mobile-pentest

name	Mobile Pentest
description	Complete mobile penetration testing — ADB/SSH automation, device control, exploitation
tags	["mobile","pentest","android","ios","methodology","automation","adb","ssh"]

Task: Complete Mobile Penetration Testing. Systematic vulnerability assessment with device automation.

Phase 1: Device Connection

Android ADB Connection

Check ADB availability:
- Verify adb in PATH
- Check device connectivity: adb devices
- Test connection: adb shell echo "connected"

Configuration:
- Enable USB debugging
- Authorize computer
- Set ADB path (if custom)
- Port forwarding: adb forward tcp:8080 tcp:8080

Automation:
- Execute commands: adb shell <command>
- File transfer: adb push/pull
- Install APK: adb install app.apk
- Screen capture: adb screencap
- Logcat monitoring: adb logcat

iOS SSH/VNC Connection

Check jailbreak:
- Detect jailbreak: Cydia, Sileo, checkra1n
- Verify SSH: ssh root@localhost
- Default password: alpine

Configuration:
- Install OpenSSH (if missing)
- Change root password
- Setup VNC server
- Configure port forwarding

Automation:
- Execute commands: ssh root@device "command"
- File transfer: scp
- Install IPA: ssh root@device "installipa"
- Screen capture: VNC viewer
- Crash logs: /var/mobile/Library/Logs/CrashReporter/

Device Fingerprinting

Android:
- Device model: getprop ro.product.model
- Android version: getprop ro.build.version.release
- SDK version: getprop ro.build.version.sdk
- Security patch: getprop ro.build.version.security_patch
- SELinux status: getenforce
- Root status: which su

iOS:
- Device model: uname -m
- iOS version: sw_vers
- Jailbreak: cycript -c "Cydia"
- Architecture: uname -a
- Sandbox: ps aux

Phase 2: Automated Device Control

Android Device Automation

ADB shell automation:
# Install app
adb install -r app.apk

# Grant permissions
adb shell pm grant com.victim.app android.permission.READ_CONTACTS

# Start activity
adb shell am start -n com.victim.app/.MainActivity

# Broadcast intent
adb shell am broadcast -a com.victim.ACTION

# Content provider query
adb shell content query --uri content://com.victim.provider/data

# Extract app data
adb shell "run-as com.victim.app cat /data/data/com.victim.app/shared_prefs/settings.xml"

# Monitor logs
adb logcat | grep -i "vulnerability"

# Screen recording
adb screenrecord /sdcard/demo.mp4

iOS Device Automation

SSH automation:
# Install app
ssh root@device "installipa -i /tmp/app.ipa"

# Extract app data
ssh root@device "tar -czf /tmp/data.tar.gz /var/mobile/Containers/Data/Application/{UUID}/"
scp root@device:/tmp/data.tar.gz ./

# Monitor logs
ssh root@device "tail -f /var/log/syslog"

# Crash logs
ssh root@device "ls -la /var/mobile/Library/Logs/CrashReporter/"

# Keychain dump
ssh root@device "cat /var/Keychains/keychain-2.db > /tmp/keychain.db"

# Process list
ssh root@device "ps aux | grep VictimApp"

# SpringBoard restart
ssh root@device "killall SpringBoard"

Remote Control

Android:
- ADB input events: adb shell input tap x y
- Text input: adb shell input text "test"
- Key events: adb shell input keyevent KEYCODE_HOME
- Screenshot: adb shell screencap -p > screen.png

iOS (VNC):
- VNC connection: localhost:5900
- Screen control
- Touch simulation
- Text input
- App switching

Phase 3: Dynamic Analysis Automation

Frida Automation

Deploy Frida server:
# Android
adb push frida-server /data/local/tmp/
adb shell "chmod 755 /data/local/tmp/frida-server"
adb shell "/data/local/tmp/frida-server &"

# iOS
ssh root@device "frida-server &"

Frida scripts:
# Hook specific function
frida -U -f com.victim.app -l hook.js

# Spawn and attach
frida -U -f com.victim.app --no-pause

# Attach to running process
frida -U com.victim.app

# Load script
frida -U com.victim.app -l exploit.js

Traffic Interception

Setup proxy:
# Android
adb shell settings put global http_proxy 192.168.1.100:8080

# iOS (Wi-Fi proxy)
# Settings → Wi-Fi → (i) → HTTP Proxy → Manual

Certificate installation:
# Android
adb push burpca.crt /sdcard/
# Install via Settings → Security → Install from SD card

# iOS
# Email certificate, install via Settings
# Or: ssh root@device "cat burpca.crt > /etc/ssl/certs/"

Capture traffic:
# Burp Suite
# mitmproxy
# Proxyman

Phase 4: Automated Exploitation

Android Exploit Automation

Install malicious APK:
1. Compile exploit APK
2. adb install exploit.apk
3. Trigger vulnerability: adb shell am start
4. Monitor results: adb logcat
5. Extract data: adb pull /sdcard/exploit_output.txt

