Autonomous mobile pentesting

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://workers.io/blog/autonomous-mobile-pentesting/
• Blog Title: Autonomous mobile pentesting
• Suggested Section: 📱 Mobile Pentesting → Android Applications Pentesting (add subsections like: Rooted emulator for pentesting (rootAVD/Magisk), System-wide MITM (AlwaysTrustUserCerts), Frida SSL pinning bypass workflow, Unity/IL2CPP reversing + Frida native hooking/pivot when UI/network is unhelpful)

🎯 Content Summary

This post explains how to build an autonomous Android pentesting agent by connecting an LLM-driven workflow to a rooted Android device and orchestrating four core capabilities: UI observation, UI interaction, HTTPS interception, and runtime instrumentation (Frida). It demonstrates how the agent can adapt its testing strategy when network-based testing fails (Unity/IL2CPP case) and pivot to binary/runtime manipulation.

Why root access is the k...

🔧 Technical Details

Autonomous mobile pentest loop: repeatedly (1) dump UI state (UI Automator), (2) reduce XML to interactive targets (clickable/focusable, deduped by bounds/position) with stable numeric IDs, (3) perform a single action via ADB input, (4) capture and time-correlate HTTPS flows with a proxy, and (5) decide the next action based on UI + recent network deltas.

System-wide MITM on Android with root: install the proxy CA as a user cert, then use a Magisk module (AlwaysTrustUserCerts) to copy user CAs into the system trust store at boot so apps that ignore user CAs become interceptable; if an app implements certificate pinning/custom TLS verification, bypass it with Frida by hooking multiple common verification points (e.g., TrustManagerImpl, SSLContext.init, WebViewClient, Conscrypt, OkHttp CertificatePinner, plus additional paths).

Pivot strategy for Unity IL2CPP apps: when UI Automator can’t see real UI (single Game view) and network interception yields no valuable API tra...

🤖 Agent Actions

I’m mapping the mobile/Android sections first, then I’ll read the closest existing pages to avoid duplicating techniques that HackTricks already covers.
I’ve narrowed this to existing Android pages instead of creating something new. Next I’m reading the closest files in parallel to see whether the useful parts are already covered and where a single update fits best.
The existing content already covers pieces of this blog across multiple pages. I’m now checking where the genuinely new value is: the agent-style mobile workflow and the Unity/IL2CPP pivot, which likely belong in one high-level Android pentesting page rather than scattering duplicates.
I’ve confirmed the setup details themselves already exist elsewhere. The missing content is the decision workflow: root as the enabler, one-action UI/network correlation, and the Unity/IL2CPP fallback when both accessibility and proxy traffic stop being useful.
I have the insertion point. I’m updating the main Android page with a compact workflow section and a Unity/IL2CPP fallback section, without repeating the deeper setup already documented in the specialized pages.
The main content is in place. I’m updating the references now and then I’ll re-read the modified sections plus the final diff to make sure the page still flows cleanly and nothing duplicated was introduced.
Updated README.md in src/mobile-pentesting/android-app-pentesting/.

I kept it to one file and only added the parts that were not already covered elsewhere in HackTricks:

• a concise rooted-emulator workflow tying together rootAVD/Magisk, system-wide CA trust with AlwaysTrustUserCerts, proxying, and frida-server
• the observe → act → intercept → decide mobile testing loop with UI Automator + short traffic windows
• the Unity / IL2CPP pivot for cases where UI Automator only sees Game view and proxy traffic is useless, including split-APK pulling, global-metadata.dat + libil2cpp.so extraction, and native Frida hooking

I also appended the references for the workers.io blog, rootAVD, and AlwaysTrustUserCerts at the end of the file. I verified the diff and placement; no other files were changed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://workers.io/blog/autonomous-mobile-pentesting/

Content Categories: Based on the analysis, this content was categorized under "📱 Mobile Pentesting → Android Applications Pentesting (add subsections like: Rooted emulator for pentesting (rootAVD/Magisk), System-wide MITM (AlwaysTrustUserCerts), Frida SSL pinning bypass workflow, Unity/IL2CPP reversing + Frida native hooking/pivot when UI/network is unhelpful)".

Repository Maintenance:

• MD Files Formatting: 972 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0