skills.rest
0xhaaz
0xhaazCOMMUNITY
Explore all skills by this author →
𝕏@0xhaazGitHub

mobile-pentest

Decompile Android and iOS apps to identify security vulnerabilities.

1|Updated Jun 22, 2026
Search Tags:#penetration testing#vulnerability analysis#app security#bug bounty#mobile pentest
One-click install
npx skills add https://github.com/0xhaaz/bug-bounty-toolkit --skill mobile-pentest-0xhaaz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mobile-pentest
Source: https://github.com/0xhaaz/bug-bounty-toolkit/tree/main/skills/mobile-pentest
Command: npx skills add https://github.com/0xhaaz/bug-bounty-toolkit --skill mobile-pentest-0xhaaz

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires apktool, jadx, frida, mitmproxy, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill streamlines the process of mobile app penetration testing by guiding through app setup, network analysis, and vulnerability identification, ultimately aiding in effective bug bounty hunting.

Core Features & Use Cases

  • Decomposition and Analysis: Decompile Android APKs and iOS IPAs to uncover hardcoded secrets, hidden API endpoints, and base URLs.
  • Network Layer Testing: Analyze traffic captured through Burp or mitmproxy to identify authentication, business logic, and injection vulnerabilities.
  • SSL Pinning Bypass: Offers methods to bypass SSL pinning for deeper traffic analysis.
  • Deeplink Injection and WebView Attacks: Tests for vulnerabilities in exported activities and JavaScript bridges within WebViews.
  • Use Case: When performing a bug bounty on a mobile application, this Skill can help identify and report security issues like IDOR, auth bypass, and data leaks.

Quick Start

Run the mobile-pentest skill to begin analyzing the app's network traffic and potential vulnerabilities.

Frequently Asked Questions about mobile-pentest

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I decompile an Android APK to find hardcoded secrets and hidden API endpoints?▼

To decompile an Android APK for mobile pentest, you can use tools like apktool and jadx to reverse engineer the application package, uncovering hardcoded secrets, hidden API endpoints, and base URLs.

How do I bypass SSL pinning to analyze mobile app network traffic?▼

You can bypass SSL pinning during mobile app penetration testing to enable deeper traffic analysis with mitmproxy or Burp, allowing you to capture and interpret network traffic without certificate validation blocks.

What tools do I need for a mobile application penetration test workflow?▼

A mobile app penetration test workflow requires tools like apktool and jadx for decompilation, frida for runtime instrumentation, and mitmproxy for network layer testing and traffic capture.

Can I test for deeplink injection and WebView vulnerabilities in mobile apps?▼

Testing for deeplink injection and WebView attacks involves analyzing exported activities and JavaScript bridges to identify security vulnerabilities within the mobile application's components.

What is the best way to identify IDOR and authentication bypass vulnerabilities in mobile apps?▼

The best way to identify IDOR, auth bypass, and data leaks in a mobile app is by analyzing captured network traffic and testing business logic through a structured mobile penetration testing workflow.

Does this mobile pentest workflow support iOS IPA analysis as well as Android?▼

Yes, the mobile app penetration testing workflow supports both Android APKs and iOS IPAs, allowing you to decompose and analyze applications across both platforms for vulnerability identification.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

mobile-android-dynamic

Intercept Android app traffic and inspect local storage during authorized security testing.

Community
Advanced
Kisilev13Kisilev13

security-arsenal

Provide security payloads for XSS, SSRF, SQLi, and other web vulnerabilities.

Community
Advanced
cmndcntrlcybercmndcntrlcyber
3

apk-redteam-pipeline

Automate Android APK red team analysis with jadx, Frida, and mitmproxy.

Community
Advanced
AcczdyAcczdy
2

performing-web-application-penetration-test

Automate web application penetration testing following the OWASP WSTG with Burp Suite.

Community
Advanced