opencode-skills-collection 4.0.43 → 4.0.44

package/bundled-skills/apk-reverse/references/frida-cookbook.md

@@ -0,0 +1,472 @@
+# Frida 实战脚本速查
+
+> 精选自 [awesome-frida](https://github.com/dweinstein/awesome-frida)、[Frida-Mobile-Scripts](https://github.com/m0bilesecurity/Frida-Mobile-Scripts)、[frida-codeshare-scripts](https://github.com/zengfr/frida-codeshare-scripts) 等开源项目。
+> 按场景分类，直接复制使用。
+
+---
+
+## 通用 Hook 模板
+
+### Hook 任意 Java 方法
+
+```javascript
+Java.perform(function() {
+    var TargetClass = Java.use("com.target.ClassName");
+    
+    // Hook 无参方法
+    TargetClass.methodName.implementation = function() {
+        console.log("[*] methodName called");
+        var ret = this.methodName();
+        console.log("[*] return: " + ret);
+        return ret;
+    };
+    
+    // Hook 有参方法
+    TargetClass.methodName.overload('java.lang.String', 'int').implementation = function(str, num) {
+        console.log("[*] methodName(" + str + ", " + num + ")");
+        var ret = this.methodName(str, num);
+        console.log("[*] return: " + ret);
+        return ret;
+    };
+});
+```
+
+### Hook 构造函数
+
+```javascript
+Java.perform(function() {
+    var TargetClass = Java.use("com.target.ClassName");
+    TargetClass.$init.overload('java.lang.String').implementation = function(arg) {
+        console.log("[*] new ClassName(" + arg + ")");
+        this.$init(arg);
+    };
+});
+```
+
+### 枚举所有方法
+
+```javascript
+Java.perform(function() {
+    var TargetClass = Java.use("com.target.ClassName");
+    var methods = TargetClass.class.getDeclaredMethods();
+    methods.forEach(function(method) {
+        console.log(method.toString());
+    });
+});
+```
+
+---
+
+## 加密/签名 Hook
+
+### Hook AES 加解密
+
+```javascript
+Java.perform(function() {
+    var Cipher = Java.use("javax.crypto.Cipher");
+    
+    Cipher.doFinal.overload('[B').implementation = function(input) {
+        var mode = this.getOpmode ? this.getOpmode() : "?";
+        console.log("[Cipher.doFinal] mode=" + mode);
+        console.log("  input: " + bytesToHex(input));
+        var result = this.doFinal(input);
+        console.log("  output: " + bytesToHex(result));
+        return result;
+    };
+    
+    // 捕获密钥
+    var SecretKeySpec = Java.use("javax.crypto.spec.SecretKeySpec");
+    SecretKeySpec.$init.overload('[B', 'java.lang.String').implementation = function(key, algo) {
+        console.log("[SecretKeySpec] algo=" + algo + " key=" + bytesToHex(key));
+        this.$init(key, algo);
+    };
+    
+    // 捕获 IV
+    var IvParameterSpec = Java.use("javax.crypto.spec.IvParameterSpec");
+    IvParameterSpec.$init.overload('[B').implementation = function(iv) {
+        console.log("[IvParameterSpec] iv=" + bytesToHex(iv));
+        this.$init(iv);
+    };
+});
+
+function bytesToHex(bytes) {
+    var hex = [];
+    for (var i = 0; i < bytes.length; i++) {
+        hex.push(('0' + (bytes[i] & 0xFF).toString(16)).slice(-2));
+    }
+    return hex.join('');
+}
+```
+
+### Hook MD5/SHA
+
+```javascript
+Java.perform(function() {
+    var MessageDigest = Java.use("java.security.MessageDigest");
+    
+    MessageDigest.digest.overload('[B').implementation = function(input) {
+        console.log("[MessageDigest.digest] algo=" + this.getAlgorithm());
+        console.log("  input: " + bytesToHex(input));
+        var result = this.digest(input);
+        console.log("  hash: " + bytesToHex(result));
+        return result;
+    };
+    
+    MessageDigest.digest.overload().implementation = function() {
+        console.log("[MessageDigest.digest] algo=" + this.getAlgorithm());
+        var result = this.digest();
+        console.log("  hash: " + bytesToHex(result));
+        return result;
+    };
+});
+```
+
+### Hook HMAC
+
+```javascript
+Java.perform(function() {
+    var Mac = Java.use("javax.crypto.Mac");
+    
+    Mac.doFinal.overload('[B').implementation = function(input) {
+        console.log("[Mac.doFinal] algo=" + this.getAlgorithm());
+        console.log("  input: " + bytesToHex(input));
+        var result = this.doFinal(input);
+        console.log("  mac: " + bytesToHex(result));
+        return result;
+    };
+    
+    Mac.init.overload('java.security.Key').implementation = function(key) {
+        var keyBytes = key.getEncoded();
+        console.log("[Mac.init] key=" + bytesToHex(keyBytes));
