# Mobile

> Mobile Operator Skill Catalog

- Skill: `purpleailab/mobile` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/mobile`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/mobile/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/mobile

---


# Mobile Operator Skill Catalog

Mobile is 40% of modern bug-bounty programs and is conspicuously absent
from Strix and XBOW commercial. This catalog covers both platforms with
shared Frida tooling for runtime work.

## Playbooks — Android

> **Inline technique reference — not separately loadable skills.** The entries below
> are summarized here for direct use; there is no separate `SKILL.md` to open for
> each. Do NOT call the skill loader on them — apply the technique with your tools
> using this summary and the Workflow in this file.


| Technique | Use for |
|---|---|
| **apk-triage** | apktool decode + jadx -d for source recovery |
| **manifest-analysis** | exported components, permissions, deeplinks |
| **insecure-storage** | SharedPreferences / SQLite / external storage scans |
| **intent-redirection** | Intent forwarding / pendingIntent abuse |
| **webview-flaws** | JavaScriptInterface, file:// access, mixed content |
| **frida-ssl-pin-bypass** | OkHttp / TrustKit / Cordova pin-bypass scripts |
| **root-detect-bypass** | Common root-detection libraries and their bypasses |

## Playbooks — iOS

| Technique | Use for |
|---|---|
| **ipa-triage** | class-dump-z + Hopper; Mach-O headers; entitlements |
| **keychain-acl** | Keychain ACL misconfigurations; `kSecAccessControl` flags |
| **url-scheme-abuse** | Universal links + URL scheme handler attacks |
| **xpc-services** | XPC interface enumeration; unauthenticated XPC services |
| **frida-trust-killer** | SSL Kill Switch + Frida pin-bypass for iOS apps |
| **jailbreak-detect-bypass** | DTAppJailbreakDetectorSwift, Liberty Lite, common patterns |

## Cross-platform

| Technique | Use for |
|---|---|
| **frida-bridge** | frida-server install on emulator / jailbroken device; basic scripts |
| **objection-walkthrough** | Objection cheatsheet (env, memory, sqlite, classes) |
| **firebase-misconfig** | Firebase /Firestore RLS / Storage / Auth bypasses |
| **mobile-api-testing** | Burp / Caido proxy → mobile API endpoint enumeration |

## Workflow

1. **Triage**: jadx for Android, class-dump for iOS. Search strings for
   API endpoints, Firebase config, AWS keys.
2. **Static**: AndroidManifest.xml exported components; iOS Info.plist
   URL schemes + entitlements.
3. **Dynamic setup**: Frida server on a rooted emulator (Android) or
   jailbroken physical device (iOS); Objection for quick inspection.
4. **SSL pin bypass**: Frida script; verify HTTPS now visible in Burp.
5. **API enumeration**: re-route the app through the proxy; spider
   reachable endpoints; export to Burp project for later web-recon-style
   testing.
6. **Insecure storage**: pull `/data/data/<pkg>/` (Android) or app
   container (iOS); grep for credentials, tokens, PII.
7. **Component-level attacks**: send crafted Intents (`adb shell am
   start ...`) or URL-scheme payloads (`xcrun simctl openurl ...`).

## Tools sandbox

- adb + emulator / physical device.
- jadx, apktool, dex2jar, jd-gui.
- class-dump, Hopper Disassembler, IDA Free (host-side).
- Frida-server (per device), frida (host), objection.
- mitmproxy / Burp Suite Community / Caido (PR #304 lands the LangChain
  Caido tool bundle).
- MobSF (`mobsf` Docker image) for automated triage when speed matters.