Dragonjar Android Pentesting Skill

reason-machines/security-skills/skills/dragonjar-android-pentesting-skill

作者 reason-machines304c245fe992无许可证11 个星标收录于 2026年10月9日更新于 2026年10月9日仓库2个月前更新

Comprehensive Android APK security analysis with static/dynamic testing, RASP detection, Frida instrumentation, and MASVS compliance scoring

仅含说明Security
AI 生成的概览

指导 Android APK 安全审计，涵盖静态分析、Frida 插桩、RASP 检测与 MASVS 评分。

功能
该技能引导智能体完成 Android APK 安全评估流程：解码 APK、静态清单与密钥分析、运行时防护检测、基于 Frida 的插桩、数据流追踪、MASVS 合规评分以及报告生成。它记录了命令、绕过配置、Frida 脚本和故障排查步骤，并说明 findings JSON 文件与评分报告等产出。该技能仅包含说明，本身不附带脚本或资源。
适用场景
适用于被要求审计 Android APK 漏洞、检测 root 或 Frida 检测等运行时防护，或在授权实验环境中验证 SSL 证书绑定与 root 检测绕过时。也适合 MASVS 评分、硬编码密钥发现或生成 Android 应用渗透测试报告的请求。
运行要求
需要 APKTool、JADX、Android SDK 平台工具、Frida 工具、Objection、APKiD，可选 Semgrep，以及已连接的设备或模拟器和用于安装工具的网络访问。部分流程需要已 root 的设备、Frida 服务端、Burp 或 ZAP 等代理，并需获得实验测试的明确授权。该技能仅含说明，不附带脚本或资源。

DragonJAR Android Pentesting Skill

Skill by ara.so — Security Skills collection.

This skill provides comprehensive Android APK security analysis capabilities for AI agents, combining static analysis, dynamic instrumentation with Frida, RASP detection, authorized bypass validation, source-to-sink tracing, MASVS scoring, and professional reporting in a unified workflow.

What This Skill Does

Transforms an AI agent into an expert Android security auditor capable of:

  • APK Analysis: Decode APKs with APKTool, decompile with JADX, detect frameworks with APKiD
  • Static Security Analysis: 50+ manifest checks, 70+ Semgrep MASTG rules, secret detection, obfuscation analysis
  • Dynamic Instrumentation: 37 Frida scripts for SSL pinning bypass, root detection bypass, crypto interception
  • Runtime Defense Analysis (RDA): Detect 18 protection categories (RootBeer, SafetyNet, Frida detection, RASP, etc.)
  • RASP Bypass: Authorized bypass runner with reusable profiles, DRY workflow
  • Data Flow Tracing: Source-to-sink methodology with confidence levels
  • MASVS Compliance: Automated scoring against OWASP MASVS controls with CVSS 4.0
  • APK Modification: Smali patching, repackaging, signing, validation

Installation

Prerequisites

Install required tools (Linux/macOS):

bash
# APKTool (3.0.1+)brew install apktool
# JADX (1.5.5+)brew install jadx
# Android SDK Platform Toolsbrew install --cask android-platform-tools
# Frida (17.9+)pip3 install frida-tools
# Objection (1.12.4+)pip3 install objection
# APKiD (3.0.0+)pip3 install apkid
# Semgrep (optional, for SAST)brew install semgrep

Skill Installation

bash
# Clone into your agent's skills directorycd ~/.agents/skills/git clone https://github.com/DragonJAR/Android-Pentesting-Skill dragonjar-android-pentesting
# Or clone to any location and add to agent skill pathgit clone https://github.com/DragonJAR/Android-Pentesting-Skill.git

Verification

bash
# Verify all dependencies are installedcd dragonjar-android-pentestingpython3 scripts/06-setup/preflight-check.py
# Expected output:# ✅ APKTool 3.0.1 found# ✅ JADX 1.5.5 found# ✅ Frida 17.9.4 found# ✅ All dependencies satisfied

