# Mobile Application Pentesting

> Use when testing mobile application security.

- Skill: `loopyluci/mobile-application-pentesting` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/mobile-application-pentesting`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/mobile-application-pentesting/raw
- Safety review: pending (external: skill-scanner PASS, skillspector CAUTION)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/mobile-application-pentesting

---


# Mobile Application Penetration Testing

Testing mobile application security — from APK/IPA analysis and traffic interception through runtime manipulation (Frida), data storage, and OWASP MASVS.

## When to Use

- Assessing Android/iOS application security
- Testing mobile API security
- Performing runtime analysis with Frida
- Auditing local data storage on mobile devices
- Testing biometric and auth implementations

## Mobile Testing Techniques

```python
MOBILE_TESTS = {
    'static_analysis': 'Decompile APK (jadx, apktool), IPA (class-dump), search for secrets, hardcoded keys',
    'traffic_interception': 'Burp Suite proxy with CA cert installed on device — intercept HTTP/HTTPS',
    'runtime_analysis': 'Frida — bypass SSL pinning, root detection, debug runtime, call methods',
    'data_storage': 'Check SharedPreferences, SQLite, Realm, Keychain/Keystore, internal/external files',
    'authentication': 'Biometric bypass (fingerprint, FaceID), local auth bypass, session persistence',
    'deep_link': 'Abuse deep links/intent schemes for unintended behavior or injection',
}

# Frida SSL pinning bypass
FRIDA_SSL_PINNING = """
// Universal Android SSL pinning bypass
Java.perform(function() {
    var SSLContext = Java.use('javax.net.ssl.SSLContext');
    SSLContext.init.implementation = function(km, tm, random) {
        var TrustManager = Java.registerClass({
            name: 'com.example.TrustAll',
            implements: [Java.use('javax.net.ssl.X509TrustManager')],
            methods: {
                checkClientTrusted: function() {},
                checkServerTrusted: function() {},
                getAcceptedIssuers: function() { return []; }
            }
        });
        this.init(km, [TrustManager.$new()], random);
    };
});
"""

# Android APK analysis
APK_ANALYSIS = [
    "jadx app.apk — decompile to readable Java",
    "apktool d app.apk — decode resources and smali",
    "strings classes.dex | grep -E 'https://|api_key|secret|password'",
    "drozer console connect — Android security assessment framework",
]
```

## Verification Checklist

- [ ] APK/IPA decompiled and analyzed (strings, hardcoded secrets, manifest)
- [ ] Burp Suite proxy configured with device CA cert
- [ ] SSL pinning bypassed (Frida or objection)
- [ ] Data storage audited (SharedPreferences, SQLite, Keychain, plist)
- [ ] Authentication/biometric bypass tested
- [ ] Deep link / intent scheme abuse tested
- [ ] OWASP MASVS controls verified
- [ ] Root/jailbreak detection bypass tested
- [ ] API endpoints tested identically to web API pentest
- [ ] Data at rest encryption verified