skills.rest
hataiit9x
hataiit9xCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

mobile-pentest

Decompile Android and iOS apps for source code and runtime testing.

3|Updated Jul 6, 2026
Search Tags:#security testing#mobile pentest#app decompilation#SSL pinning bypass#Android/iOS
One-click install
npx skills add https://github.com/hataiit9x/Bbkit-AI --skill mobile-pentest-hataiit9x
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mobile-pentest
Source: https://github.com/hataiit9x/Bbkit-AI/tree/main/ref/claude-bug-bounty/skills/mobile-pentest
Command: npx skills add https://github.com/hataiit9x/Bbkit-AI --skill mobile-pentest-hataiit9x

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires apktool, jadx, frida, objection, mitmproxy, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill enables you to perform comprehensive mobile application pentesting, covering everything from decompilation to runtime testing and bypassing security measures.

Core Features & Use Cases

  • Decompile APK/IPA: Extracts source code from Android and iOS apps for in-depth analysis.
  • Runtime Testing: Drives app UI, captures traffic, and tests APIs.
  • SSL Pinning Bypass: Enables MitM attacks on encrypted traffic.
  • Use Case: When dealing with a mobile application within a bug bounty, this Skill can be used to uncover hardcoded secrets, hidden API endpoints, and other vulnerabilities not accessible via web recon.

Quick Start

To perform a mobile pentest, use the following command: bb mobile-pentest <app_package_name>

Frequently Asked Questions about mobile-pentest

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I decompile an Android APK or iOS IPA for source code analysis?▼

To decompile Android APK or iOS IPA files for source code analysis, you can use this Skill to extract and review the underlying code, enabling you to uncover hardcoded secrets and hidden API endpoints.

What is the best way to bypass SSL pinning during a mobile pentest?▼

Bypassing SSL pinning during a mobile pentest is achieved here using integrated tools like Frida and Objection, which allow you to intercept and analyze encrypted network traffic via MitM attacks.

Do I need adb and Frida installed for runtime mobile app testing?▼

Yes, you need adb and Frida installed to perform runtime mobile app testing, as they are required to drive the app UI, capture network traffic, and test APIs during your security analysis.

Can I use mitmproxy to capture API traffic from mobile applications?▼

You can use mitmproxy to capture API traffic from mobile applications by combining it with the Skill's SSL pinning bypass capabilities, allowing comprehensive network-level testing of encrypted traffic.

What tools are required to extract source code from APK and IPA files?▼

Extracting source code from APK and IPA files requires dependencies like apktool and jadx, which enable detailed decompilation and in-depth analysis of mobile application internals.

When do I need mobile app decompilation for bug bounty hunting?▼

Mobile app decompilation is needed for bug bounty hunting when web recon is insufficient, allowing you to uncover hardcoded secrets, hidden API endpoints, and vulnerabilities inaccessible through standard web testing.

Related Skills

Explore More Software Engineering Skills→
hardw00thardw00t
90

android-pentest

Automate Android app pentesting with static APK analysis and Frida instrumentation.

Community
Advanced
pdparchitectpdparchitect
13

apk-redteam-pipeline

Automates Android APK security assessment with static analysis and runtime instrumentation.

Community
Advanced
alexfazioalexfazio
159

cc-trace

Intercept and inspect Claude Code API traffic using mitmproxy.

Community
Advanced
alicangnllalicangnll

Android Exploit

Decompile Android APK files and analyze bytecode for vulnerabilities.

Community
Advanced