Mobile Security

---
name: mobile-security
description: "Mobile security covers the complete attack/defense chain of Android/iOS application security testing, APK/IPA reverse engineering, runtime manipulation, certificate pinning bypass, and mobile data protection."
origin: openclaw
version: "0.2.0.2"
compatibility:
  - openclaw
  - claude-code
  - cursor
  - windsurf
allowed-tools:
  - Bash
  - Read
  - Write
  - Edit
  - WebSearch
  - WebFetch
metadata:
  domain: mobile
  tool_count: 6
  guide_count: 5
  mitre: "T1203-Exploitation for Client Execution, T1204.002-User Execution: Malicious File, T1518.001-Software Discovery: Security Software, T1552.001-Credentials In Files"
  last_reviewed: "2026-09-04"
---




# Skill: Mobile Security

> **Supplementary Files**:
> - `payloads.md` — Complete mobile security attack/defense chain payloads (APK/IPA analysis, Frida hooks, SSL bypass, storage extraction, Intent attacks, etc.)
> - `test-cases.md` — Structured test cases (static analysis, dynamic analysis, runtime manipulation, network testing, data protection)

## Summary

Mobile Security skill domain covering mobile operations.

**Tools**: frida, objection, apktool, jadx, mobsf, drozer

**Domain**: mobile

## Description

Mobile security covers the complete attack/defense chain of Android/iOS application security testing, APK/IPA reverse engineering, runtime manipulation, certificate pinning bypass, and mobile data protection. The core objective is to identify security flaws in mobile applications, assess client-side defense strength, extract sensitive data, and develop hardening strategies.

Mastering this skill requires a deep understanding of Android APK structure (DEX, Manifest, Resources), iOS IPA structure (Mach-O, Info.plist), mobile sandbox mechanisms, Keychain/Keystore secure storage, and Frida dynamic instrumentation. The agent can comprehensively use tools such as apktool, jadx, Frida, objection, and MobSF to complete the full workflow from application decompilation to runtime manipulation.

---

## Use Cases

1. **Android/iOS Application Penetration Testing** - Perform security assessments on target mobile applications, discovering vulnerabilities such as data leakage, insecure storage, and exposed components
2. **APK Reverse Engineering and Code Audit** - Decompile Android applications, auditing source code for hardcoded credentials, insecure API calls, and logic flaws
3. **SSL Pinning Bypass** - Bypass application certificate pinning mechanisms to intercept and analyze encrypted HTTPS traffic
4. **Runtime Hooking and Data Extraction** - Use Frida for dynamic instrumentation of running applications, hooking encryption functions, bypassing security checks, and extracting sensitive data from memory
5. **Mobile Malware Analysis** - Analyze behavioral characteristics of suspicious APKs/IPAs, extract IoCs, and assess threat levels

---

## Core Tools

| Tool | Purpose | Command Example |
|------|---------|-----------------|
| **frida** | Dynamic instrumentation framework, runtime hooks, function tracing, memory read/write | `frida -U -f com.target.app -l hook.js` |
| **objection** | Frida-based mobile runtime exploration toolkit | `objection -g com.target.app explore` |
| **apktool** | APK decompilation and repackaging, restoring Manifest and smali | `apktool d app.apk -o app_source` |
| **jadx** | DEX decompilation to readable Java source code | `jadx app.apk -d app_java` |
| **mobsf** | Mobile application automated security analysis framework (static + dynamic) | `docker run -p 8000:8000 opensecurity/mobsf` |
| **drozer** | Android IPC vulnerability scanning and exploitation framework | `drozer console connect` |

---

## Methodology

### Attack Chain

```
App Decompilation     Static Analysis       Dynamic Analysis     Runtime Manipulation
(apktool, jadx)     (Code audit, Manifest) (Proxy, traffic)   (Frida, objection)
      |                 |                 |                |
      v                 v                 v                v
Information          Vulnerability      Communication        Data Extraction
Collection           Identification     Analysis             & Exploitation
(Package name,      (Hardcoded         (API endpoints,     (Sensitive data
 components,         credentials,       authentication       export,
 permissions, SDK)   exported            mechanisms,         auth bypass,
                       components,       SSL Pinning)        security check
                       insecure                              bypass)
                       storage)
```

