dragonjar-android-pentesting-skill

# DragonJAR Android Pentesting Skill > Skill by [ara.so](https://ara.so) — Security Skills collection. This skill provides comprehensive Android APK security analysis capabilities for AI agents, combining static analysis, dynamic instrumentation with Frida, RASP detection, authorized bypass validation, source-to-sink tracing, MASVS scoring, and professional reporting in a unified workflow. ## What This Skill Does Transforms an AI agent into an expert Android security auditor capable of: - **APK Analysis**: Decode APKs with APKTool, decompile with JADX, detect frameworks with APKiD - **Static Security Analysis**: 50+ manifest checks, 70+ Semgrep MASTG rules, secret detection, obfuscation analysis - **Dynamic Instrumentation**: 37 Frida scripts for SSL pinning bypass, root detection bypass, crypto interception - **Runtime Defense Analysis (RDA)**: Detect 18 protection categories (RootBeer, SafetyNet, Frida detection, RASP, etc.) - **RASP Bypass**: Authorized bypass runner with reusable profiles, DRY workflow - **Data Flow Tracing**: Source-to-sink methodology with confidence levels - **MASVS Compliance**: Automated scoring against OWASP MASVS controls with CVSS 4.0 - **APK Modification**: Smali patching, repackaging, signing, validation ## Installation ### Prerequisites Install required tools (Linux/macOS): ```bash # APKTool (3.0.1+) brew install apktool # JADX (1.5.5+) brew install jadx # Android SDK Platform Tools brew install --cask android-platform-tools # Frida (17.9+) pip3 install frida-tools # Objection (1.12.4+) pip3 install objection # APKiD (3.0.0+) pip3 install apkid # Semgrep (optional, for SAST) brew install semgrep ``` ### Skill Installation ```bash # Clone into your agent's skills directory cd ~/.agents/skills/ git clone https://github.com/DragonJAR/Android-Pentesting-Skill dragonjar-android-pentesting # Or clone to any location and add to agent skill path git clone https://github.com/DragonJAR/Android-Pentesting-Skill.git ``` ### Verification ```bash # Verify all dependencies are installed cd dragonjar-android-pentesting python3 scripts/06-setup/preflight-check.py # Expected output: # ✅ APKTool 3.0.1 found # ✅ JADX 1.5.5 found # ✅ Frida 17.9.4 found # ✅ All dependencies satisfied ``` ## Core Workflows ### 1. Basic APK Security Audit ```bash # Full static analysis with Semgrep enrichment bash scripts/auto-audit-static.sh /path/to/app.apk --semgrep # Output includes: # - Manifest security issues (exported components, permissions) # - Hardcoded secrets (API keys, passwords, tokens) # - Insecure crypto usage # - WebView vulnerabilities # - Intent injection risks # - Findings report in findings-merged.json ``` **Example findings output:** ```json { "findings": [ { "id": "HARD-001", "severity": "CRITICAL", "title": "Hardcoded API Key in Source Code", "owasp_mobile": "M1", "masvs_control": "MASVS-STORAGE-1", "cvss": "9.1 (CRITICAL)", "location": "com/example/app/Config.java:42", "evidence": "private static final String API_KEY = \"sk_live_...\";", "remediation": "Store API keys in BuildConfig or secure server-side configuration" } ] } ``` ### 2. Runtime Defense Analysis (RASP Detection) ```bash # Detect runtime protections with passive + active modes bash scripts/02-rasp/runtime-defense-analyzer.sh \ /path/to/app.apk \ com.example.app \ --active-mode \ --authorized-lab \ --output findings-rda.json # Catalog includes 18 protection categories: # - Root detection (RootBeer, custom native) # - Emulator detection # - Debug detection # - Frida/instrumentation detection # - Screenshot/screenrecord blocking # - SafetyNet / Play Integrity # - Commercial RASP (Talsec, AppSealing, DexGuard, etc.) ``` **RDA output structure:** ```json { "detectors": { "rootbeer": { "status": "DETECTED", "confidence": "high", "evidence": "RootBeer.isRooted() returns