Back to Details

mobile-security

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Mobile Security

移动安全

Scope

范围

End-to-end mobile application VAPT for Android (APK/AAB) and iOS (IPA), aligned to the OWASP MASVS v2.x control groups and the MASTG testing process. Four complementary tiers:
  1. Static reverse engineering of compiled artifacts — Dart AOT snapshots, Unity IL2CPP, React Native/Hermes bytecode, native ARM64 
    .so
    /Mach-O, smali. Recover secrets, endpoints, and the crypto contract without a device.
  2. SAST — manifest / 
    Info.plist
    , exported-component & IPC surface, WebView, local storage, cryptographic-primitive weakness, code-signing, and automated baseline (MobSF/apkid/apkleaks) → then manual deep-dive.
  3. Dynamic analysis (DAST) — Frida/objection instrumentation, traffic interception, TLS-pinning bypass across stacks, Keychain/Keystore runtime dumps, IPC probing, and root/jailbreak/anti-tamper defeat for MAS-L2 / MASA scope.
  4. Privacy — data-collection inventory, tracker/SDK enumeration, PII leakage, declared-vs-actual (Play Data Safety / Apple Privacy Manifest).
Static dump first (faster, no device); dynamic is a first-class phase whenever a control can only be proven at runtime (enforced pinning, Keystore-backed keys, root reaction, IPC guards). Cross-asset stitching, scoring, and reporting are owned by sibling skills — this skill produces MASVS/MASTG-tagged findings and hands them off.
面向 Android（APK/AAB） 和 iOS（IPA） 的端到端移动应用 VAPT，对齐 OWASP MASVS v2.x 控制组和 MASTG 测试流程。四个互补层级：
  1. 静态逆向工程——对编译产物进行分析，包括 Dart AOT 快照、Unity IL2CPP、React Native/Hermes 字节码、原生 ARM64 
    .so
    /Mach-O、smali。无需设备即可提取敏感信息、API 端点和加密契约。
  2. SAST——manifest / 
    Info.plist
    、导出组件与 IPC 攻击面、WebView、本地存储、加密原语弱点、代码签名，以及自动化基线（MobSF/apkid/apkleaks）→ 随后进行人工深度排查。
  3. 动态分析（DAST）——Frida/objection instrumentation、流量拦截、跨技术栈的 TLS pinning 绕过、Keychain/Keystore 运行时转储、IPC 探测，以及针对 MAS-L2 / MASA 范围的 root/jailbreak/anti-tamper 绕过。
  4. 隐私——数据收集清单、tracker/SDK 枚举、PII 泄露、声明与实际情况对比（Play Data Safety / Apple Privacy Manifest）。
优先进行静态转储（速度更快，无需设备）；对于只能在运行时证明的控制项，动态分析是一等阶段（强制执行的 pinning、Keystore-backed keys、root 反应、IPC 防护）。跨资产关联、评分和报告由同级 skill 负责——本 skill 生成带 MASVS/MASTG 标签的发现项并移交给它们。

Coverage contract

覆盖契约

In a coverage-mode engagement (
pentest-engagement
mobile mode) completion is code-enforced, not narrative. Two surfaces are gated, and both are mandatory:
SurfaceFileClasses
The app bundle
recon/inventory/mobile-surface.json
the 15 
MAS-*
MASVS classes
The backend recovered from the bundle
<apex>-api/recon/inventory/surface.json
the ordinary OWASP API/web classes
The second row is where the material risk has historically been. A decompiled bundle hands you the full server contract, and that surface is not browser-reachable — so it is systematically under-tested by everyone, including the app's own developers. Recovering the endpoint inventory and driving it through the API classes is not an optional extra; a bundle that yields zero endpoints is treated as a failed acquisition.
Per-class detail: 
reference/masvs-class-map.md
. Two rules worth internalising before you write a negative:
  • proof_mode: runtime
    cannot be closed statically.     Pinning and root detection are the classic traps: static analysis can prove a control is inert (a 
    CertificatePinner
    built and never attached, a RootBeer that no DEX references) — raise that as a positive. It can never prove the control is effective; that needs a bypass attempt that failed, and a failed bypass is a legitimate, reportable result.
  • proof_mode: static
    can never be device-deferred.     No device does not excuse the manifest, the signature, the bundled dependencies, or the secrets in the artifact.
在 coverage mode 评估项目（
pentest-engagement
mobile mode）中，完成情况由代码强制判定，而不是依赖叙述性结论。以下两个攻击面均受门禁控制，且都是强制项：
攻击面文件类别
应用包
recon/inventory/mobile-surface.json
15 个 
MAS-*
MASVS 类别
从应用包中恢复出的后端
<apex>-api/recon/inventory/surface.json
常规 OWASP API/web 类别
第二行历来是重大风险所在。反编译后的应用包会向你提供完整的服务器契约，而该攻击面无法通过浏览器访问——因此所有人都会系统性地对其测试不足，包括应用自己的开发者。恢复端点清单并使用 API 类别对其进行测试不是可选的额外步骤；如果一个应用包未提取出任何端点，则视为获取失败。
各类别详情：
reference/masvs-class-map.md
。在编写否定结论前，有两条规则值得牢记：
  • proof_mode: runtime
    不能在静态阶段结项。     Pinning 和 root 检测是典型的陷阱：静态分析可以证明某项控制处于未实际生效状态（一个已创建但从未附加的 
    CertificatePinner
    ，或没有任何 DEX 引用的 RootBeer）——应将其作为正面结论提出。但静态分析永远无法证明控制有效；这需要一次未成功的绕过尝试，而绕过失败本身也是合理且可报告的结果。
  • proof_mode: static
    不能推迟到设备阶段。     没有设备不能成为跳过 manifest、签名、捆绑依赖或产物中敏感信息的理由。

