[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M770HW32TWDHB73ZXVHAPHFD":3,"skill-same:01M770HW32TWDHB73ZXVHAPHFD":50},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":14,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":35,"install":36,"resources":49},"01M770HW32TWDHB73ZXVHAPHFD","mobile-overview",null,"Use when the engagement target is an Android (APK \u002F AAB) or iOS (IPA) application. Covers static analysis (jadx, apktool, class-dump), dynamic instrumentation via Frida and Objection, SSL-pinning bypass, root\u002Fjailbreak detection bypass, deep-link \u002F URL-scheme abuse, exported-component attacks, IPC redirection, WebView vulnerabilities, and biometric \u002F Face ID \u002F Touch ID bypass.","Iwakishirokoshu\u002FHermesUltimate","Iwakishirokoshu","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F194847626?v=4","01M75P4CVGA89TTCE8JGMNAQQ9","Around","01M75P4CWF85V6GVSEFKGGFZ03",0,"MIT","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fmobile\u002FSKILL.md",[],[],"2026-11-12 13:55:43",false,"---\nname: mobile-overview\ndescription: >\n  Use when the engagement target is an Android (APK \u002F AAB) or iOS (IPA)\n  application. Covers static analysis (jadx, apktool, class-dump),\n  dynamic instrumentation via Frida and Objection, SSL-pinning bypass,\n  root\u002Fjailbreak detection bypass, deep-link \u002F URL-scheme abuse,\n  exported-component attacks, IPC redirection, WebView vulnerabilities,\n  and biometric \u002F Face ID \u002F Touch ID bypass.\nmetadata:\n  subdomain: mobile\n  when_to_use: \"mobile android ios apk aab ipa jadx apktool frida objection ssl pinning bypass root jailbreak detection deep link url scheme exported component ipc webview biometric face id touch id\"\n  subdomain: mobile\n  tags: mobile, android, ios, frida, objection, ssl-pinning, jadx, apktool\n  mitre_attack: T1635, T1623, T1517, T1521, T1517.001\n---\n\n# Mobile Operator Skill Catalog\n\nMobile is 40% of modern bug-bounty programs and is conspicuously absent\nfrom Strix and XBOW commercial. This catalog covers both platforms with\nshared Frida tooling for runtime work.\n\n## Playbooks — Android\n\n| Skill | Use for |\n|---|---|\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fandroid\u002Fapk-triage\u002FSKILL.md` | apktool decode + jadx -d for source recovery |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fandroid\u002Fmanifest-analysis\u002FSKILL.md` | exported components, permissions, deeplinks |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fandroid\u002Finsecure-storage\u002FSKILL.md` | SharedPreferences \u002F SQLite \u002F external storage scans |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fandroid\u002Fintent-redirection\u002FSKILL.md` | Intent forwarding \u002F pendingIntent abuse |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fandroid\u002Fwebview-flaws\u002FSKILL.md` | JavaScriptInterface, file:\u002F\u002F access, mixed content |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fandroid\u002Ffrida-ssl-pin-bypass\u002FSKILL.md` | OkHttp \u002F TrustKit \u002F Cordova pin-bypass scripts |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fandroid\u002Froot-detect-bypass\u002FSKILL.md` | Common root-detection libraries and their bypasses |\n\n## Playbooks — iOS\n\n| Skill | Use for |\n|---|---|\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fios\u002Fipa-triage\u002FSKILL.md` | class-dump-z + Hopper; Mach-O headers; entitlements |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fios\u002Fkeychain-acl\u002FSKILL.md` | Keychain ACL misconfigurations; `kSecAccessControl` flags |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fios\u002Furl-scheme-abuse\u002FSKILL.md` | Universal links + URL scheme handler attacks |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fios\u002Fxpc-services\u002FSKILL.md` | XPC interface enumeration; unauthenticated XPC services |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fios\u002Ffrida-trust-killer\u002FSKILL.md` | SSL Kill Switch + Frida pin-bypass for iOS apps |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fios\u002Fjailbreak-detect-bypass\u002FSKILL.md` | DTAppJailbreakDetectorSwift, Liberty