_mobile" : "M1" ,
"masvs_control" : "MASVS-STORAGE-1" ,
"cvss" : "9.1 (CRITICAL)" ,
"location" : "com/example/app/Config.java:42" ,
"evidence" : "private static final String API_KEY = \"sk_live_...\";" ,
"remediation" : "Store API keys in BuildConfig or secure server-side configuration"
}
]
}
2. Runtime Defense Analysis (RASP Detection)
bash scripts/02-rasp/runtime-defense-analyzer.sh \
/path/to/app.apk \
com.example.app \
--active-mode \
--authorized-lab \
--output findings-rda.json
{
"detectors" : {
"rootbeer" : {
"status" : "DETECTED" ,
"confidence" : "high" ,
"evidence" : "RootBeer.isRooted() returns true" ,
"bypass_profile" : "rootbeer_standard"
} ,
"ssl_pinning" : {
"status" : "DETECTED" ,
"implementation" : "OkHttp3 CertificatePinner" ,
"bypass_profile" : "ssl_okhttp3"
}
}
}
3. RASP Bypass Workflow (DRY Pattern)
bash scripts/02-rasp/rasp-bypass-runner.sh --list-profiles
bash scripts/02-rasp/rasp-bypass-runner.sh \
--package com.example.app \
--from-rda findings-rda.json \
--print-command
bash scripts/02-rasp/rasp-bypass-runner.sh \
--package com.example.app \
--from-rda findings-rda.json \
--run \
--authorized-lab
Important : Client-side bypasses do NOT forge server-side attestation. For Play Integrity, SafetyNet, Approov, or similar backend-enforced controls, use an authorized test tenant, backend allowlist, or approved lab configuration.
4. SSL Pinning Bypass
python3 scripts/07-tools/frida-exploit-helper.py \
-p com.example.app \
--script ssl-pinning-bypass
5. Framework-Specific Analysis
React Native
bash scripts/auto-audit-static.sh /path/to/app.apk
Hook React Native bridge:
Java .perform (function (var CatalystInstanceImpl = Java .use ('com.facebook.react.bridge.CatalystInstanceImpl' );
CatalystInstanceImpl .jniCallJSFunction .implementation = function (module , method, argsconsole .log ('[RN Bridge] ' + module + '.' + method);
console .log ('[RN Bridge] Args: ' + JSON .stringify (args));
return this .jniCallJSFunction (module , method, args);
};
});
Flutter
python3 tools/blutter/blutter.py lib/arm64-v8a/libapp.so output/
python3 scripts/07-tools/frida-exploit-helper.py \
-p com.example.flutter \
--script flutter-ssl-bypass
6. Data Flow Tracing
CONFIRMED: Direct observable flow without conditionsLIKELY: Flow with minimal conditional branchesPOSSIBLE: Flow through complex logic, needs dynamic validation
7. MASVS Compliance Scoring
python3 scripts/05-reporting/masvs-scorer.py findings-merged.json
8. APK Modification Workflow
apktool d -f -o decoded/ /path/to/app.apk
apktool b decoded/ -o app-modified.apk
zipalign -v -p 4 app-modified.apk app-aligned.apk
apksigner sign --ks ~/.android/debug.keystore \
--ks-pass pass:android \
--out app-signed.apk \
app-aligned.apk
apksigner verify --verbose app-signed.apk
Frida Script Library
Common Frida Operations
Frida Exploit Helper
python3 scripts/07-tools/frida-exploit-helper.py --list-scripts
python3 scripts/07-tools/frida-exploit-helper.py \
-p com.example.app \
--hook malloc,free,memcpy
python3 scripts/07-tools/frida-exploit-helper.py \
-p com.example.app \
--script ssl-pinning-bypass
python3 scripts/07-tools/frida-exploit-helper.py \
-p com.example.app \
--layout
python3 scripts/07-tools/frida-exploit-helper.py \
-p com.example.app \
--runtime-defense
Custom Frida Script Example
Java .perform (function (var targetClass = Java .use ('com.example.app.SecurityCheck' );
targetClass.isDeviceSecure .implementation = function (console .log ('[+] isDeviceSecure() called' );
var result = this .isDeviceSecure ();
console .log ('[+] Original result: ' + result);
console .log ('[+] Forcing return: true' );
