Dragonjar Android Pentesting Skill

DragonJAR Android Pentesting Skill

Skill by ara.so — Security Skills collection.

This skill provides comprehensive Android APK security analysis capabilities for AI agents, combining static analysis, dynamic instrumentation with Frida, RASP detection, authorized bypass validation, source-to-sink tracing, MASVS scoring, and professional reporting in a unified workflow.

What This Skill Does

Transforms an AI agent into an expert Android security auditor capable of:

• APK Analysis: Decode APKs with APKTool, decompile with JADX, detect frameworks with APKiD
• Static Security Analysis: 50+ manifest checks, 70+ Semgrep MASTG rules, secret detection, obfuscation analysis
• Dynamic Instrumentation: 37 Frida scripts for SSL pinning bypass, root detection bypass, crypto interception
• Runtime Defense Analysis (RDA): Detect 18 protection categories (RootBeer, SafetyNet, Frida detection, RASP, etc.)
• RASP Bypass: Authorized bypass runner with reusable profiles, DRY workflow
• Data Flow Tracing: Source-to-sink methodology with confidence levels
• MASVS Compliance: Automated scoring against OWASP MASVS controls with CVSS 4.0
• APK Modification: Smali patching, repackaging, signing, validation

Installation

Prerequisites

Install required tools (Linux/macOS):

# APKTool (3.0.1+)
brew install apktool

# JADX (1.5.5+)
brew install jadx

# Android SDK Platform Tools
brew install --cask android-platform-tools

# Frida (17.9+)
pip3 install frida-tools

# Objection (1.12.4+)
pip3 install objection

# APKiD (3.0.0+)
pip3 install apkid

# Semgrep (optional, for SAST)
brew install semgrep

Skill Installation

# Clone into your agent's skills directory
cd ~/.agents/skills/
git clone https://github.com/DragonJAR/Android-Pentesting-Skill dragonjar-android-pentesting

# Or clone to any location and add to agent skill path
git clone https://github.com/DragonJAR/Android-Pentesting-Skill.git

Verification

# Verify all dependencies are installed
cd dragonjar-android-pentesting
python3 scripts/06-setup/preflight-check.py

# Expected output:
# ✅ APKTool 3.0.1 found
# ✅ JADX 1.5.5 found
# ✅ Frida 17.9.4 found
# ✅ All dependencies satisfied

Core Workflows

1. Basic APK Security Audit

# Full static analysis with Semgrep enrichment
bash scripts/auto-audit-static.sh /path/to/app.apk --semgrep

# Output includes:
# - Manifest security issues (exported components, permissions)
# - Hardcoded secrets (API keys, passwords, tokens)
# - Insecure crypto usage
# - WebView vulnerabilities
# - Intent injection risks
# - Findings report in findings-merged.json

Example findings output:

{
  "findings": [
    {
      "id": "HARD-001",
      "severity": "CRITICAL",
      "title": "Hardcoded API Key in Source Code",
      "owasp_mobile": "M1",
      "masvs_control": "MASVS-STORAGE-1",
      "cvss": "9.1 (CRITICAL)",
      "location": "com/example/app/Config.java:42",
      "evidence": "private static final String API_KEY = \"sk_live_...\";",
      "remediation": "Store API keys in BuildConfig or secure server-side configuration"
    }
  ]
}

2. Runtime Defense Analysis (RASP Detection)

# Detect runtime protections with passive + active modes
bash scripts/02-rasp/runtime-defense-analyzer.sh \
  /path/to/app.apk \
  com.example.app \
  --active-mode \
  --authorized-lab \
  --output findings-rda.json

# Catalog includes 18 protection categories:
# - Root detection (RootBeer, custom native)
# - Emulator detection
# - Debug detection
# - Frida/instrumentation detection
# - Screenshot/screenrecord blocking
# - SafetyNet / Play Integrity
# - Commercial RASP (Talsec, AppSealing, DexGuard, etc.)