Core Workflows

1. Basic APK Security Audit

bash
# Full static analysis with Semgrep enrichmentbash scripts/auto-audit-static.sh /path/to/app.apk --semgrep
# Output includes:# - Manifest security issues (exported components, permissions)# - Hardcoded secrets (API keys, passwords, tokens)# - Insecure crypto usage# - WebView vulnerabilities# - Intent injection risks# - Findings report in findings-merged.json

Example findings output:

json
{  "findings": [    {      "id": "HARD-001",      "severity": "CRITICAL",      "title": "Hardcoded API Key in Source Code",      "owasp_mobile": "M1",      "masvs_control": "MASVS-STORAGE-1",      "cvss": "9.1 (CRITICAL)",      "location": "com/example/app/Config.java:42",      "evidence": "private static final String API_KEY = \"sk_live_...\";",      "remediation": "Store API keys in BuildConfig or secure server-side configuration"    }  ]}

2. Runtime Defense Analysis (RASP Detection)

bash
# Detect runtime protections with passive + active modesbash scripts/02-rasp/runtime-defense-analyzer.sh \  /path/to/app.apk \  com.example.app \  --active-mode \  --authorized-lab \  --output findings-rda.json
# Catalog includes 18 protection categories:# - Root detection (RootBeer, custom native)# - Emulator detection# - Debug detection# - Frida/instrumentation detection# - Screenshot/screenrecord blocking# - SafetyNet / Play Integrity# - Commercial RASP (Talsec, AppSealing, DexGuard, etc.)

RDA output structure:

json
{  "detectors": {    "rootbeer": {      "status": "DETECTED",      "confidence": "high",      "evidence": "RootBeer.isRooted() returns true",      "bypass_profile": "rootbeer_standard"    },    "ssl_pinning": {      "status": "DETECTED",      "implementation": "OkHttp3 CertificatePinner",      "bypass_profile": "ssl_okhttp3"    }  }}

3. RASP Bypass Workflow (DRY Pattern)

bash
# 1) List available bypass profilesbash scripts/02-rasp/rasp-bypass-runner.sh --list-profiles
# Output:# Available profiles:# - rootbeer_standard (RootBeer library bypass)# - ssl_okhttp3 (OkHttp3 SSL pinning)# - ssl_trustmanager (TrustManager bypass)# - frida_detection (Anti-Frida bypass)# - emulator_detection (Emulator checks bypass)
# 2) Generate bypass command from RDA findings (print only)bash scripts/02-rasp/rasp-bypass-runner.sh \  --package com.example.app \  --from-rda findings-rda.json \  --print-command
# Output:# frida -U -f com.example.app \#   -l assets/frida-scripts/android-root-bypass-advanced.js \#   -l assets/frida-scripts/ssl-pinning-bypass.js \#   --no-pause
# 3) Execute bypass in authorized lab environmentbash scripts/02-rasp/rasp-bypass-runner.sh \  --package com.example.app \  --from-rda findings-rda.json \  --run \  --authorized-lab
# Launches Frida with combined bypass scripts

Important: Client-side bypasses do NOT forge server-side attestation. For Play Integrity, SafetyNet, Approov, or similar backend-enforced controls, use an authorized test tenant, backend allowlist, or approved lab configuration.

4. SSL Pinning Bypass

bash
# Universal SSL pinning bypass (30+ implementations)python3 scripts/07-tools/frida-exploit-helper.py \  -p com.example.app \  --script ssl-pinning-bypass
# Supports:# - OkHttp3 CertificatePinner# - TrustManager custom implementations# - WebView SSL error handlers# - React Native ssl-pinning libraries# - Flutter BoringSSL (native hooks)# - Cordova SSL plugins

5. Framework-Specific Analysis

React Native
bash
# Detect React Native and extract JavaScript bundlebash scripts/auto-audit-static.sh /path/to/app.apk
# Automatically:# - Detects libreactnativejni.so# - Extracts assets/index.android.bundle# - Scans bundle for hardcoded secrets# - Analyzes Metro bundler output