true", "bypass_profile": "rootbeer_standard" }, "ssl_pinning": { "status": "DETECTED", "implementation": "OkHttp3 CertificatePinner", "bypass_profile": "ssl_okhttp3" } } } ``` ### 3. RASP Bypass Workflow (DRY Pattern) ```bash # 1) List available bypass profiles bash scripts/02-rasp/rasp-bypass-runner.sh --list-profiles # Output: # Available profiles: # - rootbeer_standard (RootBeer library bypass) # - ssl_okhttp3 (OkHttp3 SSL pinning) # - ssl_trustmanager (TrustManager bypass) # - frida_detection (Anti-Frida bypass) # - emulator_detection (Emulator checks bypass) # 2) Generate bypass command from RDA findings (print only) bash scripts/02-rasp/rasp-bypass-runner.sh \ --package com.example.app \ --from-rda findings-rda.json \ --print-command # Output: # frida -U -f com.example.app \ # -l assets/frida-scripts/android-root-bypass-advanced.js \ # -l assets/frida-scripts/ssl-pinning-bypass.js \ # --no-pause # 3) Execute bypass in authorized lab environment bash scripts/02-rasp/rasp-bypass-runner.sh \ --package com.example.app \ --from-rda findings-rda.json \ --run \ --authorized-lab # Launches Frida with combined bypass scripts ``` **Important**: Client-side bypasses do NOT forge server-side attestation. For Play Integrity, SafetyNet, Approov, or similar backend-enforced controls, use an authorized test tenant, backend allowlist, or approved lab configuration. ### 4. SSL Pinning Bypass ```bash # Universal SSL pinning bypass (30+ implementations) python3 scripts/07-tools/frida-exploit-helper.py \ -p com.example.app \ --script ssl-pinning-bypass # Supports: # - OkHttp3 CertificatePinner # - TrustManager custom implementations # - WebView SSL error handlers # - React Native ssl-pinning libraries # - Flutter BoringSSL (native hooks) # - Cordova SSL plugins ``` ### 5. Framework-Specific Analysis #### React Native ```bash # Detect React Native and extract JavaScript bundle bash scripts/auto-audit-static.sh /path/to/app.apk # Automatically: # - Detects libreactnativejni.so # - Extracts assets/index.android.bundle # - Scans bundle for hardcoded secrets # - Analyzes Metro bundler output ``` **Hook React Native bridge:** ```javascript // assets/frida-scripts/react-native-bridge-hook.js Java.perform(function() { var CatalystInstanceImpl = Java.use('com.facebook.react.bridge.CatalystInstanceImpl'); CatalystInstanceImpl.jniCallJSFunction.implementation = function(module, method, args) { console.log('[RN Bridge] ' + module + '.' + method); console.log('[RN Bridge] Args: ' + JSON.stringify(args)); return this.jniCallJSFunction(module, method, args); }; }); ``` #### Flutter ```bash # Flutter uses Dart AOT compilation and native BoringSSL # Standard Java SSL hooks won't work # Use Blutter for Dart code extraction python3 tools/blutter/blutter.py lib/arm64-v8a/libapp.so output/ # Hook native SSL functions python3 scripts/07-tools/frida-exploit-helper.py \ -p com.example.flutter \ --script flutter-ssl-bypass # Hooks: # - SSL_CTX_set_custom_verify (certificate validation) # - SSL_read / SSL_write (traffic interception) ``` ### 6. Data Flow Tracing ```bash # Phase 3: Source-to-sink analysis # Automatically runs during static audit # Example traced flows: # - User input → SQL query (SQL injection risk) # - Intent extras → WebView.loadUrl (open redirect) # - SharedPreferences → network (data leakage) # - File paths → external storage (path traversal) ``` **Flow confidence levels:** - `CONFIRMED`: Direct observable flow without conditions - `LIKELY`: Flow with minimal conditional branches - `POSSIBLE`: Flow through complex logic, needs dynamic validation ### 7. MASVS Compliance Scoring ```bash # Calculate OWASP MASVS compliance score python3 scripts/05-reporting/masvs-scorer.py findings-merged.json # Output: # MASVS Score: 72.6/100 (Grade: C) # Controls Passed: 16/23 # Controls Failed: 7 # # Critical Failures: # - MASVS-STORAGE-1: Hardcoded secrets in code # - MASVS-CRYPTO-1: Weak cryptographic algorithms # # Recommendations: # - Implement secure credential storage (Android Keystore) # - Upgrade to AES-256-GCM for encryption ``` ### 8. APK Modification Workflow ```bash # Decode APK apktool d -f -o decoded/ /path/to/app.apk # Modify smali code (example: disable root check) # Edit decoded/smali/com/app/RootDetector.smali # Change: const/4 v0, 0x1 (return true) # To: const/4 v0, 0x0 (return false) # Rebuild APK apktool b decoded/ -o app-modified.apk # Align and sign zipalign -v -p 4 app-modified.apk app-aligned.apk apksigner sign --ks ~/.android/debug.keystore \ --ks-pass pass:android \ --out app-signed.apk \ app-aligned.apk # Verify signature apksigner verify --verbose app-signed.apk ``` ## Frida Script Library ### Common Frida Operations ```bash # List all available Frida scripts ls assets/frida-scripts/ # Key scripts: # - ssl-pinning-bypass.js (universal SSL bypass) # - android-root-bypass-advanced.js (30+ root detection bypasses) # - crypto-intercept.js (monitor Cipher, MessageDigest, etc.) # - biometric-bypass.js (BiometricPrompt, FingerprintManager) # - keystore-inspector.js (dump Keystore entries) # - webview-inspector.js (WebView debugging, JS injection) # - intent-fuzzer.js (Intent injection testing) ``` ### Frida Exploit Helper ```bash # List bundled scripts python3 scripts/07-tools/frida-exploit-helper.py --list-scripts # Hook memory functions python3 scripts/07-tools/frida-exploit-helper.py \ -p com.example.app \ --hook malloc,free,memcpy # SSL pinning bypass python3 scripts/07-tools/frida-exploit-helper.py \ -p com.example.app \ --script ssl-pinning-bypass # Memory layout analysis python3 scripts/07-tools/frida-exploit-helper.py \ -p com.example.app \ --layout # Runtime defense detection python3 scripts/07-tools/frida-exploit-helper.py \ -p com.example.app \ --runtime-defense ``` ### Custom Frida Script Example ```javascript // Hook custom native function Java.perform(function() { var targetClass = Java.use('com.example.app.SecurityCheck'); targetClass.isDeviceSecure.implementation = function() { console.log('[+] isDeviceSecure() called'); var result = this.isDeviceSecure(); console.log('[+] Original result: ' + result); console.log('[+] Forcing return: true'); return true; }; console.log('[+] Hooked isDeviceSecure()'); }); ``` ## Configuration ### Environment Variables ```bash # Android SDK path export ANDROID_HOME="$HOME/Library/Android/sdk" export PATH="$PATH:$ANDROID_HOME/platform-tools:$ANDROID_HOME/build-tools/36.0.0" # Frida server configuration export FRIDA_SERVER_PORT=27042 # Optional: Semgrep API token for managed scanning export SEMGREP_APP_TOKEN="your_token_here" # Optional: Custom APKTool config export APKTOOL_CONFIG="$HOME/.apktool/config.yml" ``` ### Bypass Profiles Configuration ```json // scripts/02-rasp/bypass-profiles.json { "profiles": { "rootbeer_standard": { "description": "RootBeer library bypass", "scripts": [ "assets/frida-scripts/android-root-bypass-advanced.js" ], "hooks": ["RootBeer.isRooted", "RootBeer.isRootedWithoutBusyBoxCheck"] }, "ssl_okhttp3": { "description": "OkHttp3 CertificatePinner bypass", "scripts": [ "assets/frida-scripts/ssl-pinning-bypass.js" ], "hooks": ["CertificatePinner.check"] } } } ``` ## Common Patterns ### Pattern 1: Full Security Assessment ```bash # 1) Static analysis with Semgrep bash scripts/auto-audit-static.sh app.apk --semgrep # 2) Runtime defense detection bash scripts/02-rasp/runtime-defense-analyzer.sh \ app.apk com.example.app \ --active-mode --authorized-lab \ --output findings-rda.json # 3) MASVS scoring python3 scripts/05-reporting/masvs-scorer.py findings-merged.json # 4) Generate professional report python3 scripts/05-reporting/report-generator.py \ findings-merged.json \ findings-rda.json \ --output report.pdf ``` ### Pattern 2: Traffic Interception ```bash # 1) Set up proxy (Burp/ZAP)