Lite, common patterns |\n\n## Cross-platform\n\n| Skill | Use for |\n|---|---|\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Ffrida-bridge\u002FSKILL.md` | frida-server install on emulator \u002F jailbroken device; basic scripts |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fobjection-walkthrough\u002FSKILL.md` | Objection cheatsheet (env, memory, sqlite, classes) |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Ffirebase-misconfig\u002FSKILL.md` | Firebase \u002FFirestore RLS \u002F Storage \u002F Auth bypasses |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fmobile-api-testing\u002FSKILL.md` | Burp \u002F Caido proxy → mobile API endpoint enumeration |\n\n## Workflow\n\n1. **Triage**: jadx for Android, class-dump for iOS. Search strings for\n   API endpoints, Firebase config, AWS keys.\n2. **Static**: AndroidManifest.xml exported components; iOS Info.plist\n   URL schemes + entitlements.\n3. **Dynamic setup**: Frida server on a rooted emulator (Android) or\n   jailbroken physical device (iOS); Objection for quick inspection.\n4. **SSL pin bypass**: Frida script; verify HTTPS now visible in Burp.\n5. **API enumeration**: re-route the app through the proxy; spider\n   reachable endpoints; export to Burp project for later web-recon-style\n   testing.\n6. **Insecure storage**: pull `\u002Fdata\u002Fdata\u002F\u003Cpkg>\u002F` (Android) or app\n   container (iOS); grep for credentials, tokens, PII.\n7. **Component-level attacks**: send crafted Intents (`adb shell am\n   start ...`) or URL-scheme payloads (`xcrun simctl openurl ...`).\n\n## Tools sandbox\n\n- adb + emulator \u002F physical device.\n- jadx, apktool, dex2jar, jd-gui.\n- class-dump, Hopper Disassembler, IDA Free (host-side).\n- Frida-server (per device), frida (host), objection.\n- mitmproxy \u002F Burp Suite Community \u002F Caido (PR #304 lands the LangChain\n  Caido tool bundle).\n- MobSF (`mobsf` Docker image) for automated triage when speed matters.\n","# Mobile Operator Skill Catalog\n\nMobile is 40% of modern bug-bounty programs and is conspicuously absent\nfrom Strix and XBOW commercial. This catalog covers both platforms with\nshared Frida tooling for runtime work.\n\n## Playbooks — Android\n\n| Skill | Use for |\n|---|---|\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fandroid\u002Fapk-triage\u002FSKILL.md` | apktool decode + jadx -d for source recovery |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fandroid\u002Fmanifest-analysis\u002FSKILL.md` | exported components, permissions, deeplinks |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fandroid\u002Finsecure-storage\u002FSKILL.md` | SharedPreferences \u002F SQLite \u002F external storage scans |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fandroid\u002Fintent-redirection\u002FSKILL.md` | Intent forwarding \u002F pendingIntent abuse |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fandroid\u002Fwebview-flaws\u002FSKILL.md` | JavaScriptInterface, file:\u002F\u002F access, mixed content |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fandroid\u002Ffrida-ssl-pin-bypass\u002FSKILL.md` | OkHttp \u002F TrustKit \u002F Cordova pin-bypass scripts |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fandroid\u002Froot-detect-bypass\u002FSKILL.md` | Common root-detection libraries and their bypasses |\n\n## Playbooks — iOS\n\n| Skill | Use for |\n|---|---|\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fios\u002Fipa-triage\u002FSKILL.md` | class-dump-z + Hopper; Mach-O headers; entitlements |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fios\u002Fkeychain-acl\u002FSKILL.md` | Keychain ACL misconfigurations; `kSecAccessControl` flags |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fios\u002Furl-scheme-abuse\u002FSKILL.md` | Universal links + URL scheme handler attacks |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fios\u002Fxpc-services\u002FSKILL.md` | XPC interface enumeration; unauthenticated XPC services |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fios\u002Ffrida-trust-killer\u002FSKILL.md` | SSL Kill Switch + Frida pin-bypass for iOS apps |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fios\u002Fjailbreak-detect-bypass\u002FSKILL.md` | DTAppJailbreakDetectorSwift, Liberty Lite, common patterns |\n\n## Cross-platform\n\n| Skill | Use for |\n|---|---|\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Ffrida-bridge\u002FSKILL.md` | frida-server install on emulator \u002F jailbroken device; basic scripts |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fobjection-walkthrough\u002FSKILL.md` | Objection cheatsheet (env, memory, sqlite, classes) |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Ffirebase-misconfig\u002FSKILL.md` | Firebase \u002FFirestore RLS \u002F Storage \u002F Auth bypasses |\n| `\u002Fskills\u002Fstandard\u002Fmobile\u002Fmobile-api-testing\u002FSKILL.md` | Burp \u002F Caido proxy → mobile API endpoint enumeration |\n\n## Workflow\n\n1. **Triage**: jadx for Android, class-dump for iOS. Search strings for\n   API endpoints, Firebase config, AWS keys.\n2. **Static**: AndroidManifest.xml exported components; iOS Info.plist\n   URL schemes + entitlements.\n3. **Dynamic setup**: Frida server on a rooted emulator (Android) or\n   jailbroken physical device (iOS); Objection for quick inspection.\n4. **SSL pin bypass**: Frida script; verify HTTPS now visible in Burp.\n5. **API enumeration**: re-route the app through the proxy; spider\n   reachable endpoints; export to Burp project for later web-recon-style\n   testing.\n6. **Insecure storage**: pull `\u002Fdata\u002Fdata\u002F\u003Cpkg>\u002F` (Android) or app\n   container (iOS); grep for credentials, tokens, PII.\n7. **Component-level attacks**: send crafted Intents (`adb shell am\n   start ...`) or URL-scheme payloads (`xcrun simctl openurl ...`).\n\n## Tools sandbox\n\n- adb + emulator \u002F physical device.\n- jadx, apktool, dex2jar, jd-gui.\n- class-dump, Hopper Disassembler, IDA Free (host-side).\n- Frida-server (per device), frida (host), objection.\n- mitmproxy \u002F Burp Suite Community \u002F Caido (PR #304 lands the LangChain\n  Caido tool bundle).\n- MobSF (`mobsf` Docker image) for automated triage when speed matters.\n",{"name":5,"metadata":24,"description":29},{"tags":25,"subdomain":26,"when_to_use":27,"mitre_attack":28},"mobile, android, ios, frida, objection, ssl-pinning, jadx, apktool","mobile","mobile android ios apk aab ipa jadx apktool frida objection ssl pinning bypass root jailbreak detection deep link url scheme exported component ipc webview biometric face id touch id","T1635, T1623, T1517, T1521, T1517.001","Use when the engagement target is an Android (APK \u002F AAB) or iOS (IPA) application. Covers static analysis (jadx, apktool, class-dump), dynamic instrumentation via Frida and Objection, SSL-pinning bypass, root\u002Fjailbreak detection bypass, deep-link \u002F URL-scheme abuse, exported-component attacks, IPC redirection, WebView vulnerabilities, and biometric \u002F Face ID \u002F Touch ID bypass.\n","main","c0c483827a963764d5e1a663a9591867d47289e6","stack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fmobile","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu","2026-06-15 13:48:41",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add Iwakishirokoshu\u002FHermesUltimate --skill mobile-overview",{"tool":42,"command":43},"bunx","bunx skills add Iwakishirokoshu\u002FHermesUltimate --skill mobile-overview",{"tool":45,"command":46},"pnpm","pnpm dlx skills add Iwakishirokoshu\u002FHermesUltimate --skill mobile-overview","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fmobile\u002FSKILL.md",true,[],[51,58,65,72,79,86],{"skillNo":52,"name":53,"nameZh":6,"description":54,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":55,"categories":56,"keywords":57,"publishedAt":19},"01M770W8JDE5EC1TJT4GSDWD78","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":19},"01M770W4B7T5VCVHB88V1F02H1","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":19},"01M770W093C8FAV8S34K8VB6T9","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":19},"01M770VTNAQGZ3D0RQVFEKTE8Z","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":19},"01M770VNG05ZX3CV84R9GX8PJN","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":19},"01M770VHFH7N192V56PFSRXF5K","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]