Hook React Native bridge:

javascript
// assets/frida-scripts/react-native-bridge-hook.jsJava.perform(function() {    var CatalystInstanceImpl = Java.use('com.facebook.react.bridge.CatalystInstanceImpl');        CatalystInstanceImpl.jniCallJSFunction.implementation = function(module, method, args) {        console.log('[RN Bridge] ' + module + '.' + method);        console.log('[RN Bridge] Args: ' + JSON.stringify(args));        return this.jniCallJSFunction(module, method, args);    };});
Flutter
bash
# Flutter uses Dart AOT compilation and native BoringSSL# Standard Java SSL hooks won't work
# Use Blutter for Dart code extractionpython3 tools/blutter/blutter.py lib/arm64-v8a/libapp.so output/
# Hook native SSL functionspython3 scripts/07-tools/frida-exploit-helper.py \  -p com.example.flutter \  --script flutter-ssl-bypass
# Hooks:# - SSL_CTX_set_custom_verify (certificate validation)# - SSL_read / SSL_write (traffic interception)

6. Data Flow Tracing

bash
# Phase 3: Source-to-sink analysis# Automatically runs during static audit
# Example traced flows:# - User input → SQL query (SQL injection risk)# - Intent extras → WebView.loadUrl (open redirect)# - SharedPreferences → network (data leakage)# - File paths → external storage (path traversal)

Flow confidence levels:

  • CONFIRMED: Direct observable flow without conditions
  • LIKELY: Flow with minimal conditional branches
  • POSSIBLE: Flow through complex logic, needs dynamic validation

7. MASVS Compliance Scoring

bash
# Calculate OWASP MASVS compliance scorepython3 scripts/05-reporting/masvs-scorer.py findings-merged.json
# Output:# MASVS Score: 72.6/100 (Grade: C)# Controls Passed: 16/23# Controls Failed: 7## Critical Failures:# - MASVS-STORAGE-1: Hardcoded secrets in code# - MASVS-CRYPTO-1: Weak cryptographic algorithms## Recommendations:# - Implement secure credential storage (Android Keystore)# - Upgrade to AES-256-GCM for encryption

8. APK Modification Workflow

bash
# Decode APKapktool d -f -o decoded/ /path/to/app.apk
# Modify smali code (example: disable root check)# Edit decoded/smali/com/app/RootDetector.smali# Change: const/4 v0, 0x1  (return true)# To:     const/4 v0, 0x0  (return false)
# Rebuild APKapktool b decoded/ -o app-modified.apk
# Align and signzipalign -v -p 4 app-modified.apk app-aligned.apkapksigner sign --ks ~/.android/debug.keystore \  --ks-pass pass:android \  --out app-signed.apk \  app-aligned.apk
# Verify signatureapksigner verify --verbose app-signed.apk

Frida Script Library

Common Frida Operations

bash
# List all available Frida scriptsls assets/frida-scripts/
# Key scripts:# - ssl-pinning-bypass.js (universal SSL bypass)# - android-root-bypass-advanced.js (30+ root detection bypasses)# - crypto-intercept.js (monitor Cipher, MessageDigest, etc.)# - biometric-bypass.js (BiometricPrompt, FingerprintManager)# - keystore-inspector.js (dump Keystore entries)# - webview-inspector.js (WebView debugging, JS injection)# - intent-fuzzer.js (Intent injection testing)

Frida Exploit Helper

bash
# List bundled scriptspython3 scripts/07-tools/frida-exploit-helper.py --list-scripts
# Hook memory functionspython3 scripts/07-tools/frida-exploit-helper.py \  -p com.example.app \  --hook malloc,free,memcpy
# SSL pinning bypasspython3 scripts/07-tools/frida-exploit-helper.py \  -p com.example.app \  --script ssl-pinning-bypass
# Memory layout analysispython3 scripts/07-tools/frida-exploit-helper.py \  -p com.example.app \  --layout
# Runtime defense detectionpython3 scripts/07-tools/frida-exploit-helper.py \  -p com.example.app \  --runtime-defense

Custom Frida Script Example

javascript
// Hook custom native functionJava.perform(function() {    var targetClass = Java.use('com.example.app.SecurityCheck');        targetClass.isDeviceSecure.implementation = function() {        console.log('[+] isDeviceSecure() called');        var result = this.isDeviceSecure();        console.log('[+] Original result: ' + result);        console.log('[+] Forcing return: true');        return true;    };        console.log('[+] Hooked isDeviceSecure()');});

