菜单
移动应用安全测试的专业技能和方法论
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Authorized AI penetration testing assistant for web applications, APIs, and infrastructure. Performs reconnaissance, vulnerability assessment, PoC validation, exploit chaining, and professional reporting. Use when the user asks for pentest, penetration test, security assessment, vulnerability scan, bug bounty research, authorized hacking, SQLi/XSS/IDOR/SSRF testing, API security audit, or exploit validation.
Authorized AI penetration testing for web apps, APIs, cloud, and infrastructure. Full kill-chain methodology with PoC validation, vulnerability chaining, and professional reporting. Triggers on: pentest, penetration test, security assessment, vuln scan, bug bounty, red team, authorized hack, SQL injection test, XSS test, IDOR, SSRF, API security, exploit validation, security audit.
Authorized AI penetration testing assistant — full-spectrum security testing with deep exploitation skills and integrated tooling. Use for web app pentests, API security, vuln validation, PoC development, bug bounty, and security assessments. Triggers on pentest, penetration test, security audit, exploit, SQLi, XSS, IDOR, SSRF.
API安全测试的专业技能和方法论
JWT and OIDC security testing covering token forgery, algorithm confusion, and claim manipulation
AWS cloud security testing covering IAM misconfigurations, S3 exposure, metadata abuse, and privilege escalation paths
| name | mobile-app-security-testing |
| description | 移动应用安全测试的专业技能和方法论 |
penkit51 AI — professional penetration testing skill pack. Authorized testing only.
移动应用安全测试是确保移动应用安全性的重要环节。本技能提供移动应用安全测试的方法、工具和最佳实践，涵盖Android和iOS平台。
检查项目：
检查项目：
检查项目：
检查项目：
使用APKTool：
# 反编译APK
apktool d app.apk
# 查看AndroidManifest.xml
cat app/AndroidManifest.xml
# 查看Smali代码
find app/smali -name "*.smali"
使用Jadx：
# 反编译APK
jadx -d output app.apk
# 查看Java源码
find output -name "*.java"
使用MobSF：
# 启动MobSF
docker run -it -p 8000:8000 opensecurity/mobsf
# 上传APK进行分析
# 访问 http://localhost:8000
使用Frida：
// Hook函数
Java.perform(function() {
var MainActivity = Java.use("com.example.MainActivity");
MainActivity.onCreate.implementation = function(savedInstanceState) {
console.log("[*] onCreate called");
this.onCreate(savedInstanceState);
};
});
使用Objection：
# 启动Objection
objection -g com.example.app explore
# Hook函数
android hooking watch class_method com.example.MainActivity.onCreate
使用Burp Suite：
# 配置代理
# Android设置代理指向Burp Suite
# 安装Burp证书
硬编码密钥：
// 不安全的代码
String apiKey = "1234567890abcdef";
String password = "admin123";
不安全的存储：
// SharedPreferences存储敏感数据
SharedPreferences prefs = getSharedPreferences("data", MODE_WORLD_READABLE);
prefs.edit().putString("password", password).apply();
证书验证绕过：
// 不验证证书
TrustManager[] trustAllCerts = new TrustManager[] {
new X509TrustManager() {
public X509Certificate[] getAcceptedIssuers() { return null; }
public void checkClientTrusted(X509Certificate[] certs, String authType) { }
public void checkServerTrusted(X509Certificate[] certs, String authType) { }
}
};
使用class-dump：
# 导出头文件
class-dump app.ipa
# 查看头文件
find app -name "*.h"
使用Hopper：
# 使用Hopper反汇编
# 打开app二进制文件
# 分析汇编代码
使用otool：
# 查看Mach-O信息
otool -L app
# 查看字符串
strings app | grep -i "password\|key\|secret"
使用Frida：
// Hook Objective-C方法
var className = ObjC.classes.ViewController;
var method = className['- login:password:'];
Interceptor.attach(method.implementation, {
onEnter: function(args) {
console.log("[*] Login called");
console.log("Username: " + ObjC.Object(args[2]).toString());
console.log("Password: " + ObjC.Object(args[3]).toString());
}
});
使用Cycript：
# 附加到进程
cycript -p app
# 执行命令
[UIApplication sharedApplication]
硬编码密钥：
// 不安全的代码
NSString *apiKey = @"1234567890abcdef";
NSString *password = @"admin123";
不安全的存储：
// Keychain存储不当
NSUserDefaults *defaults = [NSUserDefaults standardUserDefaults];
[defaults setObject:password forKey:@"password"];
证书验证绕过：
// 不验证证书
- (void)connection:(NSURLConnection *)connection
didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge {
[challenge.sender useCredential:[NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust]
forAuthenticationChallenge:challenge];
}
# 启动MobSF
docker run -it -p 8000:8000 opensecurity/mobsf
# 上传应用进行分析
# 支持Android和iOS
# 安装Frida
pip install frida-tools
# 运行脚本
frida -U -f com.example.app -l script.js
# 安装Objection
pip install objection
# 启动Objection
objection -g com.example.app explore
配置代理：
问题：
修复：
问题：
修复：
问题：
修复：
问题：
修复：
record_vulnerability when running inside the penkit51 platform