When to use

何时使用

  • Target ships an Android APK/AAB or iOS IPA — extract and inspect before any runtime testing.
  • Built with Flutter (
    lib/arm64-v8a/libapp.so
    / iOS 
    App.framework
    ), Unity (
    libil2cpp.so
    + 
    global-metadata.dat
    ), or React Native + Hermes (
    libhermes.so
    + 
    index.android.bundle
    ) — needs a runtime-aware decompiler, not just jadx.
  • Stock Android/iOS app — you need the manifest/IPC/storage/crypto/signing attack surface (SAST) and, where a control is runtime-only, dynamic confirmation.
  • App uses encrypted API envelopes (KEY/IV/SALT/SIGNATURE headers) and you need to reverse the crypto contract, then replay against the live API.
  • TLS pinning / root / jailbreak detection blocks testing — bypass it dynamically (or defeat it statically) and demonstrate the protected flow.
  • You suspect IDOR / mass assignment / business-logic flaws easier to find in the dumped client, then confirmed server-side.
  • You need a MASVS-PRIVACY pass (trackers, over-collection, PII leakage, declared-vs-actual).
  • 目标交付的是 Android APK/AAB 或 iOS IPA——在任何运行时测试之前先提取并检查。
  • 使用 Flutter（
    lib/arm64-v8a/libapp.so
    / iOS 
    App.framework
    ）、Unity（
    libil2cpp.so
    + 
    global-metadata.dat
    ）或 React Native + Hermes（
    libhermes.so
    + 
    index.android.bundle
    ）构建——需要使用具备运行时感知能力的反编译器，而不只是 jadx。
  • 标准 Android/iOS 应用——需要分析 manifest/IPC/storage/crypto/signing 攻击面（SAST），并对仅在运行时存在的控制项进行动态确认。
  • 应用使用加密 API envelope（KEY/IV/SALT/SIGNATURE headers），需要逆向加密契约，然后针对实时 API 进行重放。
  • TLS pinning / root / jailbreak 检测阻碍测试——动态绕过（或静态击败）它，并证明受保护流程。
  • 怀疑存在更容易在转储的客户端中发现的 IDOR / mass assignment / business-logic 缺陷，然后在服务端确认。
  • 需要进行 MASVS-PRIVACY 检查（tracker、过度收集、PII 泄露、声明与实际情况对比）。

Methodology

方法论

Start at reference/methodology.md — the phase backbone (ACQUIRE → TRIAGE → STATIC → DYNAMIC → NETWORK → STORAGE → PLATFORM/IPC → BACKEND PIVOT → REPORT), app acquisition + evidence integrity, the MASVS→file coverage map, finding-tagging convention, and the client→API pivot. It routes to every reference below. Do preflight (../coordination/reference/preflight-checklist.md) first.
从 reference/methodology.md 开始——该文档是整个流程的阶段主干（ACQUIRE → TRIAGE → STATIC → DYNAMIC → NETWORK → STORAGE → PLATFORM/IPC → BACKEND PIVOT → REPORT），涵盖应用获取与证据完整性、MASVS→文件覆盖映射、发现项标记约定，以及客户端→API 转向。它会引导至下方每份参考文档。务必先执行预检（../coordination/reference/preflight-checklist.md）。