Configuration

Environment Variables

bash
# Android SDK pathexport ANDROID_HOME="$HOME/Library/Android/sdk"export PATH="$PATH:$ANDROID_HOME/platform-tools:$ANDROID_HOME/build-tools/36.0.0"
# Frida server configurationexport FRIDA_SERVER_PORT=27042
# Optional: Semgrep API token for managed scanningexport SEMGREP_APP_TOKEN="your_token_here"
# Optional: Custom APKTool configexport APKTOOL_CONFIG="$HOME/.apktool/config.yml"

Bypass Profiles Configuration

json
// scripts/02-rasp/bypass-profiles.json{  "profiles": {    "rootbeer_standard": {      "description": "RootBeer library bypass",      "scripts": [        "assets/frida-scripts/android-root-bypass-advanced.js"      ],      "hooks": ["RootBeer.isRooted", "RootBeer.isRootedWithoutBusyBoxCheck"]    },    "ssl_okhttp3": {      "description": "OkHttp3 CertificatePinner bypass",      "scripts": [        "assets/frida-scripts/ssl-pinning-bypass.js"      ],      "hooks": ["CertificatePinner.check"]    }  }}

Common Patterns

Pattern 1: Full Security Assessment

bash
# 1) Static analysis with Semgrepbash scripts/auto-audit-static.sh app.apk --semgrep
# 2) Runtime defense detectionbash scripts/02-rasp/runtime-defense-analyzer.sh \  app.apk com.example.app \  --active-mode --authorized-lab \  --output findings-rda.json
# 3) MASVS scoringpython3 scripts/05-reporting/masvs-scorer.py findings-merged.json
# 4) Generate professional reportpython3 scripts/05-reporting/report-generator.py \  findings-merged.json \  findings-rda.json \  --output report.pdf

Pattern 2: Traffic Interception

bash
# 1) Set up proxy (Burp/ZAP)export HTTP_PROXY=127.0.0.1:8080export HTTPS_PROXY=127.0.0.1:8080
# 2) Install CA certificate on deviceadb push burp-ca.crt /sdcard/# Install via Settings → Security → Install from SD card
# 3) Bypass SSL pinningfrida -U -f com.example.app \  -l assets/frida-scripts/ssl-pinning-bypass.js \  --no-pause
# 4) Monitor traffic in proxy

Pattern 3: Root Detection Bypass Stack

bash
# Layer 1: Java-level root checksfrida -U -f com.example.app \  -l assets/frida-scripts/android-root-bypass-advanced.js \  --no-pause
# Layer 2: Native-level root checks (if detected)# Edit native-root-bypass.js to target specific native librariesfrida -U -f com.example.app \  -l assets/frida-scripts/android-root-bypass-advanced.js \  -l assets/frida-scripts/native-hook.js \  --no-pause

Pattern 4: Automated Secret Extraction

bash
# Extract and scan all stringsbash scripts/01-decompile/extract-strings.sh app.apk > strings.txt
# Scan with patternsgrep -E '(sk_live_|ghp_|AIza[0-9A-Za-z-_]{35})' strings.txt
# Deep search in decompiled codefind decoded/smali -name "*.smali" -exec grep -H "const-string.*sk_live" {} \;
# Search in JavaScript bundles (React Native/Cordova)find decoded/assets -name "*.bundle" -o -name "*.js" | \  xargs grep -E '(API_KEY|SECRET|PASSWORD).*=.*["\'][^"\']{20,}'

Troubleshooting

Issue: APKTool Decode Fails

bash
# Error: "brut.androlib.AndrolibException: Could not decode arsc file"
# Solution 1: Update APKTool to 3.0.1+brew upgrade apktool
# Solution 2: Use --only-main-classes flagapktool d --only-main-classes -f -o decoded/ app.apk
# Solution 3: Use legacy AAPT mode (not recommended)apktool d --use-aapt1 -f -o decoded/ app.apk

