ワンクリックでManusで任意のスキルを実行

pentest-mobile

スター5

フォーク2

更新日2026年6月9日 03:59

Android and iOS mobile application penetration testing using OWASP MASTG and MASVS. Use when the user mentions APK/IPA analysis, Frida hooking, Objection, jadx, MobSF, SSL pinning bypass, root/jailbreak detection bypass, Android exported components, iOS URL schemes / Universal Links, Keystore/Keychain, MASVS-* identifiers, or any mobile static/dynamic analysis task.

インストール

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

Manusで実行

ソース

thau0x01

thau0x01/ai-pentest-kb

GitHub リポジトリを開く Creator のリポジトリを見る

ダウンロード

Manusで実行

Pentest — Mobile (Android + iOS)

Apply 02-mobile/ from the pentest-templates library.

Library root

$PENTEST_LIBRARY — caminho absoluto deste repositório clonado (definido pelo instalador; veja INSTALL.md).

Read 02-mobile/00-overview.md first, then walk numbered files.

Phase order

02-mobile/01-static-analysis.md — manifest, secrets, libs, signing.
02-mobile/02-dynamic-analysis.md — Frida, Burp interception, runtime hooking.
02-mobile/03-storage.md — MASVS-STORAGE.
02-mobile/04-cryptography.md — MASVS-CRYPTO.
02-mobile/05-authentication.md — MASVS-AUTH.
02-mobile/06-network.md — MASVS-NETWORK, TLS, pinning.
02-mobile/07-platform-android.md — IPC, intents, deep links, WebView.
02-mobile/08-platform-ios.md — URL schemes, Universal Links, App Groups, WKWebView.
02-mobile/09-resilience.md — root/jailbreak detection, anti-RE.
02-mobile/10-code.md — build hygiene, dependency CVEs.
02-mobile/11-privacy.md — data minimisation, consent.

How to operate

Confirm artefact (APK/AAB/IPA) hash, build flavour, target OS levels.
Static-first: pull manifests, signing, secrets, third-party libs from the static-analysis checklist before running dynamic.
Dynamic: Frida server matching desktop Frida version; Burp/mitmproxy CA installed in user store + system-CA bypass for Android 7+.
For each user question, locate the matching MAS-TEST item (stable ID per file) and follow its Methodology + How to test.
Backend API surface → also use pentest-web-api. IoT companion app → also use pentest-iot-ot.

When NOT to use

Pure backend API → pentest-web-api.
IoT device with companion app → use this skill for the app and pentest-iot-ot for device + radio.

Pre-conditions

Rooted Android (Pixel + Magisk + LSPosed) and/or jailbroken iOS device.
Frida server running on device matching desktop Frida version.
Burp / mitmproxy with CA pinned + user-store install + system-CA bypass.

OPSEC

Engagement-only redistribution of decrypted IPAs.
Production user data: capture metadata only unless ROE permits sample extraction.

References inside the library

Cheatsheet: cheatsheets/mobile.md.
Tooling: tools/install-mobile.md, tool-mappings/02-mobile-tools.md.
Frameworks: frameworks/owasp-masvs.md, frameworks/owasp-mastg.md, frameworks/mitre-attack-mobile.md.
Playbook: playbooks/05-mobile-pentest-day-by-day.md.

このリポジトリの他の Skills

同じリポジトリ

engagement-management

thau0x01/ai-pentest-kb

Engagement-lifecycle management — pre-engagement scoping, ROE drafting, authorisation letters, threat modeling, CVSS scoring, finding write-up, executive summary, technical report, retest scoping, remediation validation. Use when the user mentions scope a pentest, ROE template, rules of engagement, get-out-of-jail letter, authorisation letter, scope statement, communications plan, blackout window, escalation matrix, threat modeling, STRIDE, PASTA, attack tree, threat actor profile, CVSS scoring, finding template, executive summary, technical report, retest, remediation validation, regression coverage, engagement kickoff, or evidence chain of custody.

2026-06-095

engagement-retest

thau0x01/ai-pentest-kb

Plan and execute a pentest retest — re-scope, re-execute the validation steps from prior findings, detect regressions, and write the retest report. Use when the user mentions retest, re-test, remediation validation, regression coverage, "verify the fixes", "validate remediation", retest scoping, retest report, posture trajectory, or compares "before vs after" findings.

2026-06-095

engagement-scoping

thau0x01/ai-pentest-kb

Drive the pre-engagement scoping conversation and produce the scope statement, Rules of Engagement, authorisation letter, and communications plan. Use when the user mentions kickoff, scoping a pentest, drafting ROE, rules of engagement, scope statement, authorisation letter, get-out-of-jail letter, communications plan, blackout window, escalation matrix, ROE drift, third-party hosting carve-out, social-engineering allowance, time-window restrictions, or evidence-handling rules.

