workers-app-tester（工人应用程序测试员）

Workers App Tester

Pentest Android apps through a rooted device. Drives the device UI, intercepts network traffic, and uses Frida for runtime analysis.

For detailed guides, load these on demand:

• references/testing-methodology.md — IDOR, auth, exposure, local storage, deeplinks, exported components, logging
• references/frida.md — SSL bypass, root bypass, codeshare scripts, hooking patterns, custom certs
• agents/reverse-agent.md — APK decompilation sub-agent, reads codebase for endpoints, secrets, components

Session Setup

1. Pick the target

adb shell pm list packages -3
adb shell dumpsys activity activities | grep -m 1 -E 'topResumedActivity=|ResumedActivity:|mFocusedApp='

2. Create session directory

SESSION_DIR=/tmp/workers-app-tester-$(date +%Y%m%d-%H%M%S)
mkdir -p "$SESSION_DIR"

3. Start traffic interception

Set PRESERVE_AUTH=1 so auth headers are logged in full, not redacted.

adb shell settings put global http_proxy 10.0.2.2:8080

ANDROID_APP_TESTER_OUT_DIR="$SESSION_DIR" \
ANDROID_APP_TESTER_PACKAGE="<package>" \
ANDROID_APP_TESTER_PRESERVE_AUTH=1 \
nohup mitmdump --set block_global=false --listen-host 0.0.0.0 --listen-port 8080 \
  -s scripts/capture.py >"$SESSION_DIR/mitmdump.log" 2>&1 &
echo $! >"$SESSION_DIR/mitmdump.pid"

For physical devices, replace 10.0.2.2 with the host IP.

4. Launch the app

adb shell am force-stop <package> || true
adb shell monkey -p <package> -c android.intent.category.LAUNCHER 1

5. If no HTTPS traffic appears

The app uses SSL pinning. See references/frida.md — start frida-server, then spawn the app with bypass.js.

Static Analysis

Dispatch to the reverse-agent with the package name and session directory. It will:

1. Pull the APK from the device
2. Decompile with apktool (manifest, smali, resources)
3. Grep for hardcoded secrets, API endpoints, security anti-patterns
4. Read through interesting files for deeper context

Returns: exported components, deeplink schemes, API endpoints, hardcoded secrets, security issues.

Use these findings to drive targeted testing in The Loop.

The Loop

1. Observe

python3 scripts/ui.py

Returns a compact numbered list of interactive elements:

[1] "Sign In" btn @ (540,1200) bounds=[380,1150][700,1250] clickable
[2] "Email" input @ (540,400) bounds=[100,350][980,450] focusable

2. Act

One action per cycle. Tap element [1]:

adb shell input tap 540 1200

For text fields, tap then type:

adb shell input tap 540 400
adb shell input text "test@example.com"

3. Intercept

python3 scripts/traffic.py --input "$SESSION_DIR/traffic.jsonl" --since-seconds 15 --limit 10

With headers and bodies:

python3 scripts/traffic.py --input "$SESSION_DIR/traffic.jsonl" --since-seconds 15 --show-headers --show-body

4. Decide next step and repeat

Security Analysis

After exercising the app's main flows, run the analyzer:

python3 scripts/analyze.py --input "$SESSION_DIR/traffic.jsonl" --mode full

Individual modes: endpoints, idor, auth, exposure, headers.

See references/testing-methodology.md for what to do with each finding.

ADB Reference

Session Teardown

kill "$(cat "$SESSION_DIR/mitmdump.pid")" 2>/dev/null || true
adb shell settings delete global http_proxy
adb shell "su -c 'pkill frida-server'" 2>/dev/null || true

Rules

• One UI action per cycle. Observe, act, intercept, then decide.
• Always run ui.py before acting so coordinates match the current screen.
• Always tear down the session when done. The proxy setting persists across reboots.
• Document findings: endpoint, vulnerability type, reproduction steps, evidence.
• NEVER use sleep in any command. No sleep 1, no sleep 2, no sleep && command. Run commands directly. ui.py handles its own timing. Chain with && if needed.
• Be fast. No unnecessary delays between actions.

Bundled Scripts