AgentStack
Browse Sign in
Browse Why AgentStack Sell Docs
Sign in
SKILL verified MIT Self-run

Android Pentest

skill-unclecheng-li-vulnclaw-android-pentest · by Unclecheng-li

安卓应用渗透测试 — APK分析、Hook、自动化测试、运行态驱动、签名恢复、抓包分析

↗ Repository
— No reviews yet
0 installs
4 views
0.0% view→install

Install

$ agentstack add skill-unclecheng-li-vulnclaw-android-pentest

✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • ✓ Prompt-injection patterns
  • ✓ Secret / credential exfiltration
  • ✓ Dangerous shell & filesystem operations
  • ✓ Untrusted network calls
  • ✓ Known-malicious package signatures

What it can access

  • ✓ Network access No
  • ✓ Filesystem access No
  • ✓ Shell / process execution No
  • ✓ Environment & secrets No
  • ✓ Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

View the full security report →

Verified badge

Passed review? Show it. Paste this badge into your README, it links to the public security report.

AgentStack Verified badge Links to your public security report.
[![AgentStack Verified](https://agentstack.voostack.com/badges/verified.svg)](https://agentstack.voostack.com/security/report/skill-unclecheng-li-vulnclaw-android-pentest)

Reliability & compatibility

✓ Security review passed
0 installs to date
— no reviews yet
● 1mo ago

Declared compatibility

Claude CodeClaude Desktop

Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.

Preview Execution monitoring

We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.

How agent discovery & health will work →
Are you the author of Android Pentest? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

安卓应用渗透测试 Skill

针对安卓应用的专项渗透测试，遵循 runtime-first 原则：先运行态驱动、先抓包，最后才逆向。

需要更深入的客户端逆向知识？ 使用 client-reverse Skill，包含完整的签名恢复、加密还原、Burp 重放工作流。

核心原则

不要先逆向 APK。默认操作顺序：

  1. 确认目标 App 已安装在连接设备上
  2. 准备好 Burp 或 Charles 抓包
  3. 用 scrcpy_vision 驱动真实业务流程
  4. 每个关键动作后检查抓包状态
  5. 包可见且可重放 → 直接做 Web/API 安全测试
  6. 只有抓不到包/包被加密时 → 升级到 jadx/frida/ida

1. 环境准备

  • 通过 adb-mcp 连接设备/模拟器
  • 通过 jadx 反编译目标 APK
  • 通过 burp-mcp 配置代理抓包

2. 自动化探索

  • 启动 APP，通过 adb-mcp 自动截图
  • 通过 frida-mcp Hook 关键函数
  • 通过 burp-mcp 捕获和分析数据流
  • 自动点击 UI 元素，遍历功能点
  • 模拟用户行为，识别敏感数据流

3. 深度分析

  • 通过 jadx 审计源码（硬编码密钥、弱加密等）
  • 通过 frida 动态 Hook（SSL Pinning 绕过、参数篡改）
  • 通过 burp 修改重放请求（鉴权绕过、越权测试）

4. 漏洞验证

  • 构造恶意输入，验证漏洞
  • 截图记录漏洞证据
  • 生成 PoC

5. 输出

  • 安卓专项渗透报告
  • 包含截图、流量、代码审计结果

参考文档

  • references/android-authorized-app-pentest-sop.md — 安卓 App 渗透 SOP
  • references/android-external-url-runtime-first-workflow.md — 安卓外部 URL 测试
  • references/android-ui-driven-observation-and-packet-loop.md — UI 驱动观察循环
  • references/android-network-layer-testing-quick-reference.md — 网络层测试速查
  • references/android-signing-and-crypto-workflow.md — 签名与加密工作流
  • references/android-static-triage-and-callflow.md — 静态分层与调用链
  • references/android-dynamic-hooking-and-replay.md — 动态 Hook 与重放

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet, be the first.

Write a review

Versions

  • v0.1.0 Imported from the upstream source.

More in Security