SQL injection automation:
adb shell "content query --uri content://com.victim.provider/data --projection 'name' --where 'name=\"'\" OR 1=1--\"'"

Intent hijacking:
adb shell am start -n com.victim.app/.VulnActivity -e "key", "malicious_payload"

Content provider exploitation:
adb shell "content call --uri content://com.victim.provider/data --method delete"

iOS Exploit Automation

Install exploit tweak:
1. Compile with Theos
2. make package
3. scp com.exploit.deb root@device:/tmp/
4. ssh root@device "dpkg -i /tmp/com.exploit.deb"
5. Respring: ssh root@device "killall -9 SpringBoard"

Keychain extraction:
ssh root@device "keychain_dumper > /tmp/keychain.txt"
scp root@device:/tmp/keychain.txt ./

Pasteboard monitoring:
ssh root@device "pasteboarddumper &"

Sandbox escape:
ssh root@device "kernel_exploit_payload"

Phase 5: Data Extraction Automation

Android Data Extraction

Extract app data:
adb backup -apk com.victim.app
# Extract: dd if=backup.ab bs=24 skip=1 | openssl zlib -d > backup.tar

Extract shared preferences:
adb shell "run-as com.victim.app ls /data/data/com.victim.app/shared_prefs/"
adb shell "run-as com.victim.app cat /data/data/com.victim.app/shared_prefs/settings.xml"

Extract databases:
adb shell "run-as com.victim.app cat /data/data/com.victim.app/databases/database.db > /sdcard/db.db"
adb pull /sdcard/db.db

Extract files:
adb pull /sdcard/Download/
adb shell "run-as com.victim.app ls -R /data/data/com.victim.app/files/"

iOS Data Extraction

Extract app container:
ssh root@device "tar -czf /tmp/app.tar.gz /var/mobile/Containers/Data/Application/{UUID}/"
scp root@device:/tmp/app.tar.gz ./

Extract Keychain:
ssh root@device "keychain_dump > /tmp/keychain.txt"
scp root@device:/tmp/keychain.txt ./

Extract Preferences:
ssh root@device "plutil -p /var/mobile/Containers/Data/Application/{UUID}/Library/Preferences/*.plist"

Extract cache:
ssh root@device "ls -la /var/mobile/Containers/Data/Application/{UUID}/Library/Caches/"

Phase 6: Automated Scanning

MobSF Automation

Docker setup:
docker run -it -p 8000:8000 opensecurity/mobile-security-framework-mobsf

Upload APK/IPA:
curl -X POST \
  -F "file=@app.apk" \
  http://localhost:8000/api/v1/scan

Get results:
curl http://localhost:8000/api/v1/scan/{scan_id}/results_pdf

Automation script:
#!/bin/bash
for apk in *.apk; do
    scan_id=$(curl -X POST -F "file=@$apk" http://localhost:8000/api/v1/scan | jq '.scan_id')
    curl http://localhost:8000/api/v1/scan/$scan_id/results_pdf > report_$apk.pdf
done

QARK Automation

Run QARK:
cd QARK
python qark.py --apk /path/to/app.apk

Automated analysis:
#!/bin/bash
for apk in *.apk; do
    python qark.py --apk $apk --report-type html
done

Phase 7: Reporting Automation

Generate Report

Collect findings:
- MobSF results
- QARK results
- Manual findings
- Exploit POCs
- Screenshots
- Log files

Generate HTML report:
python generate_report.py \
  --apk app.apk \
  --mobsf mobsf_results.json \
  --qark qark_report.html \
  --findings findings.json \
  --output report.html

Generate PDF:
wkhtmltopdf report.html report.pdf

Usage Examples

# Android pentest with ADB
/mobile-pentest
"Connect to Android device via ADB, install target APK, perform full security assessment including dynamic analysis and exploitation"

# iOS pentest with SSH
/mobile-pentest
"Connect to jailbroken iOS device via SSH, analyze target app, extract keychain data, develop sandbox escape exploit"

# Automated analysis
/mobile-pentest
"Run automated security analysis on this APK/IPA including MobSF scan, dynamic analysis with Frida, and exploit testing"

Configuration

{
  "android": {
    "adb_path": "/usr/local/bin/adb",
    "device_id": "emulator-5554",
    "enable_adb": true
  },
  "ios": {
    "ssh_host": "localhost",
    "ssh_port": 2222,
    "ssh_user": "root",
    "ssh_password": "alpine",
    "vnc_port": 5900,
    "enable_ssh": true
  },
  "automation": {
    "mobsf_url": "http://localhost:8000",
    "frida_server": true,
    "proxy": "192.168.1.100:8080"
  }
}

Safety Features

• Permission checks before connecting
• Safe command execution
• No destructive operations without confirmation
• Automatic device disconnect
• Backup before modifications