Mobile Application Pentesting

---
name: mobile-application-pentesting
description: "Use when testing mobile application security."
version: 1.0.0
author: Hermes Agent
license: MIT
metadata:
  hermes:
    tags: [mobile-pentest, Android, iOS, IPA, APK, Frida, drozer, objection, OWASP-MASVS]
    related_skills: [api-penetration-testing, webapp-penetration-testing, reverse-engineering-basics, cloud-penetration-testing]
---

# Mobile Application Penetration Testing

Testing mobile application security — from APK/IPA analysis and traffic interception through runtime manipulation (Frida), data storage, and OWASP MASVS.

## When to Use

- Assessing Android/iOS application security
- Testing mobile API security
- Performing runtime analysis with Frida
- Auditing local data storage on mobile devices
- Testing biometric and auth implementations

## Mobile Testing Techniques

```python
MOBILE_TESTS = {
    'static_analysis': 'Decompile APK (jadx, apktool), IPA (class-dump), search for secrets, hardcoded keys',
    'traffic_interception': 'Burp Suite proxy with CA cert installed on device — intercept HTTP/HTTPS',
    'runtime_analysis': 'Frida — bypass SSL pinning, root detection, debug runtime, call methods',
    'data_storage': 'Check SharedPreferences, SQLite, Realm, Keychain/Keystore, internal/external files',
    'authentication': 'Biometric bypass (fingerprint, FaceID), local auth bypass, session persistence',
    'deep_link': 'Abuse deep links/intent schemes for unintended behavior or injection',
}

# Frida SSL pinning bypass
FRIDA_SSL_PINNING = """
// Universal Android SSL pinning bypass
Java.perform(function() {
    var SSLContext = Java.use('javax.net.ssl.SSLContext');
    SSLContext.init.implementation = function(km, tm, random) {
        var TrustManager = Java.registerClass({
            name: 'com.example.TrustAll',
            implements: [Java.use('javax.net.ssl.X509TrustManager')],
            methods: {
                checkClientTrusted: function() {},
                checkServerTrusted: function() {},
                getAcceptedIssuers: function() { return []; }
            }
        });
        this.init(km, [TrustManager.$new()], random);
    };
});
"""

# Android APK analysis
APK_ANALYSIS = [
    "jadx app.apk — decompile to readable Java",
    "apktool d app.apk — decode resources and smali",
    "strings classes.dex | grep -E 'https://|api_key|secret|password'",
    "drozer console connect — Android security assessment framework",
]
```

## Verification Checklist

- [ ] APK/IPA decompiled and analyzed (strings, hardcoded secrets, manifest)
- [ ] Burp Suite proxy configured with device CA cert
- [ ] SSL pinning bypassed (Frida or objection)
- [ ] Data storage audited (SharedPreferences, SQLite, Keychain, plist)
- [ ] Authentication/biometric bypass tested
- [ ] Deep link / intent scheme abuse tested
- [ ] OWASP MASVS controls verified
- [ ] Root/jailbreak detection bypass tested
- [ ] API endpoints tested identically to web API pentest
- [ ] Data at rest encryption verified