Issue: Frida Server Connection Failed

bash
# Error: "Failed to spawn: unable to find process with name 'com.example.app'"
# Solution 1: Verify Frida server is runningadb shell "su -c '/data/local/tmp/frida-server &'"
# Solution 2: Check Frida server version matches clientfrida --version  # Client versionadb shell "/data/local/tmp/frida-server --version"  # Server version
# Solution 3: Use spawn mode instead of attachfrida -U -f com.example.app  # Spawn mode# Instead of:frida -U com.example.app      # Attach mode

Issue: SSL Pinning Bypass Not Working

bash
# Flutter apps use native BoringSSL - Java hooks won't work# Solution: Use Flutter-specific native hooksfrida -U -f com.example.flutter \  -l assets/frida-scripts/flutter-ssl-bypass.js
# React Native apps may use custom native modules# Solution: Hook both Java and native SSL functionsfrida -U -f com.example.rn \  -l assets/frida-scripts/ssl-pinning-bypass.js \  -l assets/frida-scripts/native-hook.js

Issue: Runtime Defense Analysis Returns Empty Results

bash
# Passive mode only checks static indicators# Solution: Use --active-mode with authorized lab
bash scripts/02-rasp/runtime-defense-analyzer.sh \  app.apk com.example.app \  --active-mode \  --authorized-lab \  --output findings-rda.json
# Ensure device/emulator is accessibleadb devices  # Should show device
# Ensure app is debuggable or use rootadb shell "su -c 'pm list packages | grep example'"

Issue: MASVS Scorer Shows Low Score

bash
# Low scores indicate security gaps - this is expected behavior# Review failed controls:
python3 scripts/05-reporting/masvs-scorer.py findings-merged.json --verbose
# Common failure patterns:# - MASVS-STORAGE-1: Hardcoded secrets → Use Android Keystore# - MASVS-CRYPTO-1: Weak crypto → Upgrade to AES-256-GCM# - MASVS-NETWORK-1: No SSL pinning → Implement certificate pinning# - MASVS-RESILIENCE-1: No obfuscation → Apply ProGuard/R8

Agent Usage Examples

Example 1: Quick APK Audit

User: "Audit this APK: ~/Downloads/banking-app.apk"

Agent Actions:

bash
cd dragonjar-android-pentestingbash scripts/auto-audit-static.sh ~/Downloads/banking-app.apk --semgreppython3 scripts/05-reporting/masvs-scorer.py findings-merged.json

Agent Response: "Found 8 security issues: 2 CRITICAL (hardcoded API keys), 3 HIGH (exported activities without permissions), 2 MEDIUM (weak crypto), 1 LOW (debug logs). MASVS score: 68.2/100 (Grade: D). Report saved to findings-merged.json."

Example 2: Bypass SSL Pinning

User: "This banking app has SSL pinning. I need to intercept the login request."

Agent Actions:

bash
# Start Frida with SSL bypasspython3 scripts/07-tools/frida-exploit-helper.py \  -p com.banking.app \  --script ssl-pinning-bypass

Agent Response: "SSL pinning bypassed (OkHttp3 CertificatePinner detected). Configure your proxy (Burp/ZAP) to 127.0.0.1:8080. Restart the app and attempt login."

Example 3: Detect RASP Protections

User: "Check what runtime protections this app has."

Agent Actions:

bash
bash scripts/02-rasp/runtime-defense-analyzer.sh \  ~/Downloads/app.apk com.protected.app \  --active-mode --authorized-lab \  --output findings-rda.jsoncat findings-rda.json

Agent Response: "Detected 4 protections: RootBeer (root detection), custom emulator checks, Frida detection (anti-instrumentation), DexGuard obfuscation. Bypass profiles available: rootbeer_standard, frida_detection, emulator_detection. Run rasp-bypass-runner.sh to generate bypass command."

Example 4: Find Hardcoded Secrets in React Native

User: "This is a React Native app. Find any hardcoded API keys in the JavaScript bundle."

Agent Actions:

bash
bash scripts/auto-audit-static.sh ~/Downloads/rn-app.apkgrep -r "API_KEY\|api_key\|apiKey" decoded/assets/*.bundle

Agent Response: "Found 3 hardcoded secrets in assets/index.android.bundle: Firebase API key (line 4521), Stripe publishable key (line 8912), AWS access key ID (line 12045). Evidence saved to findings-merged.json with MASVS-STORAGE-1 control failure."