References

参考文档

Cross-cutting
  • reference/methodology.md — the hub: phases, acquisition (adb pull / bundletool / ipatool), MASVS/MASTG tagging, backend pivot.
  • reference/privacy-testing.md — MASVS-PRIVACY for both platforms: trackers/SDKs, PII channels, declared-vs-actual.
Android
  • reference/android-static-analysis.md — SAST: MobSF/apkid/apkleaks baseline, manifest & exported-component/IPC, ContentProvider SQLi/traversal, PendingIntent, deep links, native WebView RCE, storage & Keystore review, crypto-primitive weakness pass, NSC, apksigner/Janus, SBOM.
  • reference/android-dynamic-analysis.md — DAST: device/Magisk/Zygisk setup, frida-server bring-up, objection recipes, interception + Android-7 user-CA workarounds, cross-stack pinning bypass (OkHttp/BoringSSL-Flutter/RN), drozer IPC, runtime storage, RESILIENCE active bypass + repack/resign.
iOS
  • reference/ios-static-analysis.md — SAST: IPA acquisition + FairPlay decrypt (cryptid), Mach-O/ObjC/Swift RE, ATS, entitlements/provisioning, binary hardening, Keychain accessibility + Data Protection, URL schemes/Universal Links, WKWebView, pasteboard/snapshot, MobSF/SBOM.
  • reference/ios-dynamic-analysis.md — DAST: jailbroken vs non-JB (objection patchipa / frida-gadget) bring-up, objection/Frida on iOS, SSL Kill Switch / SecTrust pinning bypass, Keychain dump, LAContext biometric bypass, jailbreak/anti-debug defeat, method tracing.
Framework-specific reverse engineering
  • reference/flutter-aot-reversing.md — Flutter/Dart AOT with blutter; HTTP crypto-envelope patterns (fast_rsa OAEP-SHA256 + AES-256-CBC) and the weaknesses to report.
  • reference/scenarios/android/react-native-hermes.md — RN+Hermes: HBC-version check, decompile 
    index.android.bundle
    with hermes-dec, BuildConfig secret fast-path, RN-specific MASVS surface.
  • reference/scenarios/android/native-lib-host-extraction.md — host-side 
    dlopen
    of an Android 
    .so
    with a Bionic→glibc forwarder + 
    strcmp
    /
    memcmp
    interceptor (no Frida/emulator).
Cross-skill (reused capabilities — cross-linked, not duplicated)
  • ../reverse-engineering/reference/scenarios/static-analysis/unity-il2cpp-recipe.md — Unity 
    libil2cpp.so
    + 
    global-metadata.dat
    dump (Il2CppDumper/Il2CppInspector).
  • ../reverse-engineering/reference/scenarios/dynamic-analysis/frida-hooking.md — Frida hooking primitives (spawn/attach, Interceptor, Stalker, 
    Java.perform
    , ObjC hooks) used by both dynamic files.
  • ../reverse-engineering/reference/scenarios/obfuscation/packed-binaries.md — packer / anti-analysis unpacking for obfuscated APKs/
    .so
    .
  • ../reverse-engineering/reference/scenarios/obfuscation/hash-dispatcher-chain.md — Z3 over polynomial-hash dispatcher chains in a native 
    .so
    .
  • ../api-security/reference/scenarios/rest/owasp-bola-bopla.md · ../api-security/reference/scenarios/rest/mass-assignment.md — the client→API pivot for endpoints/IDOR recovered from the client.
Deterministic control-wiring detector
  • ../../tools/apk_control_wiring.py
     — static cross-reference over a decompiled Android tree that distinguishes a REAL applied control from an ORPHANED one: RootBeer/SafetyNet/Play-Integrity shipped-but-unwired (referenced but the result gates nothing), 
    CertificatePinner
    built-but-not-attached to an OkHttpClient, hardcoded AES/DES key literals + their invoke-sites, and bundled-but-never-loaded 
    .so
    . Run it in the STATIC phase BEFORE authoring remediation verdicts — a naive re-test that only greps for the control's presence wrongly reports an inert control "fixed" (a recurring mobile re-test crux).
通用
  • reference/methodology.md——枢纽文档：阶段、应用获取（adb pull / bundletool / ipatool）、MASVS/MASTG 标记、后端转向。
  • reference/privacy-testing.md——面向两个平台的 MASVS-PRIVACY：tracker/SDK、PII 通道、声明与实际情况对比。
Android
  • reference/android-static-analysis.md——SAST：MobSF/apkid/apkleaks 基线、manifest 与导出组件/IPC、ContentProvider SQLi/路径遍历、PendingIntent、deep links、原生 WebView RCE、storage 与 Keystore 审查、加密原语弱点专项检查、NSC、apksigner/Janus、SBOM。
  • reference/android-dynamic-analysis.md——DAST：设备/Magisk/Zygisk 环境搭建、frida-server 启动、objection 操作方案、拦截与 Android 7 用户 CA 变通方案、跨技术栈 pinning 绕过（OkHttp/BoringSSL-Flutter/RN）、drozer IPC、运行时存储、RESILIENCE 主动绕过及重打包/重新签名。
iOS
  • reference/ios-static-analysis.md——SAST：IPA 获取与 FairPlay 解密（cryptid）、Mach-O/ObjC/Swift RE、ATS、entitlements/provisioning、二进制加固、Keychain 可访问性与 Data Protection、URL schemes/Universal Links、WKWebView、pasteboard/快照、MobSF/SBOM。
  • reference/ios-dynamic-analysis.md——DAST：jailbroken 与 non-JB 环境搭建（objection patchipa / frida-gadget）、iOS 上的 objection/Frida、SSL Kill Switch / SecTrust pinning 绕过、Keychain 转储、LAContext 生物识别绕过、越狱/反调试对抗、方法追踪。
框架专项逆向工程
  • reference/flutter-aot-reversing.md——使用 blutter 对 Flutter/Dart AOT 进行分析；HTTP 加密信封模式（fast_rsa OAEP-SHA256 + AES-256-CBC）以及需要报告的弱点。
  • reference/scenarios/android/react-native-hermes.md——RN+Hermes：HBC 版本检查、使用 hermes-dec 反编译 
    index.android.bundle
    、BuildConfig secret 快速路径、RN 专项 MASVS 攻击面。
  • reference/scenarios/android/native-lib-host-extraction.md——在宿主侧对 Android 
    .so
    执行 
    dlopen
    ，配合 Bionic→glibc forwarder 与 
    strcmp
    /
    memcmp
    拦截器（无需 Frida/emulator）。
跨 skill（复用能力——交叉引用，不重复）
  • ../reverse-engineering/reference/scenarios/static-analysis/unity-il2cpp-recipe.md——转储 Unity 
    libil2cpp.so
    + 
    global-metadata.dat
    （Il2CppDumper/Il2CppInspector）。
  • ../reverse-engineering/reference/scenarios/dynamic-analysis/frida-hooking.md——Frida hooking 原语（spawn/attach、Interceptor、Stalker、
    Java.perform
    、ObjC hooks），供两份动态分析文档使用。
  • ../reverse-engineering/reference/scenarios/obfuscation/packed-binaries.md——针对混淆 APK/
    .so
    的 packer / anti-analysis 解包。
  • ../reverse-engineering/reference/scenarios/obfuscation/hash-dispatcher-chain.md——使用 Z3 分析原生 
    .so
    中的多项式哈希分派链。
  • ../api-security/reference/scenarios/rest/owasp-bola-bopla.md · ../api-security/reference/scenarios/rest/mass-assignment.md——针对从客户端恢复出的端点/IDOR 执行 client→API pivot。
确定性控制项接线检测器
  • ../../tools/apk_control_wiring.py
    ——对反编译后的 Android 目录树执行静态交叉引用，区分真正生效的控制与孤立控制：RootBeer/SafetyNet/Play-Integrity 已包含但未接线（虽有引用，但其结果不控制任何逻辑）、
    CertificatePinner
    已创建但未附加到 OkHttpClient、硬编码 AES/DES 密钥字面量及其调用点，以及已捆绑但从未加载的 
    .so
    。在编写修复结论前，应于 STATIC 阶段运行该工具——仅通过 grep 检查控制项是否存在的简单复测，会错误地把未生效的控制报告为“已修复”（这是移动端复测中反复出现的难点）。

