Mobile Pentest
This is a mobile app security testing workflow that walks you through both static and dynamic analysis for Android and iOS. You get practical Frida scripts for bypassing SSL pinning and root detection, ADB commands for exploiting exported components and deep links, and guidance on setting up your lab environment with tools like Objection, Magisk, and jailbreak utilities. The static analysis section covers decompiling APKs with jadx and apktool, dumping iOS classes, and hunting for hardcoded secrets in both platforms. What stands out is the exported components section, which shows exactly how to abuse Activities, Services, Broadcasts, and Content Providers via ADB. It's comprehensive enough for both bug bounty work and formal pentests, though you'll still need to adapt the Frida scripts to app specific obfuscation.
- GitHub stars
- 280
- last updated
- May 28, 2026
Install
$ npx -y skills add hypnguyen1209/offensive-claude --skill mobile-pentest --agent claude-codeInstalls into .claude/skills of the current project.
Files
Mobile Application Penetration Testing
When to Activate
- Android/iOS application security assessment, bug-bounty mobile triage, or app-store reconnaissance
- Need to intercept TLS traffic (SSL/cert pinning, Android 14/15 Conscrypt-APEX trust store, Flutter/RN stacks)
- Bypass root/jailbreak or biometric-gating controls during dynamic analysis
- Enumerate and exploit exported components, content providers, deep links, and WebViews
- Extract secrets from insecure storage (SharedPrefs, SQLite, Keychain, Keystore) and reverse hybrid apps
Technique Map
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/hypnguyen1209/offensive-claude
- Categories
- Testing & QA, Security, Mobile Development
- License
- MIT
- First seen
- Jun 11, 2026
More from hypnguyen1209/offensive-claude
All 25- Network Attack
- Privesc Linux
- Privesc Windows
- Recon Osint
- Red Team Ops
- Reverse Engineering
- Shellcode Dev
- Threat Hunting
- Vulnerability Analysis
- Web Pentest
- Windows Boundaries
- Windows Mitigations
- Active Directory Attack
- Advanced Redteam
- Ai Security
- Cloud Security
- Coding Mastery
- Crypto Analysis
- Edr Evasion
- Exploit Development
- Incident Response
- Initial Access
- Keylogger Arch
- Malware Analysis
Recommended
More Testing & QA
network-attackhypnguyen1209/offensive-claudeNetwork penetration testing — lateral movement, pivoting, protocol attacks, traffic interception, Active Directory exploitation, wireless attacks0skills.sh installsweb-pentesthypnguyen1209/offensive-claudeFull-spectrum web application penetration testing — OWASP Top 10, API security, authentication attacks, business logic, WAF bypass, race conditions0skills.sh installs
framing-research-questionsk-dense-ai/science-superpowersYou MUST use this before any data analysis or investigation - before exploring a dataset, loading or profiling data, running a model, computing a statistic, or 0skills.sh installs
live_database_ingestkaelio/ktxCapture semantic-layer and knowledge updates from a live database schema snapshot.0skills.sh installs
update-llm-poolkimtth/awesome-azure-openai-llmWorkflow for updating the LLM landscape paper pool (section/x_llm_papers.md) using fetch_llm_papers.py. Covers full re-fetch, resume from checkpoint, and adding0skills.sh installs
forgecad-model-graderkostard/forgecad-public-kitAnalyze, verify, and grade ForgeCAD or CAD-as-code models against a user requirement, design brief, prompt, reference, or acceptance criteria. Use when asked to0skills.sh installs