Back to Details

workers-app-tester

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Workers App Tester

Workers 应用测试工具

Pentest Android apps through a rooted device. Drives the device UI, intercepts network traffic, and uses Frida for runtime analysis.
For detailed guides, load these on demand:
  • references/testing-methodology.md — IDOR, auth, exposure, local storage, deeplinks, exported components, logging
  • references/frida.md — SSL bypass, root bypass, codeshare scripts, hooking patterns, custom certs
  • agents/reverse-agent.md — APK decompilation sub-agent, reads codebase for endpoints, secrets, components
通过已root设备对Android应用进行渗透测试。可操控设备UI、拦截网络流量，并使用Frida开展运行时分析。
如需详细指南，可按需加载以下文档：
  • references/testing-methodology.md — IDOR、鉴权、数据暴露、本地存储、深度链接、导出组件、日志检测
  • references/frida.md — SSL绕过、root检测绕过、codeshare脚本、hook模式、自定义证书
  • agents/reverse-agent.md — APK反编译子Agent，可读取代码库提取端点、密钥、组件信息

Session Setup

会话设置

1. Pick the target

1. 选择测试目标

bash
adb shell pm list packages -3
adb shell dumpsys activity activities | grep -m 1 -E 'topResumedActivity=|ResumedActivity:|mFocusedApp='
bash
adb shell pm list packages -3
adb shell dumpsys activity activities | grep -m 1 -E 'topResumedActivity=|ResumedActivity:|mFocusedApp='

2. Create session directory

2. 创建会话目录

bash
SESSION_DIR=/tmp/workers-app-tester-$(date +%Y%m%d-%H%M%S)
mkdir -p "$SESSION_DIR"
bash
SESSION_DIR=/tmp/workers-app-tester-$(date +%Y%m%d-%H%M%S)
mkdir -p "$SESSION_DIR"

3. Start traffic interception

3. 启动流量拦截

Set 
PRESERVE_AUTH=1
so auth headers are logged in full, not redacted.
bash
adb shell settings put global http_proxy 10.0.2.2:8080

ANDROID_APP_TESTER_OUT_DIR="$SESSION_DIR" \
ANDROID_APP_TESTER_PACKAGE="<package>" \
ANDROID_APP_TESTER_PRESERVE_AUTH=1 \
nohup mitmdump --set block_global=false --listen-host 0.0.0.0 --listen-port 8080 \
  -s scripts/capture.py >"$SESSION_DIR/mitmdump.log" 2>&1 &
echo $! >"$SESSION_DIR/mitmdump.pid"
For physical devices, replace 
10.0.2.2
with the host IP.
设置
PRESERVE_AUTH=1
以完整记录鉴权头，不做脱敏处理。
bash
adb shell settings put global http_proxy 10.0.2.2:8080

ANDROID_APP_TESTER_OUT_DIR="$SESSION_DIR" \
ANDROID_APP_TESTER_PACKAGE="<package>" \
ANDROID_APP_TESTER_PRESERVE_AUTH=1 \
nohup mitmdump --set block_global=false --listen-host 0.0.0.0 --listen-port 8080 \
  -s scripts/capture.py >"$SESSION_DIR/mitmdump.log" 2>&1 &
echo $! >"$SESSION_DIR/mitmdump.pid"
如果使用物理设备，将
10.0.2.2
替换为主机IP。

4. Launch the app

4. 启动应用

bash
adb shell am force-stop <package> || true
adb shell monkey -p <package> -c android.intent.category.LAUNCHER 1
bash
adb shell am force-stop <package> || true
adb shell monkey -p <package> -c android.intent.category.LAUNCHER 1

5. If no HTTPS traffic appears

5. 如果没有HTTPS流量出现

The app uses SSL pinning. See references/frida.md — start frida-server, then spawn the app with 
bypass.js
.
说明应用启用了SSL pinning。请参考references/frida.md：启动frida-server，然后通过
bypass.js
启动应用。

Static Analysis

静态分析

Dispatch to the reverse-agent with the package name and session directory. It will:
  1. Pull the APK from the device
  2. Decompile with apktool (manifest, smali, resources)
  3. Grep for hardcoded secrets, API endpoints, security anti-patterns
  4. Read through interesting files for deeper context
Returns: exported components, deeplink schemes, API endpoints, hardcoded secrets, security issues.
Use these findings to drive targeted testing in The Loop.
将包名和会话目录传给reverse-agent执行，它会完成以下操作：
  1. 从设备拉取APK
  2. 使用apktool反编译（清单文件、smali代码、资源文件）
  3. 检索硬编码密钥、API端点、安全反模式
  4. 读取高价值文件以获取更深层上下文
返回结果：导出组件、深度链接协议、API端点、硬编码密钥、安全问题。
可基于这些发现在循环测试环节开展定向测试。

The Loop

循环测试

1. Observe

1. 观察

bash
python3 scripts/ui.py
Returns a compact numbered list of interactive elements:
[1] "Sign In" btn @ (540,1200) bounds=[380,1150][700,1250] clickable
[2] "Email" input @ (540,400) bounds=[100,350][980,450] focusable
bash
python3 scripts/ui.py
返回带编号的精简可交互元素列表：
[1] "Sign In" btn @ (540,1200) bounds=[380,1150][700,1250] clickable
[2] "Email" input @ (540,400) bounds=[100,350][980,450] focusable

2. Act

2. 执行操作

One action per cycle. Tap element [1]:
bash
adb shell input tap 540 1200
For text fields, tap then type:
bash
adb shell input tap 540 400
adb shell input text "test@example.com"
每个周期仅执行一个操作。点击元素[1]：
bash
adb shell input tap 540 1200
针对文本输入框，先点击再输入内容：
bash
adb shell input tap 540 400
adb shell input text "test@example.com"

