# Android Pentest

> 安卓应用渗透测试 — APK分析、Hook、自动化测试、运行态驱动、签名恢复、抓包分析

- **Type:** Skill
- **Install:** `agentstack add skill-unclecheng-li-vulnclaw-android-pentest`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Unclecheng-li](https://agentstack.voostack.com/s/unclecheng-li)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Unclecheng-li](https://github.com/Unclecheng-li)
- **Source:** https://github.com/Unclecheng-li/VulnClaw/tree/main/vulnclaw/skills/specialized/android-pentest

## Install

```sh
agentstack add skill-unclecheng-li-vulnclaw-android-pentest
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# 安卓应用渗透测试 Skill

针对安卓应用的专项渗透测试，遵循 **runtime-first** 原则：先运行态驱动、先抓包，最后才逆向。

**需要更深入的客户端逆向知识？** 使用 `client-reverse` Skill，包含完整的签名恢复、加密还原、Burp 重放工作流。

## 核心原则

**不要先逆向 APK**。默认操作顺序：
1. 确认目标 App 已安装在连接设备上
2. 准备好 Burp 或 Charles 抓包
3. 用 scrcpy_vision 驱动真实业务流程
4. 每个关键动作后检查抓包状态
5. 包可见且可重放 → 直接做 Web/API 安全测试
6. 只有抓不到包/包被加密时 → 升级到 jadx/frida/ida

## 1. 环境准备
- 通过 adb-mcp 连接设备/模拟器
- 通过 jadx 反编译目标 APK
- 通过 burp-mcp 配置代理抓包

## 2. 自动化探索
- 启动 APP，通过 adb-mcp 自动截图
- 通过 frida-mcp Hook 关键函数
- 通过 burp-mcp 捕获和分析数据流
- 自动点击 UI 元素，遍历功能点
- 模拟用户行为，识别敏感数据流

## 3. 深度分析
- 通过 jadx 审计源码（硬编码密钥、弱加密等）
- 通过 frida 动态 Hook（SSL Pinning 绕过、参数篡改）
- 通过 burp 修改重放请求（鉴权绕过、越权测试）

## 4. 漏洞验证
- 构造恶意输入，验证漏洞
- 截图记录漏洞证据
- 生成 PoC

## 5. 输出
- 安卓专项渗透报告
- 包含截图、流量、代码审计结果

## 参考文档

- `references/android-authorized-app-pentest-sop.md` — 安卓 App 渗透 SOP
- `references/android-external-url-runtime-first-workflow.md` — 安卓外部 URL 测试
- `references/android-ui-driven-observation-and-packet-loop.md` — UI 驱动观察循环
- `references/android-network-layer-testing-quick-reference.md` — 网络层测试速查
- `references/android-signing-and-crypto-workflow.md` — 签名与加密工作流
- `references/android-static-triage-and-callflow.md` — 静态分层与调用链
- `references/android-dynamic-hooking-and-replay.md` — 动态 Hook 与重放

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Unclecheng-li](https://github.com/Unclecheng-li)
- **Source:** [Unclecheng-li/VulnClaw](https://github.com/Unclecheng-li/VulnClaw)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-unclecheng-li-vulnclaw-android-pentest
- Seller: https://agentstack.voostack.com/s/unclecheng-li
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.