offensive-mobile

# Mobile (Android + iOS) — Offensive Testing Methodology ## Quick Workflow 1. Static: pull the IPA/APK, decompile, dump resources/strings, identify endpoints 2. Dynamic: install on rooted/jailbroken device, hook with Frida, intercept TLS 3. Map exported attack surface: deep links, URL schemes, exported components 4. Storage / Keystore audit: where do secrets live, what protects them 5. API: every backend the app talks to is your scope — test like a web app --- ## Lab Setup ### Android - Rooted device or **Genymotion** / Android Studio AVD with `userdebug` build - **Magisk** for systemless root; **LSPosed** for hooks; **Frida server** matching device arch - **Burp / Mitmproxy** with system-trusted CA via Magisk module (`MagiskTrustUserCerts`) ### iOS - Jailbroken device (palera1n / checkra1n / Dopamine depending on iOS version) - **Frida** + **Objection** + **Filza** + **SSH via USB (iproxy 2222 22)** - Burp CA installed via Settings → General → Device Management → Certificate Trust Settings --- ## Static Analysis ### Android ```bash # Decode resources + smali apktool d app.apk -o app # Decompile to Java jadx -d app_src app.apk # Manifest review xmllint --format app/AndroidManifest.xml | less # Look for: android:exported="true", intent-filters, custom permissions, debuggable, allowBackup, networkSecurityConfig ``` ```bash # Secrets and endpoints grep -rE '(https?://[a-z0-9.-]+|api[_-]?key|secret|token|firebase|amazonaws|appspot)' app_src/ grep -r "Log\.[dwief]" ap...