3. Intercept

3. 拦截流量

bash
python3 scripts/traffic.py --input "$SESSION_DIR/traffic.jsonl" --since-seconds 15 --limit 10
With headers and bodies:
bash
python3 scripts/traffic.py --input "$SESSION_DIR/traffic.jsonl" --since-seconds 15 --show-headers --show-body
bash
python3 scripts/traffic.py --input "$SESSION_DIR/traffic.jsonl" --since-seconds 15 --limit 10
如需查看请求头和请求体：
bash
python3 scripts/traffic.py --input "$SESSION_DIR/traffic.jsonl" --since-seconds 15 --show-headers --show-body

4. Decide next step and repeat

4. 确定下一步操作并重复

Security Analysis

安全分析

After exercising the app's main flows, run the analyzer:
bash
python3 scripts/analyze.py --input "$SESSION_DIR/traffic.jsonl" --mode full
Individual modes: 
endpoints
, 
idor
, 
auth
, 
exposure
, 
headers
.
See references/testing-methodology.md for what to do with each finding.
跑完应用的主要流程后，运行分析工具：
bash
python3 scripts/analyze.py --input "$SESSION_DIR/traffic.jsonl" --mode full
支持的单个模式：
endpoints
、
idor
、
auth
、
exposure
、
headers
。
各发现项的处置方法请参考references/testing-methodology.md。

ADB Reference

ADB参考

ActionCommand
Tap
adb shell input tap <x> <y>
Type
adb shell input text "hello%sworld"
(%s = space)
Scroll down
adb shell input swipe 540 1500 540 500 300
Scroll up
adb shell input swipe 540 500 540 1500 300
Back
adb shell input keyevent KEYCODE_BACK
Home
adb shell input keyevent KEYCODE_HOME
Enter
adb shell input keyevent KEYCODE_ENTER
Long press
adb shell input swipe <x> <y> <x> <y> 1000
Launch app
adb shell monkey -p <pkg> -c android.intent.category.LAUNCHER 1
Force stop
adb shell am force-stop <pkg>
操作命令
点击
adb shell input tap <x> <y>
输入
adb shell input text "hello%sworld"
(%s = 空格)
向下滚动
adb shell input swipe 540 1500 540 500 300
向上滚动
adb shell input swipe 540 500 540 1500 300
返回
adb shell input keyevent KEYCODE_BACK
主页
adb shell input keyevent KEYCODE_HOME
回车
adb shell input keyevent KEYCODE_ENTER
长按
adb shell input swipe <x> <y> <x> <y> 1000
启动应用
adb shell monkey -p <pkg> -c android.intent.category.LAUNCHER 1
强制停止
adb shell am force-stop <pkg>

Session Teardown

会话清理

bash
kill "$(cat "$SESSION_DIR/mitmdump.pid")" 2>/dev/null || true
adb shell settings delete global http_proxy
adb shell "su -c 'pkill frida-server'" 2>/dev/null || true
bash
kill "$(cat "$SESSION_DIR/mitmdump.pid")" 2>/dev/null || true
adb shell settings delete global http_proxy
adb shell "su -c 'pkill frida-server'" 2>/dev/null || true

Rules

使用规则

  • One UI action per cycle. Observe, act, intercept, then decide.
  • Always run 
    ui.py
    before acting so coordinates match the current screen.
  • Always tear down the session when done. The proxy setting persists across reboots.
  • Document findings: endpoint, vulnerability type, reproduction steps, evidence.
  • NEVER use 
    sleep
    in any command. No 
    sleep 1
    , no 
    sleep 2
    , no 
    sleep && command
    . Run commands directly. 
    ui.py
    handles its own timing. Chain with 
    &&
    if needed.
  • Be fast. No unnecessary delays between actions.
  • 每个周期仅执行一个UI操作：先观察、再操作、再拦截，最后确定下一步。
  • 执行操作前务必运行
    ui.py
    ，确保坐标与当前屏幕匹配。
  • 测试完成后务必清理会话，代理设置会在设备重启后仍然生效。
  • 记录发现项：端点、漏洞类型、复现步骤、证据。
  • 严禁在任何命令中使用
    sleep
    ，不允许
    sleep 1
    、
    sleep 2
    、
    sleep && 命令
    这类写法。直接运行命令即可，
    ui.py
    会自行处理时序问题，如有需要可使用
    &&
    串联命令。
  • 操作要快，动作之间不要有不必要的延迟。

Bundled Scripts

内置脚本

ScriptPurpose
scripts/ui.py
Smart UI parser. Filters to interactive elements with spatial dedup.
scripts/capture.py
mitmproxy addon. Logs to JSONL. Set 
PRESERVE_AUTH=1
to keep auth headers.
scripts/traffic.py
Traffic viewer. 
--since-seconds
, 
--show-headers
, 
--show-body
.
scripts/analyze.py
Security analyzer. Modes: 
endpoints
, 
idor
, 
auth
, 
exposure
, 
headers
, 
full
.
scripts/bypass.js
SSL pinning bypass. TrustManagerImpl, OkHttp3, SSLContext, Conscrypt.
脚本用途
scripts/ui.py
智能UI解析器，可过滤可交互元素并做空间去重。
scripts/capture.py
mitmproxy插件，日志输出为JSONL格式。设置
PRESERVE_AUTH=1
可保留鉴权头。
scripts/traffic.py
流量查看工具，支持参数
--since-seconds
、
--show-headers
、
--show-body
。
scripts/analyze.py
安全分析工具，支持模式：
endpoints
、
idor
、
auth
、
exposure
、
headers
、
full
。
scripts/bypass.js
SSL pinning绕过脚本，支持TrustManagerImpl、OkHttp3、SSLContext、Conscrypt。