$ show DragonJAR/Android-Pentesting-Skill
This repository is a comprehensive, modular Android application security auditing framework designed for AI agents and security engineers. It automates the entire assessment lifecycle, from APK ingestion and static analysis to dynamic instrumentation, RASP (Runtime Application Self-Protection) detection and bypass, and professional reporting aligned with OWASP MASTG and MASVS v2 standards. The architecture is a well-organized toolkit of Python, Bash, and JavaScript (Frida) scripts, orchestrated by shell entry points and sharing a common library (`scripts/lib/`). Key capabilities include a 37+ script Frida arsenal for runtime manipulation, a Semgrep rule set for static vulnerability detection, a DRY bypass profile system for countering RASP solutions, and a weighted scoring engine for MASVS compliance. The codebase emphasizes modularity, schema-driven findings, and CI/CD integration. While the codebase demonstrates strong engineering practices and contains several genuinely reusable components (findings pipeline, Frida script templates, compliance scoring models), its heavy reliance on the rapidly evolving Android and Frida ecosystems introduces a medium level of technical drift. The presence of speculative content on unreleased Android versions and deprecated API references are noted risks. Overall, it is a high-quality, production-grade security toolkit that effectively bridges the gap between manual pentesting and automated security pipelines.
The LLM identified 5 files worth highlighting for reuse:
Centralized findings loader and contract that normalizes findings from diverse security tools (JSON, JSONL, wrapper formats) into a canonical schema. It is self-contained, has a clear API (`load_findings`), and is used by multiple downstream tools (merge, score, report). This pattern is directly reusable in any security pipeline that needs to aggregate and normalize findings from heterogeneous sources.
A comprehensive Frida script for bypassing Android root detection mechanisms. It follows a well-structured pattern (CONFIG, STATE, utility functions, hook functions, RPC exports) that serves as a template for any Frida-based security tool. It hooks over 50 root paths, 20 root packages, and 15 root binaries, demonstrating deep knowledge of Android anti-tampering. The modular bypass functions can be extracted and adapted for other bypass scenarios.
A DRY (Don't Repeat Yourself) configuration file that maps RASP detector names to reusable Frida bypass scripts. This decouples detection logic from bypass logic, allowing the system to dynamically build a bypass stack. This pattern is a non-obvious, highly reusable solution for managing a matrix of defenses and countermeasures in any security testing framework.
A portable, standalone set of 60+ Semgrep rules aligned with OWASP MASTG for detecting vulnerabilities in Android, Kotlin, and Java code. It covers categories like crypto, auth, network, storage, and platform. This rule set can be directly integrated into any CI/CD pipeline or Semgrep workflow, making it a highly valuable and reusable static analysis asset.
A well-structured JSON data model defining the MASVS v2 scoring matrix (23 controls) with weights and pass/fail semantics. It is consumed by the scoring engine to calculate compliance scores. This data-driven approach to compliance scoring is a reusable pattern that can be adapted for any security standard (e.g., PCI DSS, ISO 27001) by simply replacing the control definitions and mapping rules.