return true ;
};
console .log ('[+] Hooked isDeviceSecure()' );
});
Configuration
Environment Variables
export ANDROID_HOME="$HOME /Library/Android/sdk"
export PATH="$PATH :$ANDROID_HOME /platform-tools:$ANDROID_HOME /build-tools/36.0.0"
export FRIDA_SERVER_PORT=27042
export SEMGREP_APP_TOKEN="your_token_here"
export APKTOOL_CONFIG="$HOME /.apktool/config.yml"
Bypass Profiles Configuration
{
"profiles" : {
"rootbeer_standard" : {
"description" : "RootBeer library bypass" ,
"scripts" : [
"assets/frida-scripts/android-root-bypass-advanced.js"
] ,
"hooks" : [ "RootBeer.isRooted" , "RootBeer.isRootedWithoutBusyBoxCheck" ]
} ,
"ssl_okhttp3" : {
"description" : "OkHttp3 CertificatePinner bypass" ,
"scripts" : [
"assets/frida-scripts/ssl-pinning-bypass.js"
] ,
"hooks" : [ "CertificatePinner.check" ]
}
}
}
Common Patterns
Pattern 1: Full Security Assessment
bash scripts/auto-audit-static.sh app.apk --semgrep
bash scripts/02-rasp/runtime-defense-analyzer.sh \
app.apk com.example.app \
--active-mode --authorized-lab \
--output findings-rda.json
python3 scripts/05-reporting/masvs-scorer.py findings-merged.json
python3 scripts/05-reporting/report-generator.py \
findings-merged.json \
findings-rda.json \
--output report.pdf
Pattern 2: Traffic Interception
export HTTP_PROXY=127.0.0.1:8080
export HTTPS_PROXY=127.0.0.1:8080
adb push burp-ca.crt /sdcard/
frida -U -f com.example.app \
-l assets/frida-scripts/ssl-pinning-bypass.js \
--no-pause
Pattern 3: Root Detection Bypass Stack
frida -U -f com.example.app \
-l assets/frida-scripts/android-root-bypass-advanced.js \
--no-pause
frida -U -f com.example.app \
-l assets/frida-scripts/android-root-bypass-advanced.js \
-l assets/frida-scripts/native-hook.js \
--no-pause
Pattern 4: Automated Secret Extraction
bash scripts/01-decompile/extract-strings.sh app.apk > strings.txt
grep -E '(sk_live_|ghp_|AIza[0-9A-Za-z-_]{35})' strings.txt
find decoded/smali -name "*.smali" -exec grep -H "const-string.*sk_live" {} \;
find decoded/assets -name "*.bundle" -o -name "*.js" | \
xargs grep -E '(API_KEY|SECRET|PASSWORD).*=.*["\' ][^"\']{20,}'
Troubleshooting
Issue: APKTool Decode Fails
brew upgrade apktool
apktool d --only-main-classes -f -o decoded/ app.apk
apktool d --use-aapt1 -f -o decoded/ app.apk
Issue: Frida Server Connection Failed
adb shell "su -c '/data/local/tmp/frida-server &'"
frida --version
adb shell "/data/local/tmp/frida-server --version"
frida -U -f com.example.app
frida -U com.example.app
Issue: SSL Pinning Bypass Not Working
frida -U -f com.example.flutter \
-l assets/frida-scripts/flutter-ssl-bypass.js
frida -U -f com.example.rn \
-l assets/frida-scripts/ssl-pinning-bypass.js \
-l assets/frida-scripts/native-hook.js
Issue: Runtime Defense Analysis Returns Empty Results
bash scripts/02-rasp/runtime-defense-analyzer.sh \
app.apk com.example.app \
--active-mode \
--authorized-lab \
--output findings-rda.json
adb devices
adb shell "su -c 'pm list packages | grep example'"
Issue: MASVS Scorer Shows Low Score
python3 scripts/05-reporting/masvs-scorer.py findings-merged.json --verbose
Agent Usage Examples
Example 1: Quick APK Audit User : "Audit this APK: ~/Downloads/banking-app.apk"
cd dragonjar-android-pentesting
bash scripts/auto-audit-static.sh ~/Downloads/banking-app.apk --semgrep
python3 scripts/05-reporting/masvs-scorer.py findings-merged.json
Agent Response : "Found 8 security issues: 2 CRITICAL (hardcoded API keys), 3 HIGH (exported activities without permissions), 2 MEDIUM (weak crypto), 1 LOW (debug logs). MASVS score: 68.2/100 (Grade: D). Report saved to findings-merged.json."
Example 2: Bypass SSL Pinning User : "This banking app has SSL pinning. I need to intercept the login request."
python3 scripts/07-tools/frida-exploit-helper.py \
-p com.banking.app \
--script ssl-pinning-bypass
Agent Response : "SSL pinning bypassed (OkHttp3 CertificatePinner detected). Configure your proxy (Burp/ZAP) to 127.0.0.1:8080. Restart the app and attempt login."
Example 3: Detect RASP Protections User : "Check what runtime protections this app has."
bash scripts/02-rasp/runtime-defense-analyzer.sh \
~/Downloads/app.apk com.protected.app \
--active-mode --authorized-lab \
--output findings-rda.json
cat findings-rda.json
Agent Response : "Detected 4 protections: RootBeer (root detection), custom emulator checks, Frida detection (anti-instrumentation), DexGuard obfuscation. Bypass profiles available: rootbeer_standard, frida_detection, emulator_detection. Run rasp-bypass-runner.sh to generate bypass command."
Example 4: Find Hardcoded Secrets in React Native User : "This is a React Native app. Find any hardcoded API keys in the JavaScript bundle."
bash scripts/auto-audit-static.sh ~/Downloads/rn-app.apk
grep -r "API_KEY\|api_key\|apiKey" decoded/assets/*.bundle
Agent Response : "Found 3 hardcoded secrets in assets/index.android.bundle: Firebase API key (line 4521), Stripe publishable key (line 8912), AWS access key ID (line 12045). Evidence saved to findings-merged.json with MASVS-STORAGE-1 control failure."
Advanced Topics
Native Code Analysis
unzip app.apk "lib/*" -d native/
python3 scripts/07-tools/frida-exploit-helper.py \
-p com.example.app \
--hook JNI_OnLoad,RegisterNatives
frida -U -f com.example.app -l - << 'EOF'
var base = Module.findBaseAddress('libnative.so' );
Interceptor.attach(base.add(0x1234), {
onEnter: function (args) {
console.log('[+] Native function called' );
console.log('Arg0: ' + args[0]);
}
});
EOF
Attestation Bypass Limitations **Important** : Client-side hooks cannot forge server-verified attestation:
- ❌ Play Integrity verdicts (Google server-signed)
- ❌ SafetyNet attestation responses
- ❌ Approov tokens (server-side verification)
- ❌ App Attest (Apple server validation)
**Authorized Testing Approaches** :
- ✅ Use test tenant with backend allowlist
- ✅ Configure mock verifier in staging environment
- ✅ Request official pentest exception from vendor
- ✅ Use approved lab environment with vendor cooperation
Custom Semgrep Rules
rules:
- id: custom-api-key-pattern
pattern: |
const-string $VAR, "cust_$KEY"
message: Custom API key pattern detected
severity: ERROR
languages: [smali ]
metadata:
owasp_mobile: M1
masvs_control: MASVS-STORAGE-1
References
License Apache 2.0 - See LICENSE file for details.