RDA output structure:

{
  "detectors": {
    "rootbeer": {
      "status": "DETECTED",
      "confidence": "high",
      "evidence": "RootBeer.isRooted() returns true",
      "bypass_profile": "rootbeer_standard"
    },
    "ssl_pinning": {
      "status": "DETECTED",
      "implementation": "OkHttp3 CertificatePinner",
      "bypass_profile": "ssl_okhttp3"
    }
  }
}

3. RASP Bypass Workflow (DRY Pattern)

# 1) List available bypass profiles
bash scripts/02-rasp/rasp-bypass-runner.sh --list-profiles

# Output:
# Available profiles:
# - rootbeer_standard (RootBeer library bypass)
# - ssl_okhttp3 (OkHttp3 SSL pinning)
# - ssl_trustmanager (TrustManager bypass)
# - frida_detection (Anti-Frida bypass)
# - emulator_detection (Emulator checks bypass)

# 2) Generate bypass command from RDA findings (print only)
bash scripts/02-rasp/rasp-bypass-runner.sh \
  --package com.example.app \
  --from-rda findings-rda.json \
  --print-command

# Output:
# frida -U -f com.example.app \
#   -l assets/frida-scripts/android-root-bypass-advanced.js \
#   -l assets/frida-scripts/ssl-pinning-bypass.js \
#   --no-pause

# 3) Execute bypass in authorized lab environment
bash scripts/02-rasp/rasp-bypass-runner.sh \
  --package com.example.app \
  --from-rda findings-rda.json \
  --run \
  --authorized-lab

# Launches Frida with combined bypass scripts

Important: Client-side bypasses do NOT forge server-side attestation. For Play Integrity, SafetyNet, Approov, or similar backend-enforced controls, use an authorized test tenant, backend allowlist, or approved lab configuration.

4. SSL Pinning Bypass

# Universal SSL pinning bypass (30+ implementations)
python3 scripts/07-tools/frida-exploit-helper.py \
  -p com.example.app \
  --script ssl-pinning-bypass

# Supports:
# - OkHttp3 CertificatePinner
# - TrustManager custom implementations
# - WebView SSL error handlers
# - React Native ssl-pinning libraries
# - Flutter BoringSSL (native hooks)
# - Cordova SSL plugins

5. Framework-Specific Analysis

React Native

# Detect React Native and extract JavaScript bundle
bash scripts/auto-audit-static.sh /path/to/app.apk

# Automatically:
# - Detects libreactnativejni.so
# - Extracts assets/index.android.bundle
# - Scans bundle for hardcoded secrets
# - Analyzes Metro bundler output

Hook React Native bridge:

// assets/frida-scripts/react-native-bridge-hook.js
Java.perform(function() {
    var CatalystInstanceImpl = Java.use('com.facebook.react.bridge.CatalystInstanceImpl');
    
    CatalystInstanceImpl.jniCallJSFunction.implementation = function(module, method, args) {
        console.log('[RN Bridge] ' + module + '.' + method);
        console.log('[RN Bridge] Args: ' + JSON.stringify(args));
        return this.jniCallJSFunction(module, method, args);
    };
});

Flutter

# Flutter uses Dart AOT compilation and native BoringSSL
# Standard Java SSL hooks won't work

# Use Blutter for Dart code extraction
python3 tools/blutter/blutter.py lib/arm64-v8a/libapp.so output/

# Hook native SSL functions
python3 scripts/07-tools/frida-exploit-helper.py \
  -p com.example.flutter \
  --script flutter-ssl-bypass

# Hooks:
# - SSL_CTX_set_custom_verify (certificate validation)
# - SSL_read / SSL_write (traffic interception)

6. Data Flow Tracing

# Phase 3: Source-to-sink analysis
# Automatically runs during static audit

# Example traced flows:
# - User input → SQL query (SQL injection risk)
# - Intent extras → WebView.loadUrl (open redirect)
# - SharedPreferences → network (data leakage)
# - File paths → external storage (path traversal)

Flow confidence levels:

• CONFIRMED: Direct observable flow without conditions
• LIKELY: Flow with minimal conditional branches
• POSSIBLE: Flow through complex logic, needs dynamic validation

7. MASVS Compliance Scoring

# Calculate OWASP MASVS compliance score
python3 scripts/05-reporting/masvs-scorer.py findings-merged.json

# Output:
# MASVS Score: 72.6/100 (Grade: C)
# Controls Passed: 16/23
# Controls Failed: 7
#
# Critical Failures:
# - MASVS-STORAGE-1: Hardcoded secrets in code