Offensive mobile

--- name: offensive-mobile description: "Penetration testing methodology for mobile (Android and iOS) applications. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link/URL-scheme abuse, exported component attacks (Android activities, services, providers, receivers; iOS XPC, URL schemes, universal links), insecure data storage (SharedPrefs, KeyStore misuse, NSUserDefaults, Keychain ACL bypass), IPC/Intent redirection, WebView vulnerabilities (JavaScriptInterface, file:// access), Firebase/AWS/Azure misconfiguration leaks, mobile-API-testing, biometric/Face ID/Touch ID bypass, app cloning and runtime patching, and mobile malware/RAT analysis primitives. Use for mobile penetration testing, mobile bug bounty triage, or app store reconnaissance." --- # Mobile (Android + iOS) : Offensive Testing Methodology ## Quick Workflow 1. Static: download the IPA/APK, decompile, dump resources/strings, identify endpoints 2. Dynamic: Install on a rooted or jailbroken device; use Frida to rehook; intercept TLS 3. Map the exported attack surface: deep links, URL schemes, exported components 4. Storage/Keystore audit: where secrets are stored, what protects them 5. API: every backend the app communicates with is within your scope:test it like a web app --- ## Lab Setup ### Android - Rooted device or Genymotion / Android Studio AVD with a build from userdebug - Magisk for systemless root; LSPosed for hooks; Frida server matching the device architecture - Burp / Mitmproxy with a system-trusted CA via a Magisk module (MagiskTrustUserCerts) ### iOS - Jailbroken device (palera1n / checkra1n / Dopamine, depending on the iOS version) - Frida + Objection + Filza + SSH via USB (iproxy 2222 22) - Burp CA installed via Settings → General → Device Management → Certificate Trust Settings --- ## Static Analysis ### Android ``bash # Decode resources + smali apktool d app.apk -o app # Decompile to Java jadx -d app_src app.apk # Manifest review xmllint --format app/AndroidManifest.xml | less # Look for: android:exported="true", intent-filters, custom permissions, debuggable, allowBackup, networkSecurityConfig bash # Secrets and endpoints grep -rE '(https?://[a-z0-9.-]+|api[_-]?key|secret|token|firebase|amazonaws|appspot)' app_src/ grep -r "Log\.[dwief]" app_src/ # leftover debug logs # Native libs file app/lib/*/*.so # RE in Ghidra/IDA; look for JNI_OnLoad and exported Java_* functions ### iOS bash # Pull IPA from device frida-ios-dump -o app.ipa "com.vendor.app" # Or via App Store via 3rd-party tools (Apple Configurator with paid acct, etc.) unzip app.ipa # Decrypt if needed (jailbroken device): bagbak / clutch bagbak com.vendor.app # Class dump class-dump-dyld -H Payload/App.app/App -o headers/ # Or for Swift symbols, use Hopper / IDA # Strings / endpoints strings -a Payload/App.app/App | grep -E '(https?://|key|secret|api)' bash # Info.plist analysis plutil -p Payload/App.app/Info.plist # Look for: NSAppTransportSecurity exceptions, CFBundleURLTypes (URL schemes), # associated-domains entitlements, UIFileSharingEnabled, ATS exemptions --- ## Dynamic Analysis & Frida ### Common Hooks ``javascript // Bypass SSL pinning (Android : generic OkHttp/CertificatePinner/TrustManager) Java.perform(() => { const X509TrustManager = Java.use('javax.net.ssl.X509TrustManager'); const TrustManagerFactory = Java.use('javax.net.ssl.TrustManagerFactory'); // ... full bypass scripts: codeshare.frida.re/@pcipolloni/universal-android-ssl-pinning-bypass-with-frida }); // Bypass root detection Java.perform(() => { const File = Java.use('java.io.File'); File.exists.implementation = function () { const path = this.getAbsolutePath(); if (path.includes('su') || path.includes('Magisk')) return false; return this.exists(); }; }); // iOS : bypass jailbreak detection const stat = Module.findExportByName(null, 'stat'); Interceptor.attach(stat, { onEnter(args) { const path = args[0].readUtf8String(); if (/Cydia | jailbreak | substrate | frida/i.test(path)) { args[0] = Memory.allocUtf8Str