DragonJAR/Android-Pentesting-Skill

What to do

The value the summary omits is the exact command sequence and its ordering constraint. Install by cloning into your agent's skills directory:

cd ~/.agents/skills/
git clone https://github.com/DragonJAR/Android-Pentesting-Skill Android-Pentesting-Skill

Verify dependencies before running anything:

python3 scripts/06-setup/preflight-check.py

Shell and PowerShell variants exist (preflight-check.sh, preflight-check.ps1); the Bash script needs Bash 4+ (/opt/homebrew/bin/bash on macOS Homebrew).

How it works

The RASP bypass is a four-step "DRY" pipeline that is print-first — it will not execute a bypass until you pass --run --authorized-lab. The ordering matters: detect, then map detections to reusable profiles, then generate a reviewable command, then (only if authorized) run.

# 1) Detect RASP/runtime defenses
bash scripts/02-rasp/runtime-defense-analyzer.sh app.apk com.target.app --output findings-rda.json

# 2) Review available bypass profiles
bash scripts/02-rasp/rasp-bypass-runner.sh --list-profiles

# 3) Generate a reviewed Frida command from findings
bash scripts/02-rasp/rasp-bypass-runner.sh \
  --package com.target.app \
  --from-rda findings-rda.json \
  --print-command

# 4) Execute only in an authorized lab
bash scripts/02-rasp/rasp-bypass-runner.sh \
  --package com.target.app \
  --from-rda findings-rda.json \
  --run --authorized-lab

Profiles live in scripts/02-rasp/bypass-profiles.json and reference Frida scripts under assets/frida-scripts/. Phase structure runs 0–5 (decode → manifest/attack-surface → grep patterns → Semgrep MASTG rules → source-to-sink → RASP → classification/scoring); the transcripts show it auto-detects Flutter, React Native (libhermes.so), and native frameworks and adjusts (e.g. extracting assets/index.android.bundle for RN secret scans).

flowchart LR
  D[RDA detect] --> P[list-profiles]
  P --> C[print-command]
  C -->|reviewed| A{--authorized-lab?}
  A -->|yes| R[run bypass]
  A -->|no| STOP[print only, no exec]

Caveats

The page states one hard limit explicitly: client-side Frida hooks cannot forge server-side attestation verdicts. For Approov, Play Integrity, or SafetyNet, you need an authorized test tenant, backend allowlist, mock verifier, or approved lab config — not a hook. Bypass validation only covers client-side controls (SSL pinning, root/debug/emulator checks, anti-Frida, FLAG_SECURE, packer/native checks) and only "where technically feasible." The RDA in the transcript exposed 18 catalog entries but only 14 executable detectors, so detection coverage exceeds bypass coverage.