菜单
Mobile application security testing — Android (smali, Frida, IL2CPP, Flutter AOT, React Native/Hermes, root detection), iOS (jailbreak, Objection).
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Threat Intelligence Report Design System — ReportLab-based PDF generation for A4 reports with Transilience branding, typography, and layout standards.
Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion.
Cloud and container security testing - AWS, Azure, GCP, Docker, and Kubernetes misconfigurations and exploitation.
Detect and break the cloud post-compromise attack chain (AWS / Azure / GCP) — per-stage CloudTrail / Activity-Log / Audit-Log detection signals and the preventive controls that close each step. Use for cloud detection engineering, hardening, remediation write-ups, or blue-team posture review of the lateral-movement -> privilege-escalation -> exfiltration -> evasion chain.
HackTheBox platform operations and automations to solve challenges, machines and capture the flags hacking competitions
Injection vulnerability testing - SQL, NoSQL, OS Command, SSTI, XXE, and LDAP/XPath injection techniques.
| name | mobile-security |
| description | Mobile application security testing — Android (smali, Frida, IL2CPP, Flutter AOT, React Native/Hermes, root detection), iOS (jailbreak, Objection). |
Security testing of mobile applications, with emphasis on static analysis of compiled artifacts (Dart AOT snapshots, Unity IL2CPP, native ARM64 libraries, smali bytecode) before reaching for dynamic instrumentation. Covers the toolchain selection puzzle (blutter / doldrums / reFlutter for Flutter; Il2CppDumper for Unity; jadx + apktool for stock Android), envelope reverse-engineering for crypto-wrapped APIs (RSA-OAEP key wrapping, AES-CBC body encryption, base64 header transport), TLS pinning bypass, and root/jailbreak detection bypass. Static dump first; dynamic Frida/Objection only when static is insufficient.
lib/arm64-v8a/libapp.so present) — needs Dart-aware decompiler.libil2cpp.so + global-metadata.dat) — needs Il2CppDumper.libhermes.so + libreact_*.so + assets/index.android.bundle) — the logic is Hermes bytecode in the bundle, not the dex; decompile the bundle with hermes-dec.index.android.bundle with hermes-dec (works on HBC v96), the BuildConfig/strings.xml secret fast-path, and the RN-specific MASVS surface (plaintext AsyncStorage, JS-layer TLS pinning, WebView config, unsigned CodePush OTA, bundled-SDK CVEs).dlopen of an Android .so with a Bionic→glibc forwarder + strcmp/memcmp interceptor to dump expected values without Frida or an emulator..so validates input via hundreds of polynomial-hash dispatcher functions and constructs the secret deterministically from input bytes; use Z3 over the chain rather than emulating.