Mobile Security Skill

Quick Workflow

Progress:
- [ ] Extract APK/IPA
- [ ] Decompile (jadx for Android)
- [ ] Search for hardcoded secrets
- [ ] Check native libraries
- [ ] Dynamic analysis with Frida if needed
- [ ] Extract flag

Quick Analysis Pipeline

# Android APK
file app.apk
apktool d app.apk -o extracted/
jadx app.apk -d output/
grep -r "flag\|secret" output/

# iOS IPA
unzip app.ipa -d extracted/
strings Payload/App.app/App | grep -i flag

Reference Files

Tools Summary

CTF Quick Patterns

# Flag in resources
grep -r "flag\|ctf\|secret" extracted/res/

# Flag in native library
strings extracted/lib/*/*.so | grep -i flag

# Hardcoded secrets
grep -r "api_key\|secret\|password" output/