Пентест мобильных приложений Android и iOS

★ 8.1 · testing

mobile-pentest is a Claude Code skill that implements a runtime-first methodology for pentesting mobile applications (Android APK and iOS IPA) in bug bounty engagements. The workflow follows a strict order: install the app, proxy traffic through Burp or mitmproxy, drive real business flows by hand, and escalate to decompilation with apktool/jadx or Frida/objection instrumentation only when traffic is SSL-pinned, encrypted, or absent. The skill covers static sweeps for hardcoded secrets and hidden API endpoints, SSL pinning bypass via objection patchapk and Frida CertificatePinner/checkServerTrusted hooks, request-signing recovery through the OkHttp interceptor chain, exported-activity and deeplink intent injection, WebView addJavascriptInterface bridge abuse, and JNI native-lib triage. It is built for bug bounty hunters who need a fresh attack surface when web recon dries up or when traffic must be MitM'd to test the backend.