菜单
Mobile application red team category — Android (APK) and iOS (IPA) pentest. Routing skill: identifies the platform + attack surface, then loads the matching sub-skill.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Benchmark mode marker — engagement objective is flag capture. Generic engagement rules apply unchanged.
Exploit Active Directory Certificate Services ESC1 — vulnerable template allows arbitrary SAN, enabling user impersonation up to domain admin.
BloodHound ingestion + canonical Cypher queries for AD attack-path enumeration. Run after collector dumps zip; promotes findings into the knowledge graph.
NetExec (CrackMapExec successor) — unified SMB/LDAP/MSSQL/WinRM/RDP/SSH/FTP/VNC protocol auth + post-auth modules. 200+ modules incl. BloodHound auto-ingest, ESC1-15 scanning, PrintNightmare, LDAP relay.
Active Directory attack lane — BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync, LAPS extraction.
Red team engagement lifecycle management — initiation, phase transitions, go/no-go gates, deconfliction, emergency procedures, completion.
| name | mobile |
| description | Mobile application red team category — Android (APK) and iOS (IPA) pentest. Routing skill: identifies the platform + attack surface, then loads the matching sub-skill. |
| allowed-tools | Bash Read Write |
| metadata | {"subdomain":"mobile","when_to_use":"mobile, android, ios, apk, ipa, app, smartphone, frida, objection, jadx, apktool, mobsf, ssl pinning, root detection, jailbreak, intent, deep link, url scheme, mobile pentest","tags":"mobile, android, ios, frida, jadx, apktool","mitre_attack":"T1517, T1640, T1418, T1409"} |
This is a routing skill. Identify the target platform and the relevant attack surface, then load the specialized sub-skill.
| Sub-Skill | Covers | When to Load |
|---|---|---|
| android | APK static (apktool/jadx) + dynamic (Frida/Objection), SSL pinning bypass, root detection bypass, intent fuzzing, keystore extraction, exported components | Android .apk file in scope, Play-Store target, MDM-managed Android device |
adb shell pm path <pkg>), or device pull (adb pull)standard/exploit/web/ once you have endpoints and tokens| Tool | Use |
|---|---|
apktool | Smali decompile / recompile / re-sign |
jadx | Java pseudocode from DEX |
frida / frida-tools | Runtime instrumentation |
objection | Frida wrapper — ready-made bypass scripts |
mobsf | Automated SAST+DAST first-pass triage |
drozer | IPC / exported-component fuzzer |
apksigner / zipalign | Re-sign modified APKs for re-install |
frida-ssl-pin-bypass | Universal SSL-pinning patches |
nox / genymotion / android-studio AVD | Emulators (x86_64 for speed) |
ios/) is on the roadmap — for iOS work today, leverage the same dynamic patterns (Frida + Objection) and load android/SKILL.md for the methodology since the analytical workflow is platform-agnostic./skills/standard/exploit/web/SKILL.md.