$loading...
Mobile application security testing — Android/iOS static analysis, ADB dynamic analysis, traffic interception, SSL pinning bypass, and Frida instrumentation. (24 payloads)
apktool d app.apk -o output/jadx -d output/ app.apkgrep -r "password\|apikey\|secret\|token" output/ --include="*.xml" --include="*.java"cat output/AndroidManifest.xml | grep -E "android:exported|android:permission"cat output/res/values/strings.xmladb shell dumpsys activity | grep -i "intent\|component"adb logcat | grep -i "password\|token\|secret\|error"adb shell run-as com.target.app ls /data/data/com.target.app/adb shell content query --uri content://com.target.app.provider/adb shell am start -n com.target.app/.SomeInternalActivityadb reverse tcp:8080 tcp:8080frida -U -l ssl-pinning-bypass.js -f com.target.appEdit network_security_config.xml to add <certificates src="user"/> under <trust-anchors>class-dump -H target.app/Target -o headers/strings target.app/Target | grep -iE "api|key|secret|token|password"find . -name "*.plist" | xargs grep -l "password\|key\|token"objection -g com.target.app exploreios sslpinning disableios keychain dumpios nsuserdefaults getios hooking list classesios hooking watch class ClassNamefrida -U -l bypass-jailbreak.js com.target.appJava.perform(function() {
var TrustManager = Java.use('javax.net.ssl.X509TrustManager');
// Override checkServerTrusted to bypass SSL pinning
});Level up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides