mcpField
P
pentest-mobile-app

pentest-mobile-app

github.com/jd-opensourceSecurity31582 installsUpdated 28w ago
Repository

About pentest-mobile-app

pentest-mobile-app is a skill for authorized mobile application security testing. It covers static and runtime analysis, local data storage, inter-process communication, binary protections, and mobile-context API risks.

Key features

  1. 01APK and IPA static analysis
  2. 02Sensitive data storage checks
  3. 03Certificate pinning bypass and traffic interception
  4. 04Authentication, session, and deep link testing
  5. 05Android and iOS inter-process communication testing
  6. 06Binary protection and mobile API testing

Use cases

  1. 01Checking binaries for hardcoded secrets and debug flags
  2. 02Testing sensitive data in keychains, databases, and logs
  3. 03Intercepting HTTPS traffic and examining certificate pinning
  4. 04Assessing exported components, URL schemes, and device ID handling

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/jd-opensource/joysafeter --skill pentest-mobile-app

After installing, type/pentest-mobile-appin Claude Code to confirm it loaded.

Bundled filesreferences/tools.mdreferences/workflows.md

Details

From the project README

Pentest Mobile App

Purpose

Mobile apps are completely absent from Shannon (web-only) and all existing skills. Mobile apps often share backend APIs but introduce unique attack surfaces: local storage, pinning, intent handling, binary protections.

Prerequisites

Authorization Requirements
  • Written authorization with mobile app testing scope
  • APK/IPA files or access to app store downloads
  • Test devices or emulators (rooted Android, jailbroken iOS preferred)
  • Backend API documentation if available
Environment Setup
  • Frida for runtime instrumentation
  • Objection for quick mobile security testing
  • MobSF for automated static/dynamic analysis
  • jadx for Android decompilation, Hopper for iOS
  • Burp Suite configured as mobile proxy

Core Workflow

  1. Static Analysis: Decompile APK/IPA, analyze for hardcoded secrets, insecure storage patterns, weak crypto, exported components, debug flags.
  2. Insecure Data Storage: Check SharedPreferences/Keychain for sensitive data, SQLite DBs, log files, clipboard exposure, backup extraction.
  3. Certificate Pinning Bypass: Use Frida/Objection to disable pinning, intercept HTTPS traffic, test HTTP fallback.
  4. Auth & Session on Mobile: Token storage security, biometric bypass, session timeout, deep link auth bypass.
  5. IPC Testing: Exported Activities/Services/BroadcastReceivers (Android), URL scheme hijacking (iOS), intent injection, custom URI handler abuse.
  6. Binary Protections: Root/jailbreak detection bypass, anti-tampering bypass, code obfuscation assessment, runtime manipulation via Frida.
  7. Mobile-Context API Testing: APIs trusting mobile client-side validation, device-ID spoofing, push notification token abuse.

Tool Categories

CategoryToolsPurpose
Runtime InstrumentationFrida, ObjectionHook functions, bypass protections
Static AnalysisMobSF, jadx, HopperDecompile and analyze binaries
Traffic InterceptionBurp Suite, mitmproxyHTTPS interception with pinning bypass
Android Testingadb, drozerComponent testing, IPC analysis
iOS TestingObjection, cycriptRuntime manipulation, keychain dump

References

  • references/tools.md - Tool function signatures and parameters
  • references/workflows.md - Attack pattern definitions and test vectors

Comments

Markdown supported