Mobile Recon: Attack Surface Mapping

This skill defines the methodology for static reconnaissance of mobile applications. It is loaded by /scope, /acquire, and /recon commands and used by the scope agent, acquisition agent, and orchestrator during the RECON phase.

Objective

Map every entry point, configuration surface, and embedded asset in the target app. Recon does NOT hunt for vulnerabilities; it catalogs what exists so hunters can prioritize.

iOS Recon Workflow

1. Structure Mapping

After extraction and decryption, map the .app bundle:

Payload/
  AppName.app/
    AppName           ← main executable (Mach-O)
    Info.plist         ← app configuration
    embedded.mobileprovision
    Frameworks/        ← embedded frameworks/dylibs
    PlugIns/           ← app extensions (widgets, share, etc.)
    Assets.car         ← compiled asset catalog
    *.storyboardc      ← compiled storyboards
    *.momd             ← Core Data models
    *.lproj/           ← localization bundles

Key files to inventory:

• Main executable and all embedded framework binaries
• Info.plist (app config, URL schemes, ATS, permissions)
• embedded.mobileprovision (entitlements, team ID)
• Any .plist, .json, .xml, .db, .sqlite files in the bundle

2. Entry Point Extraction

Run these tools and record results to recon/<target>/:

3. Binary Surface

4. Aggregate iOS Surface

Combine outputs into recon/<target>/ios_surface.json:

{
  "entry_points": {
    "url_schemes": ["myapp://", "myapp-auth://"],
    "universal_links": ["applinks:example.com"],
    "app_extensions": ["ShareExtension", "WidgetExtension"],
    "background_modes": ["fetch", "remote-notification"]
  },
  "config_surface": {
    "ats_status": "exceptions_present",
    "ats_exceptions": ["api.example.com"],
    "permissions_requested": ["camera", "location-always", "contacts"],
    "dangerous_entitlements": []
  },
  "binary_surface": {
    "frameworks_count": 12,
    "debug_frameworks": [],
    "sdk_inventory": [{"name": "Firebase", "version": "10.x"}],
    "crypto_apis_used": ["CCCrypt", "SecKeyCreateEncryptedData"],
    "keychain_protection_levels": ["kSecAttrAccessibleWhenUnlocked"],
    "endpoints_found": 34,
    "secrets_flagged": 2
  }
}

Android Recon Workflow

1. Structure Mapping

After apktool + jadx extraction, map:

extracted/
  apktool/
    AndroidManifest.xml   ← decoded manifest (readable XML)
    res/                  ← decoded resources
    assets/               ← raw assets
    smali/                ← Dalvik bytecode
    lib/                  ← native libraries (.so)
      arm64-v8a/
      armeabi-v7a/
  jadx/
    sources/              ← decompiled Java source
    resources/            ← resource files

Key files to inventory:

• AndroidManifest.xml (components, permissions, intent filters, SDK versions)
• All .so files in lib/ (native libraries to reverse)
• res/xml/network_security_config.xml (if present)
• Any .json, .xml, .db, .properties files in assets/

2. Component & Configuration Extraction

3. Source & Binary Surface

4. Aggregate Android Surface

Combine into recon/<target>/android_surface.json following the same pattern as iOS.

Cross-Platform Recon

Run these regardless of platform:

React Native / Hermes Bundles

React Native apps with the Hermes engine ship a compiled bytecode bundle (magic bytes c6 1f bc 03). For these apps, the JavaScript business logic is in the bundle, not the native binary. Detect and extract first, then feed the extracted strings to secret_scanner.py and api_endpoint_extractor.py.

# Detect: check the magic bytes of main.jsbundle or index.android.bundle
python3 -c "import sys; print('hermes' if open(sys.argv[1],'rb').read(4) == b'\\xc6\\x1f\\xbc\\x03' else 'plain_js')" <bundle>

# Extract strings (one per line, one per string-table entry)
python3 tools/analysis/shared/hermes_extractor.py \
  --bundle workspace/<target>/ios/extracted/Payload/<App>.app/main.jsbundle \
  --out workspace/<target>/hermes/ios_strings.txt

python3 tools/analysis/shared/hermes_extractor.py \
  --bundle workspace/<target>/android/extracted/apktool/assets/index.android.bundle \
  --out workspace/<target>/hermes/android_strings.txt

# Scan the extracted strings for secrets and endpoints
python3 tools/analysis/shared/secret_scanner.py --path workspace/<target>/hermes/ios_strings.txt
grep -a '^https\?://' workspace/<target>/hermes/ios_strings.txt | sort -u

hermes_extractor.py supports --json for structured output including the parsed HBC header fields. Hermes apps are identified during acquisition; if the acquisition report lists a js_bundle of format hermes_bytecode, the hunters must consult the extracted strings file rather than (or in addition to) the native binary.

Binary Analysis (Optional, Ghidra/BN)

If analysis.binary_analyzer is configured, run headless analysis:

# iOS: analyze the decrypted main executable
bash tools/binary_analysis/ghidra_analyze.sh \
  --binary <decrypted_exec> --platform ios --output recon/<target>/

# Android: analyze each .so in lib/
bash tools/binary_analysis/ghidra_analyze.sh \
  --binary <native.so> --platform android --output recon/<target>/

Then classify functions:

python3 tools/binary_analysis/function_classifier.py \
  --results recon/<target>/*_ghidra_results.json --output recon/<target>/

Attack Surface Prioritization

After all tools complete, rank areas for hunters by signal density:

The orchestrator uses this ranking to decide which hunter instances to spawn and which areas to skip.

Scope Verification Checklist

Before starting recon, verify:

1. Bundle ID / package name matches scope.json exactly
2. App version is the current App Store / Play Store release
3. iOS binary is decrypted (cryptid == 0 via verify_decryption.py)
4. Android manifest is from the production build (not debug)
5. Binary analysis is allowed by program scope

Output Contract

All recon outputs go to recon/<target>/ as JSON files. The orchestrator and hunter agents consume these files, so maintain the schema contracts defined above. Every tool outputs structured JSON with a top-level status field (success or error).