Cybersecurity
Mobile Pentest
Mobile app pentest for bug bounty (Android APK + iOS IPA) — runtime-first workflow: install app, proxy through Burp/mitmproxy, drive the UI, capture packets, then test the API exactly like a web target; escalate to decompile (apktool/jadx) and Frida/objection only when traffic is SSL-pinned, encrypted, or absent. Covers APK/IPA decompile for hardcoded secrets + hidden API endpoints + base URLs the web app never exposes, exported-activity and deeplink intent injection, WebView addJavascriptInterface bridge abuse, SSL pinning bypass (objection patchapk / Frida CertificatePinner + checkServerTrusted hooks), OkHttp interceptor chain to recover request signing, JNI native-lib triage, and the quick apktool/grep secret + endpoint sweep. Use when the program scope includes a mobile app, when web recon dries up and you need a fresh attack surface, or when traffic is pinned and you must MitM it.
- Publisher / source
- awarexone/Agentic-Bug-Hunter (found on GitHub top repositories)
- Upstream record
- awarexone/Agentic-Bug-Hunter
- Version
- Version 1
- Published
- Publication review
- Approved for publication
- Content fingerprint
74690f0bcf60e1010885cb06e7ae677a9305f7f035638a3cf17923d0367f0f46