apk-redteam-pipeline
为移动安全测试提供从采集到动态探测的一站式自动化工具链。
含攻防与脱壳工具且会下载外部二进制，可能被滥用，需合法授权。
自动化获取 APK、反编译、搜索密钥并生成 Frida 动态脚本的红队流水线。
一条龙的 Android 红队流水线：自动抓 APK（Play 商店 + 镜像站回退）、用 JADX 反编译、grep 出密钥/URL/JWT/Firebase、提取 pinned-cert、枚举导出组件并生成 Frida 动态脚本与 intent 注入探针。适合目标有移动应用或在资源里能找到 APK 链接时使用。特别之处是把人工繁琐的抓取、反编译和动态挂钩模板自动化，能快速回收硬编码凭证和内部 API 入口。
▸ 展开 SKILL.md 英文原文
End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert extraction, exported-component enumeration, Frida runtime instrumentation templates, intent-injection probes. Built from an authorized external red-team engagement where 7 APKs were pulled manually, 4 download attempts truncated, and a hardcoded JWT + 30 internal API endpoints were recovered from one of the apps. Use when target has a mobile app catalogue (Play Store developer page), when you find an APK URL hosted on a web server, or when post-recon mentions "mobile app" in scope.
帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/apk-redteam-pipeline/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/apk-redteam-pipeline/SKILL.md"## When to use this skill Trigger when: - Recon surfaces 1+ mobile apps under the target's developer name (Play Store dev page) - A web app hosts `*.apk` files directly (e.g. `Recruitz.apk` found on a subdomain during one engagement) - APK package IDs leaked via stealer logs (e.g. `com.<brand>.app`, `com.<brand>.<sub-brand>` patterns in stealer dump format) - Customer-facing app, dealer/partner portal, or employee mobile companion app is in scope - Bug bounty program lists Android in scope DO NOT use for: - iOS-only targets (different pipeline — IPA reverse, MobSF, frida-ios-dump) - React Native / Flutter web apps already covered by JS bundle analysis - Server-side only assessments --- #