mobile-overview
Use when the engagement target is an Android (APK / AAB) or iOS (IPA) application. Covers static analysis (jadx, apktool, class-dump), dynamic instrumentation via Frida and Objection, SSL-pinning bypass, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported-component attacks, IPC redirection, WebView vulnerabilities, and biometric / Face ID / Touch ID bypass.
- License 许可
- MIT
- 最近更新
- 2026-06-15
- Stars
- ★ 0
- Forks
- 0
01 前言 Front Matter
- name
- mobile-overview
- metadata
- { "tags": "mobile, android, ios, frida, objection, ssl-pinning, jadx, apktool", "subdomain": "mobile", "when_to_use": "mobile android ios apk aab ipa jadx apktool frida objection ssl pinning bypass root jailbreak detection deep link url scheme exported component ipc webview biometric face id touch id", "mitre_attack": "T1635, T1623, T1517, T1521, T1517.001" }
- description
- Use when the engagement target is an Android (APK / AAB) or iOS (IPA) application. Covers static analysis (jadx, apktool, class-dump), dynamic instrumentation via Frida and Objection, SSL-pinning bypass, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported-component attacks, IPC redirection, WebView vulnerabilities, and biometric / Face ID / Touch ID bypass.
03 SKILL.md 正文
Mobile Operator Skill Catalog
Mobile is 40% of modern bug-bounty programs and is conspicuously absent from Strix and XBOW commercial. This catalog covers both platforms with shared Frida tooling for runtime work.
Playbooks — Android
| Skill | Use for |
|---|---|
/skills/standard/mobile/android/apk-triage/SKILL.md |
apktool decode + jadx -d for source recovery |
/skills/standard/mobile/android/manifest-analysis/SKILL.md |
exported components, permissions, deeplinks |
/skills/standard/mobile/android/insecure-storage/SKILL.md |
SharedPreferences / SQLite / external storage scans |
/skills/standard/mobile/android/intent-redirection/SKILL.md |
Intent forwarding / pendingIntent abuse |
/skills/standard/mobile/android/webview-flaws/SKILL.md |
JavaScriptInterface, file:// access, mixed content |
/skills/standard/mobile/android/frida-ssl-pin-bypass/SKILL.md |
OkHttp / TrustKit / Cordova pin-bypass scripts |
/skills/standard/mobile/android/root-detect-bypass/SKILL.md |
Common root-detection libraries and their bypasses |
Playbooks — iOS
| Skill | Use for |
|---|---|
/skills/standard/mobile/ios/ipa-triage/SKILL.md |
class-dump-z + Hopper; Mach-O headers; entitlements |
/skills/standard/mobile/ios/keychain-acl/SKILL.md |
Keychain ACL misconfigurations; kSecAccessControl flags |
/skills/standard/mobile/ios/url-scheme-abuse/SKILL.md |
Universal links + URL scheme handler attacks |
/skills/standard/mobile/ios/xpc-services/SKILL.md |
XPC interface enumeration; unauthenticated XPC services |
/skills/standard/mobile/ios/frida-trust-killer/SKILL.md |
SSL Kill Switch + Frida pin-bypass for iOS apps |
/skills/standard/mobile/ios/jailbreak-detect-bypass/SKILL.md |
DTAppJailbreakDetectorSwift, Liberty Lite, common patterns |
Cross-platform
| Skill | Use for |
|---|---|
/skills/standard/mobile/frida-bridge/SKILL.md |
frida-server install on emulator / jailbroken device; basic scripts |
/skills/standard/mobile/objection-walkthrough/SKILL.md |
Objection cheatsheet (env, memory, sqlite, classes) |
/skills/standard/mobile/firebase-misconfig/SKILL.md |
Firebase /Firestore RLS / Storage / Auth bypasses |
/skills/standard/mobile/mobile-api-testing/SKILL.md |
Burp / Caido proxy → mobile API endpoint enumeration |
Workflow
- Triage: jadx for Android, class-dump for iOS. Search strings for API endpoints, Firebase config, AWS keys.
- Static: AndroidManifest.xml exported components; iOS Info.plist URL schemes + entitlements.
- Dynamic setup: Frida server on a rooted emulator (Android) or jailbroken physical device (iOS); Objection for quick inspection.
- SSL pin bypass: Frida script; verify HTTPS now visible in Burp.
- API enumeration: re-route the app through the proxy; spider reachable endpoints; export to Burp project for later web-recon-style testing.
- Insecure storage: pull
/data/data/<pkg>/(Android) or app container (iOS); grep for credentials, tokens, PII. - Component-level attacks: send crafted Intents (
adb shell am start ...) or URL-scheme payloads (xcrun simctl openurl ...).
Tools sandbox
- adb + emulator / physical device.
- jadx, apktool, dex2jar, jd-gui.
- class-dump, Hopper Disassembler, IDA Free (host-side).
- Frida-server (per device), frida (host), objection.
- mitmproxy / Burp Suite Community / Caido (PR #304 lands the LangChain Caido tool bundle).
- MobSF (
mobsfDocker image) for automated triage when speed matters.
04 同仓库更多 Skills
wps-pixie-dust
WPS Pixie-Dust offline nonce attack (reaver -K / pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.
wpa3-sae
WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.
wpa2-psk
WPA/WPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer/SMB encryption mode in 2026.
wpa-enterprise-eap
WPA/WPA2/WPA3-Enterprise (802.1X/EAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.
krack-fragattacks
KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation/aggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.
evil-twin-karma
Evil-twin rogue AP with KARMA/Mana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK/open networks. Distinct from wpa-enterprise-eap which targets 802.1X.