1. **App Decompilation** - apktool restores Manifest and smali code, jadx decompiles to readable Java, obtaining complete application structure
2. **Static Analysis** - Audit AndroidManifest.xml (exported components, permissions, debuggable flag), scan for hardcoded credentials and API keys
3. **Dynamic Analysis** - Configure proxy to intercept network traffic, analyze API communication patterns and authentication mechanisms, identify certificate pinning implementations
4. **Runtime Manipulation** - Use Frida to hook key functions (encryption, authentication, checks), bypass security protections, extract runtime sensitive data
5. **Data Extraction and Exploitation** - Export plaintext data from SharedPreferences/SQLite, exploit exported component vulnerabilities, construct Intent attack chains

### Defense Perspective

| Defense Measure | Purpose | Bypass Approach |
|-----------------|---------|-----------------|
| **Code Obfuscation** | ProGuard/R8 obfuscate code, increasing reverse engineering difficulty | Spend time analyzing obfuscation mappings, dynamically hook to bypass static protections |
| **Certificate Pinning** | Pin server certificate fingerprints, preventing MITM attacks | Frida hook TrustManager / OkHttp CertificatePinner |
| **Root/Jailbreak Detection** | Detect whether device is rooted/jailbroken, blocking dangerous environments | Frida hook detection function return values, modify file existence checks |
| **Anti-Tampering** | Detect APK integrity, prevent repackaging | Modify signature verification logic, bypass integrity checks |
| **Secure Storage** | Use Android Keystore / iOS Keychain for sensitive data storage | Hook encryption functions to intercept plaintext before encryption / after decryption |
| **Anti-Debug** | Detect debugger attachment, preventing dynamic analysis | Modify anti-debugging flags, use Frida spawn mode to bypass |

---

## Practical Steps

### 1. APK Decompilation and Static Analysis

Decompile APK to obtain Manifest and smali code, scan for hardcoded credentials and insecure storage patterns.

### 2. Frida Hook Basics

Use Frida Java.perform to hook login methods for credential interception, hook encryption functions to intercept plaintext data.

### 3. SSL Pinning Bypass

Bypass certificate pinning through Frida hooking OkHttp CertificatePinner or replacing TrustManager. Shortcut: `objection -g com.target.app explore` -> `android sslpinning disable`.

### 4. Data Storage Analysis

Check SharedPreferences plaintext storage, SQLite database contents, external storage leakage, exploit allowBackup to extract application data.

### 5. Intent Exploitation and Component Attacks

Use drozer to discover exported components, construct malicious Intents via adb to attack exported Activities, Content Providers, Broadcast Receivers, and Deep Links.

> **Detailed payloads in `payloads.md`, complete test checklist in `test-cases.md`.**

---

### Cross-Platform Mobile Testing

Modern mobile apps increasingly use cross-platform frameworks that introduce unique attack surfaces:

| Framework | Key Attack Surface | Primary Tools |
|-----------|-------------------|---------------|
| React Native | JS bundle extraction, WebView bridges, AsyncStorage | jadx, Frida, Burp |
| Flutter | Dart snapshot, libapp.so, platform channels | Ghidra, Frida, reFlutter |
| Xamarin | DLL extraction, AOT compilation | dnSpy, ILDasm |
| Capacitor/Ionic | WebView exposure, plugin API | Chrome DevTools, Burp |

See `guides/react-native-flutter-security.md` for framework-specific testing methodology.

### Mobile-Cloud Integration Testing

Mobile apps connect to cloud backends (Firebase, AWS Amplify, custom APIs). Key test areas:

1. **Backend API exposure**: Enumerate and test all API endpoints accessible from the app
2. **Cloud service misconfiguration**: Firebase rules, Cognito pools, Storage buckets
3. **Authentication flow**: OAuth 2.0/OIDC implementation flaws on mobile
4. **Third-party SDK security**: Data collection, tracking, insecure defaults

See `guides/mobile-api-security-testing.md` and `guides/mobile-cloud-integration.md`.

---

## Detection Methods

### Mobile App Static Analysis
- **Hardcoded secrets**: Strings analysis revealing API keys (`AKIA...`), JWT tokens, OAuth client secrets.
- **Insecure storage**: Credentials in `SharedPreferences` (Android), `NSUserDefaults` (iOS) without encryption.
- **Exported components** (Android): Activities/services/receivers exported without permission check.
- **Insecure transit**: Apps not enforcing TLS; cleartext traffic allowed.

### Dynamic Analysis Detection
- **Runtime manipulation**: Frida-instrumented app accessing sensitive functions.
- **Insecure IPC**: Apps sharing sensitive data via Intent (Android) / URL scheme (iOS) without verification.
- **WebView abuse**: JavaScript bridge (`addJavascriptInterface`) exposing sensitive functions.

### SIEM Detection Rules
- **Splunk SPL (mobile)**: `index=mobile sourcetype=apk:analysis | where permission matches "android.permission.SMS"`
- **MobSF (Mobile Security Framework)**: Automated static + dynamic analysis.
- **NowSecure / Veracode Mobile**: Commercial mobile app scanning.

## Defense Evasion Techniques

### Mobile Exploit Stealth
- **Single-shot exploit**: One exploit per app launch; below sustained-pattern detection.
- **Memory-only execution**: Run from RAM; no disk artifacts in `/data/data/<package>/`.
- **Use legitimate intents**: Abuse exported components that look legitimate (e.g., share, profile).

### Anti-Analysis
- **Root/Jailbreak detection**: Detect and exit if compromised (defender-side; red team needs to bypass).
- **Frida/Xposed detection**: Check for Frida server on port 27042; check for Xposed hooks.
- **Emulator detection**: Check for emulator-specific properties (`ro.kernel.qemu`, `iSimulator`).
- **SafetyNet / Play Integrity**: Google's remote attestation; harder to bypass.

### Persistence Stealth
- **Device admin** (Android): Use Device Admin for persistence; harder to remove.
- **Accessibility service** (Android): Use Accessibility for persistence; powerful and persistent.
- **Background app refresh** (iOS): Use Background App Refresh; killed less often.

### Network Stealth
- **Domain fronting**: Use legitimate CDN for C2; appears as legitimate traffic.
- **Protocol mimicry**: C2 over legitimate-looking API (e.g., JSON to attacker's "analytics" endpoint).
- **TLS fingerprinting**: Match ` okhttp` / `URLSession` JA3 signature.

## Orchestration

### ECC Loop Pattern
- **Pattern**: Sequential Pipeline
- **Rationale**: Mobile security testing follows a sequential approach — decompile → analyze → hook → verify — where each phase builds on the previous
- **Integration**: codebase-onboarding (app structure understanding), browser-qa (WebView testing), verification-loop (finding confirmation)

### Cross-Skill Pipeline
```
codebase-onboarding → mobile-security → verification-loop → article-writing
```

### Quality Gate
- Pre-condition: Target APK/IPA available, testing environment configured
- Post-condition: All attack surfaces documented, findings independently verified
- Verification: Use verification-loop Phase 4 (independent confirmation with different tool)

---

## Hacker Laws

| Law | Application in Mobile Security |
|-----|--------------------------------|
| **First Principles** | Don't rely on tools for one-click results; understand APK internal structure (DEX, Manifest, Resources) and Android runtime mechanisms. Only by understanding the underlying principles of Frida instrumentation can you write precise hook scripts |
| **Trust but Verify** | All client-side security checks can be bypassed. Root Detection, SSL Pinning, and Anti-Debug are delays, not barriers, to attackers. Defense design must assume the client has been fully compromised |
| **Minimize Attack Surface** | Every exported=true component is an entry point. Follow the principle of least privilege: disable unnecessary exported components, remove debuggable flags, prohibit cleartext traffic, and implement Certificate Pinning |

---

## Learning Resources

  **This skill's supplementary files**: payloads.md, test-cases.md
  **Related skills**: skills/binary-reverse/SKILL.md, skills/web-xss/SKILL.md
  **External resources**:
  - [OWASP MSTG](https://owasp.org/www-project-mobile-security-testing-guide/) - Authoritative mobile security testing standard
  - [Frida Official Documentation](https://frida.re/docs/home/) - Complete reference for Frida dynamic instrumentation
  - [MobSF GitHub](https://github.com/MobSF/Mobile-Security-Framework-MobSF) - Mobile security automated analysis framework
  - [HackTricks - Mobile Pentesting](https://book.hacktricks.xyz/mobile-pentesting) - Mobile penetration techniques collection