skills.rest
bpnrockstar
bpnrockstarCOMMUNITY
Explore all skills by this author →
GitHub

mobile-pentest

Automate Android and iOS mobile application pentest operations.

Updated Jul 1, 2026
Search Tags:#mobile pentest#android pentest#iOS pentest#APK/IPA analysis#mobile vulnerability
One-click install
npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill mobile-pentest-bpnrockstar
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mobile-pentest
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/mobile-pentest
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill mobile-pentest-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill streamlines mobile application pentesting, covering runtime analysis, reverse engineering, and network security for Android and iOS apps.

Core Features & Use Cases

  • Runtime Analysis: Proxy mobile app traffic, drive UI, capture packets, and test APIs like a web target.
  • Reverse Engineering: Decompile APK/IPA to reveal hidden APIs, hardcoded secrets, and base URLs.
  • Network Security: Bypass SSL pinning, exploit vulnerabilities, and report findings.
  • Use Case: If you're performing a bug bounty or red team engagement targeting mobile applications, this skill provides a comprehensive approach to identify security weaknesses.

Quick Start

Run the mobile-pentest skill with the following command to begin pentesting an Android app: mobile-pentest start android-app /path/to/apk

Frequently Asked Questions about mobile-pentest

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate mobile app pentesting for Android and iOS applications?▼

Automate mobile app pentesting by running the skill with your app file path to proxy mobile traffic, decompile code, and identify security weaknesses. Use the command `mobile-pentest start android-app /path/to/apk` to begin automated vulnerability analysis.

Can I find hardcoded secrets and hidden APIs by decompiling an APK or IPA file?▼

Decompiling an APK or IPA file reveals hidden APIs, hardcoded secrets, and base URLs through reverse engineering. The skill automates this code analysis to uncover embedded security vulnerabilities within the mobile application package.

What is the best way to bypass SSL pinning during a mobile pentest engagement?▼

Bypass SSL pinning during a mobile pentest using automated network security testing techniques provided by the skill. It intercepts proxy traffic to exploit vulnerabilities and validate security weaknesses across Android and iOS apps.

Does this mobile pentest approach work for both bug bounty and red team engagements?▼

This mobile pentest approach works for both bug bounty and red team engagements targeting mobile applications. It provides a comprehensive method to identify and validate security weaknesses through runtime analysis and reverse engineering.

How do I test mobile app APIs and capture network traffic like a web target?▼

Test mobile app APIs and capture network traffic by proxying mobile app data through the skill's runtime analysis capabilities. It drives the UI and captures packets to test mobile APIs using standard web target testing techniques.

Related Skills

Explore More Software Engineering Skills→
gerald-icagerald-ica

Burp Suite Web Application Testing

Automate web application security testing with Burp Suite.

Community
Advanced
guaidao2guaidao2
81

jadx

Decompile Android APK, DEX, AAR, and JAR bytecode into Java source and decoded resources.

Community
Advanced
alexfazioalexfazio
159

cc-trace

Intercept and inspect Claude Code API traffic using mitmproxy.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

mobile-android-static

Analyze Android APK and AAB artifacts for security vulnerabilities.

Community
Advanced