Anti-patterns

反模式

  • Reaching for Frida/emulator before the static dump exists — static-first is faster and needs no device. But do not treat dynamic as out of scope: pinning enforcement, Keystore binding, root reaction, and IPC reachability are runtime-only.
  • Reporting a control as present (root/pinning/tamper detection) without an active bypass attempt — MAS-L2 / MASA require you defeat it or prove you can't.
  • Concluding "no pinning" from an empty 
    network_security_config.xml
    , or "no secrets" from a 
    cryptid 1
    iOS binary — check the JS/native pin layers, and decrypt the IPA first.
  • Stopping at a client-side IDOR — it is a server-side hypothesis; confirm via the api-security pivot.
  • Reporting a CVE from a library's mere presence — confirm the exact version and a reachable code path.
  • 静态转储尚未生成就急着使用 Frida/emulator——静态优先更快且无需设备。但不要将动态分析排除在范围之外：pinning 强制执行、Keystore 绑定、root 反应、IPC 可达性都只能在运行时验证。
  • 在未进行主动绕过尝试的情况下，就报告某项控制（root/pinning/tamper detection）已存在——MAS-L2 / MASA 要求你击败它，或证明你无法击败。
  • 仅凭空的 
    network_security_config.xml
    就得出“没有 pinning”的结论，或仅凭 
    cryptid 1
    的 iOS 二进制文件就得出“没有 secrets”的结论——应检查 JS/native pinning 层，并先解密 IPA。
  • 止步于客户端 IDOR——它只是服务端假设；应通过 api-security pivot 确认。
  • 仅因库存在就报告 CVE——必须确认准确版本以及可达代码路径。