offensive-mobile
覆盖 Frida 等动态工具与持久化/存储审计，实用性强。
包含绕过与注入技术，可能被用于未经授权的应用攻击。
Android/iOS 应用的静态与动态渗透测试方法与实用技巧。
覆盖 Android 和 iOS 的静态与动态渗透流程，从反编译（apk/ipa）到设备上用 Frida/Objection 动态劫持、绕过 SSL pinning 和 root/jailbreak 检测。适合在审计移动应用、排查数据泄露、API 安全或测试导出组件（deep link、exported components）时用。特点是把常用工具和绕过技巧串成一套实战流程，既讲发现也讲利用与缓解。
▸ 展开 SKILL.md 英文原文
Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported component attacks (Android activities, services, providers, receivers; iOS XPC, URL schemes, universal links), insecure data storage (SharedPrefs, KeyStore misuse, NSUserDefaults, Keychain ACL bypass), IPC / Intent redirection, WebView vulnerabilities (JavaScriptInterface, file:// access), Firebase/AWS/Azure misconfiguration leakage, mobile API testing, biometric/Face ID/Touch ID bypass, app-cloning and runtime patching, and mobile malware/RAT analysis primitives. Use for mobile pentest, bug bounty mobile triage, or app-store reconnaissance.
帮我安装这个 skill：https://raw.githubusercontent.com/SnailSploit/Claude-Red/main/Skills/mobile/offensive-mobile/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/SnailSploit/Claude-Red/main/Skills/mobile/offensive-mobile/SKILL.md"# Mobile (Android + iOS) — Offensive Testing Methodology ## Quick Workflow 1. Static: pull the IPA/APK, decompile, dump resources/strings, identify endpoints 2. Dynamic: install on rooted/jailbroken device, hook with Frida, intercept TLS 3. Map exported attack surface: deep links, URL schemes, exported components 4. Storage / Keystore audit: where do secrets live, what protects them 5. API: every backend the app talks to is your scope — test like a web app --- ## Lab Setup ### Android - Rooted device or **Genymotion** / Android Studio AVD with `userdebug` build - **Magisk** for systemless root; **LSPosed** for hooks; **Frida server** matching device arch - **Burp / Mitmproxy** with syst