mobile-attacker

Cybersecurity Skills (Invoke First)

Before starting mobile testing, invoke these skills via the Skill tool:

• cybersecurity-skills:conducting-mobile-app-penetration-test
• cybersecurity-skills:performing-android-app-static-analysis-with-mobsf
• cybersecurity-skills:performing-dynamic-analysis-of-android-app
• cybersecurity-skills:reverse-engineering-android-malware-with-jadx
• cybersecurity-skills:intercepting-mobile-traffic-with-burpsuite
• cybersecurity-skills:performing-mobile-app-certificate-pinning-bypass
• cybersecurity-skills:analyzing-ios-app-security-with-objection

Scope Enforcement

Verify app package name (e.g., com.example.app) and backend domains are in scope.txt. Only test on owned/authorized test devices or emulators. Do not exfiltrate user PII from the device.

Android Static Analysis

APK Decompilation

mkdir -p evidence/$(date +%Y%m%d)/$TARGET/mobile/{static,dynamic,traffic,frida}

# Decompile APK with apktool (smali + resources)
apktool d $APK_FILE \
  -o evidence/$(date +%Y%m%d)/$TARGET/mobile/static/apktool_decompiled/ \
  --force 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/mobile/static/apktool.log

# Decompile to Java with jadx
jadx \
  -d evidence/$(date +%Y%m%d)/$TARGET/mobile/static/jadx_output/ \
  --export-gradle \
  $APK_FILE 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/mobile/static/jadx.log

# Extract strings of interest
grep -rE \
  "http[s]?://|password|secret|api_key|firebase|aws|key=|token|bearer|BasicAuth|encrypt" \
  evidence/$(date +%Y%m%d)/$TARGET/mobile/static/jadx_output/ \
  --include="*.java" 2>/dev/null | \
  tee evidence/$(date +%Y%m%d)/$TARGET/mobile/static/interesting_strings.txt

# Check Android Manifest
cat evidence/$(date +%Y%m%d)/$TARGET/mobile/static/apktool_decompiled/AndroidManifest.xml | \
  tee evidence/$(date +%Y%m%d)/$TARGET/mobile/static/manifest.txt

# Check for exported activities / services / receivers (potential attack surface)
grep -E "exported=\"true\"|android:exported" \
  evidence/$(date +%Y%m%d)/$TARGET/mobile/static/apktool_decompiled/AndroidManifest.xml | \
  tee evidence/$(date +%Y%m%d)/$TARGET/mobile/static/exported_components.txt

# Extract hardcoded values from resources
grep -rE "API_KEY|SECRET|PASSWORD|FIREBASE|GOOGLE_API" \
  evidence/$(date +%Y%m%d)/$TARGET/mobile/static/apktool_decompiled/res/ 2>/dev/null | \
  tee evidence/$(date +%Y%m%d)/$TARGET/mobile/static/hardcoded_values.txt

# Check google-services.json (Firebase config)
find evidence/$(date +%Y%m%d)/$TARGET/mobile/static/ \
  -name "google-services.json" -o -name "GoogleService-Info.plist" 2>/dev/null | \
  xargs cat 2>/dev/null | tee evidence/$(date +%Y%m%d)/$TARGET/mobile/static/firebase_config.txt

# Find network_security_config (SSL pinning config)
find evidence/$(date +%Y%m%d)/$TARGET/mobile/static/apktool_decompiled/ \
  -name "network_security_config.xml" 2>/dev/null | \
  xargs cat 2>/dev/null | tee evidence/$(date +%Y%m%d)/$TARGET/mobile/static/nsc.xml