Perform end-to-end penetration testing of Android and iOS mobile applications.
npx skills add https://github.com/woohyun212/security-skill --skill mobile-pentest
Please help me install this Agent Skill. Skill: mobile-pentest Source: https://github.com/woohyun212/security-skill/tree/main/mobile-pentest Command: npx skills add https://github.com/woohyun212/security-skill --skill mobile-pentest
Identifies security weaknesses in Android and iOS applications by combining static analysis, dynamic instrumentation, network interception, and storage inspection to find insecure storage, certificate pinning and root/jailbreak bypasses, and exposed secrets mapped to OWASP MASVS.
Request a full assessment of /tmp/target.apk to detect SSL pinning, exposed secrets, insecure storage, and produce a MASVS-mapped findings report.
High-intent search queries and answers about installing and using this skill.
Mobile app penetration testing identifies insecure storage, certificate pinning bypasses, and exposed secrets by combining static decompilation with jadx or class-dump, dynamic Frida instrumentation, proxy interception, and storage inspection to map findings to OWASP MASVS controls.
Yes, bypassing SSL pinning and observing runtime behavior is achieved through dynamic instrumentation using Frida and objection to extract sensitive runtime artifacts and validate certificate pinning controls during mobile security assessments.
Yes, runtime access for dynamic instrumentation requires either adb for Android or a jailbroken iOS device to successfully execute Frida scripts, intercept network traffic via proxy, and inspect SharedPreferences, SQLite, or Keychain storage.
Mapping mobile application security findings to OWASP MASVS compliance requires generating a structured report that aligns identified vulnerabilities from static and dynamic analysis with specific MASVS categories for remediation and audit purposes.
Decompiling APKs and IPAs to find hardcoded secrets and insecure configurations is done through static analysis using JADX and apktool for Android, alongside class-dump and otool for iOS, to inspect exported components and configuration files.
hardw00tAutomate iOS pentesting workflows with Frida and Objection.
cenconq25Audit codebases against OWASP MASVS and generate prioritized remediation reports.
DorianGalloBypass TLS certificate pinning in Android and iOS apps using runtime hooks and proxy CA trust fixes.
pdparchitectAutomates Android APK security assessment with static analysis and runtime instrumentation.
