What problem does it solve? Android application security assessments require deep knowledge of platform-specific attack surfaces like SSL pinning, exported components, WebView bridges, and root detection, which general-purpose models often handle superficially. This Skill provides a structured playbook of concrete commands, Frida scripts, and decision logic for authorized mobile penetration testing. ## Core Features & Use Cases - SSL Pinning Bypass: Covers Frida universal hooks, Objection, Network Security Config overrides, and Magisk/LSPosed module approaches with a hook-point coverage table. - Component & WebView Exploitation: Provides adb commands and exploitation patterns for exported activities, content provider SQL injection and path traversal, broadcast injection, intent redirection, and JavaScript bridge abuse. - Ready-to-Use Frida Scripts: A companion reference file includes templates for root detection bypass, crypto key extraction, WebView debugging, SharedPreferences dumping, intent sniffing, and biometric bypass. - Use Case: During an authorized mobile assessment, you cannot intercept an app's HTTPS traffic. Load this Skill to select the right SSL pinning bypass method (Frida, Objection, or Magisk module), then proceed to test exported components and WebView configurations using the included decision tree. ## Quick Start Use the android-pentesting-tricks skill to help me bypass SSL pinning on the target app com.example.app and enumerate its exported components.
