[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7DG079G2G5TGSXFVJSVMHM0":3,"skill-same:01M7DG079G2G5TGSXFVJSVMHM0":54},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":34,"commitSha":35,"skillDirectory":36,"forksCount":14,"repositoryHtmlUrl":37,"repositoryHomepageUrl":6,"ownerHtmlUrl":38,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":39,"install":40,"resources":53},"01M7DG079G2G5TGSXFVJSVMHM0","mobile-android",null,"Android APK pentest workflow — apktool\u002Fjadx static, Frida dynamic instrumentation, SSL pinning bypass, root detection bypass, intent fuzzing, keystore extraction.","Akapi895\u002Fraptix","Akapi895","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F83953516?v=4","01M7DEGNDGERR4F4YETDFVA512","Phạm Anh Tuấn","01M7DEGNEHYZNA920AYM5EH7H8",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fmobile\u002Fandroid\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: mobile-android\ndescription: Android APK pentest workflow — apktool\u002Fjadx static, Frida dynamic instrumentation, SSL pinning bypass, root detection bypass, intent fuzzing, keystore extraction.\nmetadata:\n  when_to_use: \"android apk apk-extract jadx apktool frida objection mobsf ssl pinning root detect intent webview\"\n  mitre_attack: T1517, T1640, T1418, T1409\n  subdomain: mobile\n  upstream_refs:\n    - https:\u002F\u002Fgithub.com\u002Fskylot\u002Fjadx\n    - https:\u002F\u002Fgithub.com\u002Ffrida\u002Ffrida\n    - https:\u002F\u002Fgithub.com\u002Fsensepost\u002Fobjection\n    - https:\u002F\u002Fgithub.com\u002FMobSF\u002FMobile-Security-Framework-MobSF\n    - https:\u002F\u002Fgithub.com\u002FImKKingshuk\u002FLockKnife\n---\n\n# Android Pentest Playbook\n\n> Static decompile (apktool\u002Fjadx\u002FMobSF) to map exported components,\n> hardcoded secrets, and insecure storage, then Frida\u002FObjection for\n> SSL-pinning and root-detection bypass once the attack surface is\n> known. For a Unity IL2CPP game APK specifically, use\n> `mobile\u002Fandroid\u002Fil2cpp\u002FSKILL.md` instead — jadx\u002Fapktool expose\n> nothing of the native game logic there.\n\n## Prerequisites\n\n- `adb` + a rooted device or emulator (required for `run-as` data\n  pulls, Frida server push, and Magisk-based tooling like\n  `magisk-trust-user-certs`).\n- Tools: `apktool`, `jadx` (`jadx-gui` for interactive use), `dex2jar`,\n  `jd-gui`, `androguard`, `apkanalyzer`\u002F`aapt`, MobSF\n  (`docker run ... opensecurity\u002Fmobile-security-framework-mobsf`).\n- Dynamic: `frida-server` (device-side) + `frida` \u002F `objection` (host).\n- Proxy: Burp Suite Community or mitmproxy, with the root CA installed\n  on the device for TLS interception.\n- `drozer` for IPC\u002Fcontent-provider testing, `abe.jar` for `adb backup`\n  unpacking, `apkleaks` for static secret sweeps.\n\n## 1. Static — decompile + inspect\n\n### Pull APK\n```bash\n# Listed apps on connected device\nadb shell pm list packages -3            # third-party only\nadb shell pm path com.target.app         # find APK path\nadb pull \u002Fdata\u002Fapp\u002F...