
You are performing a security assessment of an Android APK for an authorized client.

**Static Analysis**
- How do you extract and examine an APK? What does `apktool d` give you vs `jadx`?
- What does the AndroidManifest.xml reveal? (permissions, exported components, backup settings, debuggable flag)
- What exported Activities, Services, Broadcast Receivers, and Content Providers represent attack surface?
- How do you identify hardcoded API keys, credentials, or endpoints in decompiled Java/Kotlin code?

**Dynamic Analysis Setup**
- How do you set up a rooted Android emulator or physical device for dynamic testing?
- How do you proxy Android traffic through Burp Suite? (certificate installation, proxy settings)
- What is SSL pinning and how do you bypass it? (Frida, objection, network_security_config manipulation)

**Runtime Analysis**
- How do you use Frida to hook Java methods at runtime?
- How do you monitor file system access, shared preferences, and SQLite databases during app usage?
- How do you intercept and modify runtime function calls to bypass authentication?

**Data Storage**
- Where do Android apps commonly store sensitive data insecurely? (SharedPreferences, SQLite, external storage, logcat)
- How do you extract and examine app data on a rooted device?
- What does "backup allowed" in the manifest mean for data exposure?

**Common Vulnerabilities**
- What is a deep link vulnerability and how do you exploit an exported Activity?
- What is a Content Provider injection?

Output:
- Static analysis checklist
- Frida script template for SSL pinning bypass
- Common finding list with severity ratings


Android APK Security Analysis


You are performing an iOS application security assessment on a jailbroken test device.

**Static Analysis**
- How do you decrypt an App Store IPA for static analysis? (Tools: frida-ios-dump, bagbak)
- What does the Info.plist reveal? (URL schemes, permissions, ATS configuration, entitlements)
- How do you examine App Transport Security (ATS) settings and what misconfigurations are high risk?
- How do you decompile a Swift/Objective-C binary? (Hopper, Ghidra, class-dump)

**Dynamic Analysis**
- How do you set up Burp Suite to capture iOS traffic on a jailbroken device?
- What is iOS SSL pinning and what are the three main bypass approaches? (Frida hooks, SSL Kill Switch, objection)
- How do you use objection without writing Frida scripts?

**Data Storage**
- What are the iOS data storage locations and which are insecure by default? (NSUserDefaults, Keychain, SQLite, plist files, CoreData)
- What does the NSUserDefaults store and how do you extract it?
- How does the iOS Keychain work and what protection classes matter?

**Jailbreak Detection Bypass**
- What checks do apps commonly perform to detect jailbreaks?
- How do you bypass jailbreak detection with Frida or Liberty Lite?

**Binary Analysis**
- What is ASLR, PIE, ARC, and stack canaries on iOS and how do you verify them?
- What does a missing PIE flag indicate?

Output:
- iOS assessment workflow checklist
- Common vulnerabilities and their iOS-specific manifestations
- Frida / objection command reference for iOS


iOS Application Security Assessment


You are testing the backend APIs consumed by a mobile application as part of an authorized mobile security assessment.

**API Discovery**
- How do you identify all API endpoints used by a mobile app? (traffic interception, static analysis, JS files)
- What does examining network requests during app usage reveal beyond what static analysis shows?
- How do you test endpoints that are not triggered during normal app flows?

**Authentication & Authorization**
- How do mobile APIs typically authenticate? (JWT, OAuth2, custom tokens, API keys)
- How do you test for JWT vulnerabilities? (none algorithm, weak secret, algorithm confusion)
- How do you test for broken object-level authorization (BOLA/IDOR) on mobile APIs?
- How do you test for broken function-level authorization? (accessing admin endpoints as a regular user)

**Session Management**
- What is the mobile token lifecycle and where are tokens stored on device?
- How do you test for token leakage in logs, URLs, or error messages?
- What happens if you reuse a token after logout?

**Input Validation**
- How do mobile APIs differ from web APIs in input handling?
- What injection types are most relevant in mobile API contexts? (SQLi, NoSQLi, command injection)

**API Versioning & Deprecated Endpoints**
- How do you discover older API versions (v1, v2) that may lack modern security controls?
- What do outdated API endpoints typically expose that current versions do not?

**Rate Limiting & Enumeration**
- How do you test for rate limiting on authentication, OTP, and password reset endpoints?
- What does missing rate limiting on a PIN verification endpoint mean for an attacker?

Output:
- Mobile API testing checklist
- Common findings with CVSS scoring notes
- Burp Suite workflow for mobile API testing


Mobile API Security Testing


You are testing a mobile application that implements SSL pinning, preventing you from intercepting HTTPS traffic with a proxy.

**Understanding SSL Pinning**
- What is SSL pinning and why do developers implement it?
- What are the three main implementation approaches: certificate pinning, public key pinning, and SPKI pinning?
- How do you confirm that pinning is active and not just a failed proxy configuration?

**Bypass Techniques**

*Frida-based Bypass*
- How does a generic Frida SSL pinning bypass script work?
- What Android API methods does it hook and why? (TrustManager, HostnameVerifier, OkHttp CertificatePinner)
- When does a generic script fail and what custom hooks do you need to write?

*Objection*
- What does `android sslpinning disable` actually do under the hood?
- How reliable is objection's built-in bypass across different app implementations?

*Network Security Config Manipulation*
- How can you patch an Android APK to disable pinning in the network_security_config.xml?
- What does the `<trust-anchors>` element do and how do you add the system CA?
- How do you repackage and sign the modified APK?

*iOS Bypass*
- What does SSL Kill Switch 2 or SSL Kill Switch 3 patch in iOS?
- When does you need a custom Frida hook for iOS vs the off-the-shelf tool?

**Advanced Pinning**
- What is certificate transparency pinning and is it bypassable with the same methods?
- What does "custom TLS implementation" mean and why is it harder to bypass?

Output:
- Bypass decision tree by implementation type
- Frida script template with common Android hook targets
- APK patching workflow for network_security_config


Mobile Security

Android APK Security Analysis

iOS Application Security Assessment

Mobile API Security Testing

SSL Pinning Bypass Techniques