Conducts penetration testing of iOS and Android mobile applications following the OWASP Mobile Application Security Testing Guide (MASTG) to identify vulnerabilities in data storage, network communication, authentication, cryptography, and platform-specific security controls. The tester performs static analysis of application binaries, dynamic analysis at runtime, and API security testing to evaluate the complete mobile attack surface. Activates for requests involving mobile app pentest, iOS security assessment, Android security testing, or OWASP MASTG assessment.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Do not use against mobile applications without written authorization from the application owner, for distributing modified or repackaged applications, or for testing apps on the public app stores without a separate test build.
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
Analyze the application binary without executing it:
Android Static Analysis:
jadx -d output/ target.apk to obtain Java/Kotlin source codeAndroidManifest.xml for exported components (activities, services, receivers, content providers), permissions, and debuggable flaggrep -rn "api_key\|password\|secret\|token\|aws_" output/setJavaScriptEnabled(true), addJavascriptInterface(), and loading untrusted contentpython manage.py runserver and upload the APK for automated static analysisiOS Static Analysis:
otool -L <binary> to list linked frameworks and identify third-party librariesIntercept and analyze all network communications:
frida -U -f com.target.app -l ssl-pinning-bypass.js --no-pauseobjection -g "Target App" explore --startup-command "ios sslpinning disable"Test for insecure local data storage:
Android Data Storage:
/data/data/com.target.app/sqlite3 /data/data/com.target.app/databases/*.db ".dump"logcat -d | grep -i "password\|token\|key"android:allowBackup="false" in AndroidManifest.xmliOS Data Storage:
objection -g "Target App" explore then ios keychain dumpfind /var/mobile/Containers/Data/Application/ -name "*.plist" -exec plutil -p {} \;Test mobile-specific authentication controls:
Test the application's resistance to runtime attacks:
adb shell am start -n com.target.app/.InternalActivity -e "user_id" "admin"| Term | Definition |
|---|---|
| OWASP MASTG | Mobile Application Security Testing Guide; comprehensive manual for mobile app security testing covering both iOS and Android platforms |
| Certificate Pinning | A mobile security control that restricts which TLS certificates the app trusts, preventing man-in-the-middle attacks through proxy interception |
| Frida | Dynamic instrumentation toolkit that allows injection of JavaScript into running processes to hook functions, modify behavior, and bypass security controls |
| Root/Jailbreak Detection | Application-level checks to detect if the device has been modified to grant root access, typically blocking app usage on compromised devices |
| Android Keystore | Hardware-backed credential storage on Android that protects cryptographic keys and secrets from extraction even on rooted devices |
| App Transport Security (ATS) | iOS security feature that enforces HTTPS connections by default; ATS exceptions may indicate insecure network communication |
| Deep Links | URL schemes that open specific screens within a mobile application, which may bypass normal navigation and authentication flows if not properly validated |
Context: A bank is launching a new mobile banking app for iOS and Android. The app handles account viewing, fund transfers, bill payment, and check deposit. OWASP MASVS L2 compliance is required due to the financial data handled.
Approach:
Pitfalls:
## Finding: Biometric Authentication Bypass via Frida Instrumentation
**ID**: MOB-003
**Severity**: High (CVSS 7.7)
**Platform**: Android and iOS
**OWASP MASVS**: MASVS-AUTH-2 (Biometric Authentication)
**Description**:
The mobile banking app's biometric authentication can be bypassed using Frida
dynamic instrumentation. The authentication callback function accepts a boolean
result from the biometric API, which can be hooked and forced to return true
without presenting a valid fingerprint or face scan.
**Proof of Concept (Android)**:
frida -U -f com.bank.mobileapp -l bypass-biometric.js --no-pause
// bypass-biometric.js
Java.perform(function() {
var BiometricCallback = Java.use("com.bank.mobileapp.auth.BiometricCallback");
BiometricCallback.onAuthenticationSucceeded.implementation = function(result) {
console.log("[*] Biometric bypassed");
this.onAuthenticationSucceeded(result);
};
});
**Impact**:
An attacker with physical access to an unlocked device can bypass biometric
authentication and access the victim's bank accounts, initiate transfers,
and view financial data without biometric verification.
**Remediation**:
1. Implement server-side biometric verification using Android BiometricPrompt
CryptoObject tied to a Keystore key
2. Require the biometric operation to decrypt a server-side challenge, making
client-side bypass ineffective
3. Add runtime integrity checks to detect Frida and other instrumentation frameworks
4. Implement step-up authentication for high-risk operations (transfers > threshold)
まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
日本語の概要は準備中です。原文の説明を表示しています。
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
日本語の概要は準備中です。原文の説明を表示しています。
Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when an organization handles Controlled Unclassified Information (CUI) under a DoD contract, when a contract carries DFARS clause 252.204-7012/7019/7020/7021, when preparing for or responding to a CMMC assessment, when computing or improving an SPRS score, when building a System Security Plan or POA&M for 800-171, or when scoping which systems are in the CUI boundary. Keywords: CMMC, CMMC Level 2, NIST 800-171, SP 800-171 Rev 2, CUI, FCI, SPRS, DFARS 7012, C3PAO, POA&M, System Security Plan, DoD Assessment Methodology, 110 controls, defense industrial base, DIB, FedRAMP equivalency.
日本語の概要は準備中です。原文の説明を表示しています。
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
日本語の概要は準備中です。原文の説明を表示しています。
Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths
日本語の概要は準備中です。原文の説明を表示しています。
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.
日本語の概要は準備中です。原文の説明を表示しています。