\u002Fbase.apk \u002Ftmp\u002F\n\n# Or from Google Play\ngplaycli -d com.target.app -f \u002Ftmp\u002F      # CLI Play store dump\n\n# Or from third-party APK mirrors (apkpure \u002F apkmirror)\n```\n\n### Decompile\n```bash\n# Smali (low-level)\napktool d base.apk -o \u002Ftmp\u002Fapk-smali\n\n# Java pseudo-code (jadx)\njadx --output-dir \u002Ftmp\u002Fapk-java base.apk\n# Or jadx-gui for interactive\n\n# Combine for full picture\n```\n\n### MobSF automated triage\n```bash\ndocker run -it --rm -p 8000:8000 opensecurity\u002Fmobile-security-framework-mobsf\n# Upload APK via web UI, get full report\n```\n\n### Manifest review\n```bash\napkanalyzer manifest print base.apk\n# OR\naapt dump xmltree base.apk AndroidManifest.xml | head -50\n\n# Critical signals:\n# - android:debuggable=\"true\"        → debugger attachable\n# - android:allowBackup=\"true\"       → adb backup possible w\u002Fo root\n# - android:exported=\"true\" w\u002Fo perm → exposed component\n# - \u003Cuses-permission> SMS\u002FCAMERA\u002FMIC reach  → privacy risk\n# - \u003Cintent-filter> w\u002F \"android.intent.action.VIEW\" + custom scheme → deeplink\n# - networkSecurityConfig: cleartextTrafficPermitted=\"true\" → MITM-friendly\n```\n\n### Secrets sweep\n```bash\n# Hardcoded keys in smali \u002F java code\ngrep -rn 'api[_-]?key\\|secret\\|password' \u002Ftmp\u002Fapk-java\u002F | head -20\n\n# Strings + entropy\nstrings -a base.apk | grep -E 'eyJhbGc|^[A-Za-z0-9+\u002F]{30,}={0,2}$' | head\n\n# AndroGuard for deep static\nandroguard analyze base.apk\n```\n\n## 2. Dynamic — Frida + Objection\n\n### Setup\n```bash\n# Push frida-server (rooted device \u002F emulator)\nadb push frida-server-16.x.x-android-arm64 \u002Fdata\u002Flocal\u002Ftmp\u002F\nadb shell \"chmod 755 \u002Fdata\u002Flocal\u002Ftmp\u002Ffrida-server && \u002Fdata\u002Flocal\u002Ftmp\u002Ffrida-server &\"\n\n# Or use Magisk module on prod devices\n```\n\n### Bypass SSL pinning (Frida codeshare scripts)\n```bash\nfrida -U -l https:\u002F\u002Fcodeshare.frida.re\u002F@pcipolloni\u002Funiversal-android-ssl-pinning-bypass-with-frida\u002F -f com.target.app\n\n# Or Objection's built-in\nobjection -g com.target.app explore\n> android sslpinning disable\n```\n\n### Bypass root detection\n```bash\nobjection -g com.target.app explore\n> android root disable\n\n# Or via Frida script — patches common checks (RootBeer, SafetyNet)\n```\n\n### Intercept TLS\n```bash\n# Burp or mitmproxy w\u002F root CA installed on device (or magisk-trust-user-certs)\n# Then re-launch app — traffic visible in proxy\n```\n\n### Hook arbitrary functions\n```javascript\n\u002F\u002F Frida script — hook a class method\nJava.perform(function() {\n    var Auth = Java.use(\"com.target.app.AuthManager\");\n    Auth.checkLicense.implementation = function() {\n        console.log(\"checkLicense called, returning true\");\n        return true;\n    };\n});\n```\n\n## 3. Common Android-specific attack surface\n\n### 3.1 Insecure deeplinks \u002F intents\n```bash\n# Test exposed activity\nadb shell am start -n com.target.app\u002Fcom.target.app.MainActivity \\\n  -a android.intent.action.VIEW -d \"myapp:\u002F\u002Fattacker-controlled-url\"\n\n# Test exposed service \u002F broadcast\nadb shell am startservice -n com.target.app\u002F.ExposedService --es extra \"value\"\nadb shell am broadcast -a com.target.app.ACTION_X --ei param 999\n```\n\n### 3.2 WebView vulnerabilities\n- `setJavaScriptEnabled(true)` + `addJavascriptInterface()` w\u002Fo `@JavascriptInterface` annotation → arbitrary Java method exec from JS\n- `setAllowFileAccessFromFileURLs(true)` → file:\u002F\u002F URL XSS reads local files\n- Custom URL scheme handlers w\u002Fo validation\n\n### 3.3 Insecure storage\n```bash\n# Pull app data (rooted)\nadb shell run-as com.target.app cat \u002Fdata\u002Fdata\u002Fcom.target.app\u002Fshared_prefs\u002FAuth.xml\n\n# SQLite DBs\nadb shell