Пентест мобильных приложений Android и iOS

★ 8.2 · testing

mobile-pentest is a Claude Code skill that guides mobile application penetration testing for Android APK and iOS IPA targets using a runtime-first workflow: install the app, proxy traffic through Burp Suite or mitmproxy, drive real business flows by hand, and escalate to decompilation with apktool/jadx or dynamic instrumentation with Frida/objection only when traffic is SSL-pinned, encrypted, or absent. The static sweep phase uses grep and apkleaks against smali and XML to surface hardcoded secrets, hidden API endpoints, and base URLs that web recon never reaches. The skill also covers exported-activity and deeplink intent injection, WebView addJavascriptInterface bridge abuse, OkHttp interceptor chain analysis to recover request signing, and injecting a network_security_config to trust user CA certificates. Built for bug bounty hunters who need a fresh attack surface after web recon dries up or when app traffic must be MitM'd.