# Android APK decompilation
apktool d target.apk -o decompiled/
jadx -d java_src/ target.apk

# Search for secrets and misconfigurations
grep -rn "api_key\|password\|secret\|token\|firebase" java_src/
grep -rn "http://" java_src/  # Cleartext HTTP
grep -rn "MODE_WORLD_READABLE\|MODE_WORLD_WRITEABLE" java_src/
grep -rn "\.db\|\.sqlite" java_src/  # Database files

# AndroidManifest.xml review
# Check: exported components, debuggable flag, backup allowed,
#         cleartext traffic, permissions
grep -E "exported=\"true\"|debuggable=\"true\"|allowBackup=\"true\"|usesCleartextTraffic" decompiled/AndroidManifest.xml

# MobSF automated scan
docker run -it -p 8000:8000 opensecurity/mobile-security-framework-mobsf
# Upload APK/IPA via web interface

# iOS IPA analysis
unzip target.ipa -d extracted/
# Check Info.plist for ATS exceptions, URL schemes
plutil -convert xml1 extracted/Payload/App.app/Info.plist
grep -A5 "NSAppTransportSecurity" extracted/Payload/App.app/Info.plist

// Frida script: Hook encryption function
Java.perform(function() {
    var cipher = Java.use('javax.crypto.Cipher');
    cipher.doFinal.overload('[B').implementation = function(data) {
        console.log('Cipher.doFinal input: ' + byteArrayToHex(data));
        var result = this.doFinal(data);
        console.log('Cipher.doFinal output: ' + byteArrayToHex(result));
        return result;
    };
});

// Hook SharedPreferences writes
Java.perform(function() {
    var editor = Java.use('android.content.SharedPreferences$Editor');
    editor.putString.implementation = function(key, value) {
        console.log('SharedPrefs PUT: ' + key + ' = ' + value);
        return this.putString(key, value);
    };
});

// iOS: Hook NSURLSession for network inspection
if (ObjC.available) {
    var NSURLSession = ObjC.classes.NSURLSession;
    Interceptor.attach(NSURLSession['- dataTaskWithRequest:completionHandler:'].implementation, {
        onEnter: function(args) {
            var request = ObjC.Object(args[2]);
            console.log('URL: ' + request.URL().absoluteString());
        }
    });
}

# Objection (easiest)
objection -g com.target.app explore -s "android sslpinning disable"
objection -g com.target.app explore -s "ios sslpinning disable"

# Frida script for custom pinning bypass
frida -U -f com.target.app -l ssl_bypass.js --no-pause

# Magisk + TrustUserCerts module (Android 7+)
# System-level CA installation for intercepting all traffic

MASVS-STORAGE: Data storage and privacy
├── No sensitive data in logs
├── No sensitive data in backups
├── No sensitive data in cleartext (SharedPrefs, NSUserDefaults)
├── Keychain/Keystore used for sensitive data
└── Clipboard cleared for sensitive fields

MASVS-CRYPTO: Cryptographic practices
├── No hardcoded keys
├── No deprecated algorithms (MD5, SHA1, DES, RC4)
├── Proper key management (Android Keystore, iOS Keychain)
└── TLS 1.2+ enforced

MASVS-AUTH: Authentication and authorization
├── Session management server-side
├── Biometric auth backed by Keystore/Keychain
├── Re-authentication for sensitive operations
└── Token expiry enforced

MASVS-NETWORK: Network communication
├── TLS for all connections
├── Certificate pinning implemented
├── ATS enabled (iOS) / cleartext traffic disabled (Android)
└── No custom certificate validation that weakens security

MASVS-RESILIENCE: Reverse engineering resilience
├── Root/jailbreak detection
├── Debugger detection
├── Code obfuscation (ProGuard/R8 for Android)
└── Integrity verification