run-as com.target.app sqlite3 \u002Fdata\u002Fdata\u002Fcom.target.app\u002Fdatabases\u002Fmain.db \".dump\"\n```\n\n### 3.4 Keystore extraction\nAndroid Keystore is supposed to be hardware-backed. On rooted devices\nor devices w\u002F keystore bugs, keys extractable via:\n- Frida hooks on `KeyStore.getKey()`\n- LockKnife-style memory dump (https:\u002F\u002Fgithub.com\u002FImKKingshuk\u002FLockKnife)\n- TEE exploitation (rare, advanced)\n\n### 3.5 PIN brute \u002F passkey\nAndroid 14+ passkey biometric flow — LockKnife exploits Android pre-A14\nkeystore quirks. Modern Android raises the bar significantly.\n\n### 3.6 Backup-restore confusion\nIf `allowBackup=true`:\n```bash\nadb backup com.target.app\n# Pull backup, extract w\u002F android-backup-extractor (abe.jar)\njava -jar abe.jar unpack backup.ab backup.tar\ntar xvf backup.tar\n```\n\n## 4. Tools cheat-sheet\n\n| Tool | Use |\n|---|---|\n| `apktool` | Smali decompile + repack |\n| `jadx` | Java pseudo-code, GUI |\n| `androguard` | Static API analysis library |\n| `MobSF` | Web-UI automated triage |\n| `Frida` | Runtime instrumentation |\n| `Objection` | Frida-based REPL for common tasks |\n| `drozer` | IPC + content provider testing |\n| `LockKnife` | Credential extraction (forensics) |\n| `abe.jar` | Backup unpacking |\n| `apkleaks` | Static secret sweep |\n| `apksigner` | APK signature analysis |\n| `bytecode-viewer` | Multi-decompiler GUI |\n\n## 5. PoC framing\n\n- Demonstrate API key extraction from static APK → use key to access backend\n- Demonstrate SSL pinning bypass + traffic capture → show sensitive data over TLS-MITM'd connection\n- Demonstrate exposed component RCE → `adb shell am start -n ... --es cmd 'rm -rf'`\n- Document `allowBackup=true` + sensitive data extraction post-backup\n\n## 6. Severity\n\n| Bug | Severity |\n|---|---|\n| Hardcoded API key w\u002F admin scope | Critical 9.0 |\n| Exposed activity → arbitrary intent injection | Critical 9.0 |\n| WebView `addJavascriptInterface` → RCE in app context | Critical 9.0 |\n| SSL pinning bypass + sensitive endpoint | High 8.0 |\n| Backup extracts auth tokens | High 7-8 |\n| Root detection bypass alone | Informational |\n| Deeplink takeover (registered scheme) | High-Critical depending on flow |\n\n## 7. Defender\n- ProGuard \u002F R8 obfuscation (raises bar; not security)\n- Native code for cryptographic primitives + key derivation\n- Hardware-backed Keystore (StrongBox where available)\n- Network Security Config: cleartext denied, custom CA refusal\n- SafetyNet \u002F Play Integrity API for tamper detection\n- Custom SSL pinning (not via system trust store)\n\n## Cross-references\n- Operator's `android-re` global skill (Raptix-external)\n- Reverser binary triage: `skills\u002Freverser\u002Ftriage\u002FSKILL.md`\n- Cipher\u002Fkey extraction: `skills\u002Fexploit\u002Fcrypto\u002FSKILL.md`\n\n## Known exemplars\n- 2019: Multiple banking apps disclosed for SSL pinning bypass — $5-15k bounties\n- 2021: Multiple Android apps w\u002F exposed activity RCE chains\n- LockKnife (2024): Android forensics credential extraction tool\n- Routine: hardcoded Firebase URLs + permissive rules → full DB read\n","# Android Pentest Playbook\n\n> Static decompile (apktool\u002Fjadx\u002FMobSF) to map exported components,\n> hardcoded secrets, and insecure storage, then Frida\u002FObjection for\n> SSL-pinning and root-detection bypass once the attack surface is\n> known. For a Unity IL2CPP game APK specifically, use\n> `mobile\u002Fandroid\u002Fil2cpp\u002FSKILL.md` instead — jadx\u002Fapktool expose\n> nothing of the native game logic there.