Agent skill · security · yaklang
android-pentesting-tricks
Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redirection, root detection bypass, tapjacking, and backup extraction during authorized mobile security assessments.
Why this skill is useful
Adds executable scripts and detailed techniques for bypassing security measures in Android applications that are not commonly known.
What it needs
Requires adb, frida, objection installed locally. About 7k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Android Pentesting Tricks — Expert Attack Playbook AI LOAD INSTRUCTION: Expert Android application security testing techniques. Covers SSL pinning bypass (Frida/Objection/LSPosed), component exposure, WebView exploitation, intent redirection, root detection bypass, and Play Integrity evasion. Base models miss Frida hook specifics and multi-layer bypass chains. 0. RELATED ROUTING Before going deep, consider loading: mobile-ssl-pinning-bypass for in-depth cross-platform SSL pinning bypass techniques and framework-specific hooks ios-pentesting-tricks when also testing the iOS version of the same app api-sec for backend API security testing once traffic is intercepted Advanced Reference Also load FRIDASCRIPTS.md when you need: Ready-to-use Frida script templates for common Android testing tasks Detailed hook points for OkHttp, Retrofit, Volley, WebView Root detection bypass script collection --- 1. SSL PINNING BYPASS 1.1 Frida Universal Bypass Hook Point Library/Class Coverage --- --- --- X509TrustManager.checkServerTrusted Android SDK All standard HTTPS OkHttpClient.Builder.sslSocketFactory OkHttp 3.x/4.x Square OkHttp CertificatePinner.check OkHttp 3.x/4.x OkHttp pinning HttpsURLConnection.setSSLSocketFactory Android SDK Legacy HTTPS SSLContext.init Android SDK Custom SSL contexts WebViewClient.onReceivedSslError WebView WebView SSL errors TrustManagerFactory.getTrustManagers Android SDK Factory-created TMs 1.2 Objection (Quick Method) 1.3 Network Security Config (Debug Builds) If you can modify the APK or it's a debug build: 1.4 Magisk Module Approach Module Method Scope --- --- --- LSPosed + TrustMeAlready Hooks system-wide TrustManager All apps LSPosed + SSLUnpinning Targeted SSL bypass Per-app MagiskTrustUserCerts Moves user CA to system store All apps trusting system CAs ConscryptTrustUserCerts Patches Conscrypt Newer Android (7+) --- 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/android-pentesting-tricks