Advanced Topics

Native Code Analysis

bash
# Extract native librariesunzip app.apk "lib/*" -d native/
# Analyze with Ghidra/IDA (manual)# Or use Frida for runtime analysis:
python3 scripts/07-tools/frida-exploit-helper.py \  -p com.example.app \  --hook JNI_OnLoad,RegisterNatives
# Hook specific native function by offsetfrida -U -f com.example.app -l - << 'EOF'var base = Module.findBaseAddress('libnative.so');Interceptor.attach(base.add(0x1234), {    onEnter: function(args) {        console.log('[+] Native function called');        console.log('Arg0: ' + args[0]);    }});EOF

Attestation Bypass Limitations

markdown
**Important**: Client-side hooks cannot forge server-verified attestation:
- ❌ Play Integrity verdicts (Google server-signed)- ❌ SafetyNet attestation responses- ❌ Approov tokens (server-side verification)- ❌ App Attest (Apple server validation)
**Authorized Testing Approaches**:- ✅ Use test tenant with backend allowlist- ✅ Configure mock verifier in staging environment- ✅ Request official pentest exception from vendor- ✅ Use approved lab environment with vendor cooperation

Custom Semgrep Rules

yaml
# Add custom rule to scripts/03-static-analysis/semgrep-rules/
rules:  - id: custom-api-key-pattern    pattern: |      const-string $VAR, "cust_$KEY"    message: Custom API key pattern detected    severity: ERROR    languages: [smali]    metadata:      owasp_mobile: M1      masvs_control: MASVS-STORAGE-1

References

License

Apache 2.0 - See LICENSE file for details.

来源与署名

来源：reason-machines/security-skills位于skills/dragonjar-android-pentesting-skill提交304c245

许可证： 无许可证

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

更多来自 reason-machines/security-skills 的技能

Vibe Pentest Ai Security Testing

reason-machines

面向 Web 应用、API 和管理后台的 AI 多智能体自动化渗透测试，输出安全报告。

Security112个月前更新

Unisecurityguard Academic Whistleblower Archive

reason-machines

指导搭建基于 GitHub 的学术职场举报与遭审查社交媒体证据存档平台。

Security112个月前更新

Security Detections Mcp

reason-machines

用于搜索和分析安全检测规则并映射 MITRE ATT&CK 覆盖范围的 MCP 服务器技能。

Security112个月前更新

Security Threat Awareness

reason-machines

提醒用户警惕伪装成破解安全软件的 GitHub 恶意软件分发仓库。

Security112个月前更新

S800 Vehicle Network Security Testing

reason-machines

指导汽车 CAN 总线与车载网络的安全测试，涵盖流量捕获、模糊测试、ECU 扫描、重放与 UDS 诊断。

Security112个月前更新

Pentest Agents Bug Bounty Framework

reason-machines

自主漏洞赏金框架，包含狩猎代理、验证关卡、漏洞利用链和平台 MCP 服务器。

Security112个月前更新

更多Security技能

Kyc Rules

anthropics

精选

将公司的 KYC/AML 规则表应用于已解析的开户记录，评定风险并给出处理路由。

Security39K2周前更新

Compliance Tracking

anthropics

精选

跟踪合规要求、审计准备情况以及 SOC 2、ISO 27001、GDPR、HIPAA 和 PCI DSS 等框架的证据。

Security27K今天更新

Dpop Adoption

google

精选

指导为 Google OAuth 平台实现 OAuth 2.0 DPoP（RFC 9449）发送方约束刷新令牌。

Security21K今天更新

Secops Triage

google

精选

指导 SOC 分析师对 Google SecOps 安全告警进行分诊，从调查到关闭或升级。

Security21K今天更新

Secops Investigate

google

精选

指导 SOC 分析师在 Google SecOps 中使用 UDM 查询和时间线进行深入的安全事件与实体调查。

Security21K今天更新

Secops Hunt

google

精选

指导在 Google SecOps 中使用 UDM 查询、IoC 回溯、普遍性与异常分析进行主动威胁狩猎。

Security21K今天更新