\n\n## Prerequisites\n\n- `adb` + a rooted device or emulator (required for `run-as` data\n  pulls, Frida server push, and Magisk-based tooling like\n  `magisk-trust-user-certs`).\n- Tools: `apktool`, `jadx` (`jadx-gui` for interactive use), `dex2jar`,\n  `jd-gui`, `androguard`, `apkanalyzer`\u002F`aapt`, MobSF\n  (`docker run ... opensecurity\u002Fmobile-security-framework-mobsf`).\n- Dynamic: `frida-server` (device-side) + `frida` \u002F `objection` (host).\n- Proxy: Burp Suite Community or mitmproxy, with the root CA installed\n  on the device for TLS interception.\n- `drozer` for IPC\u002Fcontent-provider testing, `abe.jar` for `adb backup`\n  unpacking, `apkleaks` for static secret sweeps.\n\n## 1. Static — decompile + inspect\n\n### Pull APK\n```bash\n# Listed apps on connected device\nadb shell pm list packages -3            # third-party only\nadb shell pm path com.target.app         # find APK path\nadb pull \u002Fdata\u002Fapp\u002F...\u002Fbase.apk \u002Ftmp\u002F\n\n# Or from Google Play\ngplaycli -d com.target.app -f \u002Ftmp\u002F      # CLI Play store dump\n\n# Or from third-party APK mirrors (apkpure \u002F apkmirror)\n```\n\n### Decompile\n```bash\n# Smali (low-level)\napktool d base.apk -o \u002Ftmp\u002Fapk-smali\n\n# Java pseudo-code (jadx)\njadx --output-dir \u002Ftmp\u002Fapk-java base.apk\n# Or jadx-gui for interactive\n\n# Combine for full picture\n```\n\n### MobSF automated triage\n```bash\ndocker run -it --rm -p 8000:8000 opensecurity\u002Fmobile-security-framework-mobsf\n# Upload APK via web UI, get full report\n```\n\n### Manifest review\n```bash\napkanalyzer manifest print base.apk\n# OR\naapt dump xmltree base.apk AndroidManifest.xml | head -50\n\n# Critical signals:\n# - android:debuggable=\"true\"        → debugger attachable\n# - android:allowBackup=\"true\"       → adb backup possible w\u002Fo root\n# - android:exported=\"true\" w\u002Fo perm → exposed component\n# - \u003Cuses-permission> SMS\u002FCAMERA\u002FMIC reach  → privacy risk\n# - \u003Cintent-filter> w\u002F \"android.intent.action.VIEW\" + custom scheme → deeplink\n# - networkSecurityConfig: cleartextTrafficPermitted=\"true\" → MITM-friendly\n```\n\n### Secrets sweep\n```bash\n# Hardcoded keys in smali \u002F java code\ngrep -rn 'api[_-]?key\\|secret\\|password' \u002Ftmp\u002Fapk-java\u002F | head -20\n\n# Strings + entropy\nstrings -a base.apk | grep -E 'eyJhbGc|^[A-Za-z0-9+\u002F]{30,}={0,2}$' | head\n\n# AndroGuard for deep static\nandroguard analyze base.apk\n```\n\n## 2. Dynamic — Frida + Objection\n\n### Setup\n```bash\n# Push frida-server (rooted device \u002F emulator)\nadb push frida-server-16.x.x-android-arm64 \u002Fdata\u002Flocal\u002Ftmp\u002F\nadb shell \"chmod 755 \u002Fdata\u002Flocal\u002Ftmp\u002Ffrida-server && \u002Fdata\u002Flocal\u002Ftmp\u002Ffrida-server &\"\n\n# Or use Magisk module on prod devices\n```\n\n### Bypass SSL pinning (Frida codeshare scripts)\n```bash\nfrida -U -l https:\u002F\u002Fcodeshare.frida.re\u002F@pcipolloni\u002Funiversal-android-ssl-pinning-bypass-with-frida\u002F -f com.target.app\n\n# Or Objection's built-in\nobjection -g com.target.app explore\n> android sslpinning disable\n```\n\n### Bypass root detection\n```bash\nobjection -g com.target.app explore\n> android root disable\n\n# Or via Frida script — patches common checks (RootBeer, SafetyNet)\n```\n\n### Intercept