2026-06-095

pentest-active-directory

thau0x01/ai-pentest-kb

Active Directory and hybrid Entra ID penetration testing. Use when the user mentions BloodHound, SharpHound, SOAPHound, AzureHound, RustHound, Kerberoast, AS-REP roast, Golden/Silver/Diamond/Sapphire ticket, DCSync, DCShadow, NTLM relay, ntlmrelayx, ADCS ESC1-ESC15+, EKUwu, Certipy, ACL abuse (GenericAll/WriteDACL/WriteOwner/shadow credentials), GPO abuse, NoPac, ZeroLogon, PetitPotam, DFSCoerce, PrinterBug, krbrelayup, AAD Connect, MSOL_, Pass-Through Auth, Seamless SSO, AdminSDHolder, SID History, krbtgt, or any "domain compromise" task.

2026-06-095

pentest-ai-llm

thau0x01/ai-pentest-kb

LLM-backed application, AI agent, and AI/ML supply-chain penetration testing. Use when the user mentions LLM pentest, AI red team, prompt injection (direct or indirect), jailbreak, DAN, Crescendo, GCG, many-shot jailbreak, system prompt leakage, RAG poisoning, embedding poisoning/inversion, vector DB attack, MCP / Model Context Protocol abuse, tool poisoning, agent excessive agency, function-call abuse, output handling chains (XSS/SSRF/SQLi via LLM output), training-data extraction, membership inference, modelscan/picklescan, Hugging Face poisoned model, garak, PyRIT, promptmap, Augustus, Spikee, OWASP LLM01-LLM10, MITRE ATLAS, or unbounded consumption / cost amplification.

2026-06-095

pentest-cheatsheet

thau0x01/ai-pentest-kb

Surface a one-page pentest cheatsheet for fast field recall. Use when the user asks for a "quick command", "cheatsheet", "one-liner", "what's the syntax for X", "remind me how to do Y", "give me the recon snippets", "AD cheatsheet", "lateral-movement one-liners", "AWS quick commands", "Azure quick commands", "mobile cheatsheet", "initial access cheatsheet", or any request that wants tools/commands without methodology overhead.

2026-06-095

name	pentest-mobile
description	Android and iOS mobile application penetration testing using OWASP MASTG and MASVS. Use when the user mentions APK/IPA analysis, Frida hooking, Objection, jadx, MobSF, SSL pinning bypass, root/jailbreak detection bypass, Android exported components, iOS URL schemes / Universal Links, Keystore/Keychain, MASVS-* identifiers, or any mobile static/dynamic analysis task.

Pentest — Mobile (Android + iOS)

Apply 02-mobile/ from the pentest-templates library.

Library root

$PENTEST_LIBRARY — caminho absoluto deste repositório clonado (definido pelo instalador; veja INSTALL.md).

Read 02-mobile/00-overview.md first, then walk numbered files.

Phase order

02-mobile/01-static-analysis.md — manifest, secrets, libs, signing.
02-mobile/02-dynamic-analysis.md — Frida, Burp interception, runtime hooking.
02-mobile/03-storage.md — MASVS-STORAGE.
02-mobile/04-cryptography.md — MASVS-CRYPTO.
02-mobile/05-authentication.md — MASVS-AUTH.
02-mobile/06-network.md — MASVS-NETWORK, TLS, pinning.
02-mobile/07-platform-android.md — IPC, intents, deep links, WebView.
02-mobile/08-platform-ios.md — URL schemes, Universal Links, App Groups, WKWebView.
02-mobile/09-resilience.md — root/jailbreak detection, anti-RE.
02-mobile/10-code.md — build hygiene, dependency CVEs.
02-mobile/11-privacy.md — data minimisation, consent.

How to operate

Confirm artefact (APK/AAB/IPA) hash, build flavour, target OS levels.
Static-first: pull manifests, signing, secrets, third-party libs from the static-analysis checklist before running dynamic.
Dynamic: Frida server matching desktop Frida version; Burp/mitmproxy CA installed in user store + system-CA bypass for Android 7+.
For each user question, locate the matching MAS-TEST item (stable ID per file) and follow its Methodology + How to test.
Backend API surface → also use pentest-web-api. IoT companion app → also use pentest-iot-ot.

When NOT to use

Pure backend API → pentest-web-api.
IoT device with companion app → use this skill for the app and pentest-iot-ot for device + radio.

Pre-conditions

Rooted Android (Pixel + Magisk + LSPosed) and/or jailbroken iOS device.
Frida server running on device matching desktop Frida version.
Burp / mitmproxy with CA pinned + user-store install + system-CA bypass.

OPSEC

Engagement-only redistribution of decrypted IPAs.
Production user data: capture metadata only unless ROE permits sample extraction.

References inside the library

Cheatsheet: cheatsheets/mobile.md.
Tooling: tools/install-mobile.md, tool-mappings/02-mobile-tools.md.
Frameworks: frameworks/owasp-masvs.md, frameworks/owasp-mastg.md, frameworks/mitre-attack-mobile.md.
Playbook: playbooks/05-mobile-pentest-day-by-day.md.