TLS\n```bash\n# Burp or mitmproxy w\u002F root CA installed on device (or magisk-trust-user-certs)\n# Then re-launch app — traffic visible in proxy\n```\n\n### Hook arbitrary functions\n```javascript\n\u002F\u002F Frida script — hook a class method\nJava.perform(function() {\n    var Auth = Java.use(\"com.target.app.AuthManager\");\n    Auth.checkLicense.implementation = function() {\n        console.log(\"checkLicense called, returning true\");\n        return true;\n    };\n});\n```\n\n## 3. Common Android-specific attack surface\n\n### 3.1 Insecure deeplinks \u002F intents\n```bash\n# Test exposed activity\nadb shell am start -n com.target.app\u002Fcom.target.app.MainActivity \\\n  -a android.intent.action.VIEW -d \"myapp:\u002F\u002Fattacker-controlled-url\"\n\n# Test exposed service \u002F broadcast\nadb shell am startservice -n com.target.app\u002F.ExposedService --es extra \"value\"\nadb shell am broadcast -a com.target.app.ACTION_X --ei param 999\n```\n\n### 3.2 WebView vulnerabilities\n- `setJavaScriptEnabled(true)` + `addJavascriptInterface()` w\u002Fo `@JavascriptInterface` annotation → arbitrary Java method exec from JS\n- `setAllowFileAccessFromFileURLs(true)` → file:\u002F\u002F URL XSS reads local files\n- Custom URL scheme handlers w\u002Fo validation\n\n### 3.3 Insecure storage\n```bash\n# Pull app data (rooted)\nadb shell run-as com.target.app cat \u002Fdata\u002Fdata\u002Fcom.target.app\u002Fshared_prefs\u002FAuth.xml\n\n# SQLite DBs\nadb shell run-as com.target.app sqlite3 \u002Fdata\u002Fdata\u002Fcom.target.app\u002Fdatabases\u002Fmain.db \".dump\"\n```\n\n### 3.4 Keystore extraction\nAndroid Keystore is supposed to be hardware-backed. On rooted devices\nor devices w\u002F keystore bugs, keys extractable via:\n- Frida hooks on `KeyStore.getKey()`\n- LockKnife-style memory dump (https:\u002F\u002Fgithub.com\u002FImKKingshuk\u002FLockKnife)\n- TEE exploitation (rare, advanced)\n\n### 3.5 PIN brute \u002F passkey\nAndroid 14+ passkey biometric flow — LockKnife exploits Android pre-A14\nkeystore quirks. Modern Android raises the bar significantly.\n\n### 3.6 Backup-restore confusion\nIf `allowBackup=true`:\n```bash\nadb backup com.target.app\n# Pull backup, extract w\u002F android-backup-extractor (abe.jar)\njava -jar abe.jar unpack backup.ab backup.tar\ntar xvf backup.tar\n```\n\n## 4. Tools cheat-sheet\n\n| Tool | Use |\n|---|---|\n| `apktool` | Smali decompile + repack |\n| `jadx` | Java pseudo-code, GUI |\n| `androguard` | Static API analysis library |\n| `MobSF` | Web-UI automated triage |\n| `Frida` | Runtime instrumentation |\n| `Objection` | Frida-based REPL for common tasks |\n| `drozer` | IPC + content provider testing |\n| `LockKnife` | Credential extraction (forensics) |\n| `abe.jar` | Backup unpacking |\n| `apkleaks` | Static secret sweep |\n| `apksigner` | APK signature analysis |\n| `bytecode-viewer` | Multi-decompiler GUI |\n\n## 5. PoC framing\n\n- Demonstrate API key extraction from static APK → use key to access backend\n- Demonstrate SSL pinning bypass + traffic capture → show sensitive data over TLS-MITM'd connection\n- Demonstrate exposed component RCE → `adb shell am start -n ... --es cmd 'rm -rf'`\n- Document `allowBackup=true` + sensitive data extraction post-backup\n\n## 6. Severity\n\n| Bug | Severity |\n|---|---|\n| Hardcoded API key w\u002F admin scope | Critical 9.0 |\n| Exposed activity → arbitrary intent injection | Critical 9.0 |\n| WebView `addJavascriptInterface` → RCE in app context | Critical 9.0 |\n| SSL pinning bypass + sensitive endpoint | High 8.0 |\n| Backup extracts auth tokens | High 7-8 |\n| Root detection bypass alone | Informational |\n| Deeplink takeover (registered scheme) | High-Critical depending on flow |\n\n## 7. Defender\n- ProGuard \u002F R8 obfuscation (raises bar; not security)\n- Native code for cryptographic primitives + key derivation\n- Hardware-backed Keystore (StrongBox where available)\n- Network Security Config: cleartext denied, custom CA refusal\n- SafetyNet \u002F Play Integrity API for tamper detection\n- Custom SSL pinning (not via system trust store)\n\n## Cross-references\n- Operator's `android-re` global skill (Raptix-external)\n- Reverser binary triage: `skills\u002Freverser\u002Ftriage\u002FSKILL.md`\n- Cipher\u002Fkey extraction: `skills\u002Fexploit\u002Fcrypto\u002FSKILL.md`\n\n## Known exemplars\n- 2019: Multiple banking apps disclosed for SSL pinning bypass — $5-15k bounties\n- 2021: Multiple Android apps w\u002F exposed activity RCE chains\n- LockKnife (2024): Android forensics credential extraction tool\n- Routine: hardcoded Firebase URLs + permissive rules → full DB read\n",{"name":5,"metadata":24,"description":7},{"subdomain":25,"when_to_use":26,"mitre_attack":27,"upstream_refs":28},"mobile","android apk apk-extract jadx apktool frida objection mobsf ssl pinning root detect intent webview","T1517, T1640, T1418, T1409",[29,30,31,32,33],"https:\u002F\u002Fgithub.com\u002Fskylot\u002Fjadx","https:\u002F\u002Fgithub.com\u002Ffrida\u002Ffrida","https:\u002F\u002Fgithub.com\u002Fsensepost\u002Fobjection","https:\u002F\u002Fgithub.com\u002FMobSF\u002FMobile-Security-Framework-MobSF","https:\u002F\u002Fgithub.com\u002FImKKingshuk\u002FLockKnife","master","8e5d356b795eae2edd4a26509a4b8968e2c4c251","packages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fmobile\u002Fandroid","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix","https:\u002F\u002Fgithub.com\u002FAkapi895","2026-11-06 17:46:09",{"source":8,"skillName":5,"commands":41,"prompt":51,"zipAvailable":52},[42,45,48],{"tool":43,"command":44},"npx","npx skills add Akapi895\u002Fraptix --skill mobile-android",{"tool":46,"command":47},"bunx","bunx skills add Akapi895\u002Fraptix --skill mobile-android",{"tool":49,"command":50},"pnpm","pnpm dlx skills add Akapi895\u002Fraptix --skill mobile-android","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fmobile\u002Fandroid\u002FSKILL.md",true,[],[55,62,69,76,83,90],{"skillNo":56,"name":57,"nameZh":6,"description":58,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":59,"categories":60,"keywords":61,"publishedAt":19},"01M7DGM32SRP4FZSPYWY621BKQ","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":63,"name":64,"nameZh":6,"description":65,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":68,"publishedAt":19},"01M7DGKXXVDTY0KBZZR83VFPZX","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":70,"name":71,"nameZh":6,"description":72,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":73,"categories":74,"keywords":75,"publishedAt":19},"01M7DGKSV77ENX3D6TG2HQX9MK","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":82,"publishedAt":19},"01M7DGKJ9R6YTFRFBSEAJRGGKF","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":19},"01M7DGKCFZGKK2EQMWZM1A18S8","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":19},"01M7DGK76MKZQWBXTZN82W7214","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]