+        this.init(key);
+    };
+});
+```
+
+---
+
+## 网络请求 Hook
+
+### Hook OkHttp3 请求/响应
+
+```javascript
+Java.perform(function() {
+    var OkHttpClient = Java.use("okhttp3.OkHttpClient");
+    var Interceptor = Java.use("okhttp3.Interceptor");
+    
+    // Hook newCall 获取请求 URL
+    var RealCall = Java.use("okhttp3.RealCall");
+    RealCall.execute.implementation = function() {
+        var request = this.request();
+        console.log("[OkHttp] " + request.method() + " " + request.url().toString());
+        var headers = request.headers();
+        for (var i = 0; i < headers.size(); i++) {
+            console.log("  " + headers.name(i) + ": " + headers.value(i));
+        }
+        var response = this.execute();
+        console.log("[OkHttp] Response: " + response.code());
+        return response;
+    };
+});
+```
+
+### Hook URL 连接
+
+```javascript
+Java.perform(function() {
+    var URL = Java.use("java.net.URL");
+    URL.openConnection.overload().implementation = function() {
+        console.log("[URL] " + this.toString());
+        return this.openConnection();
+    };
+});
+```
+
+### Hook WebView
+
+```javascript
+Java.perform(function() {
+    var WebView = Java.use("android.webkit.WebView");
+    WebView.loadUrl.overload('java.lang.String').implementation = function(url) {
+        console.log("[WebView.loadUrl] " + url);
+        this.loadUrl(url);
+    };
+    
+    WebView.evaluateJavascript.implementation = function(script, callback) {
+        console.log("[WebView.evaluateJavascript] " + script.substring(0, 200));
+        this.evaluateJavascript(script, callback);
+    };
+});
+```
+
+---
+
+## 绕过类 Hook
+
+### 通用 SSL Pinning 绕过
+
+```javascript
+Java.perform(function() {
+    // OkHttp3 CertificatePinner
+    try {
+        var CertificatePinner = Java.use("okhttp3.CertificatePinner");
+        CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function() {
+            console.log("[*] SSL Pinning bypassed (OkHttp3)");
+        };
+    } catch(e) {}
+    
+    // TrustManagerImpl
+    try {
+        var TrustManagerImpl = Java.use("com.android.org.conscrypt.TrustManagerImpl");
+        TrustManagerImpl.verifyChain.implementation = function(untrustedChain) {
+            console.log("[*] SSL Pinning bypassed (TrustManagerImpl)");
+            return untrustedChain;
+        };
+    } catch(e) {}
+    
+    // X509TrustManager
+    try {
+        var X509TrustManager = Java.use("javax.net.ssl.X509TrustManager");
+        var TrustManager = Java.registerClass({
+            name: "com.bypass.TrustManager",
+            implements: [X509TrustManager],
+            methods: {
+                checkClientTrusted: function() {},
+                checkServerTrusted: function() {},
+                getAcceptedIssuers: function() { return []; }
+            }
+        });
+    } catch(e) {}
+    
+    // Network Security Config (Android 7+)
+    try {
+        var NetworkSecurityConfig = Java.use("android.security.net.config.NetworkSecurityConfig");
+        NetworkSecurityConfig.isCleartextTrafficPermitted.implementation = function() { return true; };
+    } catch(e) {}
+});
+```
+
+### 通用 Root 检测绕过
+
+```javascript
+Java.perform(function() {
+    // File.exists 绕过
+    var File = Java.use("java.io.File");
+    var rootPaths = ["su", "Superuser", "magisk", "busybox", "xposed", 
+                     "/system/xbin/su", "/system/bin/su", "/sbin/su",
+                     "/data/local/xbin/su", "/data/local/bin/su"];
+    
+    File.exists.implementation = function() {
+        var path = this.getAbsolutePath();
+        for (var i = 0; i < rootPaths.length; i++) {
+            if (path.toLowerCase().indexOf(rootPaths[i].toLowerCase()) !== -1) {
+                console.log("[Root] Blocked: " + path);
+                return false;
+            }
+        }
+        return this.exists();
+    };
+    
+    // Runtime.exec 绕过
+    var Runtime = Java.use("java.lang.Runtime");
+    Runtime.exec.overload('java.lang.String').implementation = function(cmd) {
+        if (cmd.indexOf("su") !== -1 || cmd.indexOf("which") !== -1) {
+            console.log("[Root] Blocked exec: " + cmd);
+            throw Java.use("java.io.IOException").$new("Permission denied");
+        }
+        return this.exec(cmd);
+    };
+    
+    // Build.TAGS 绕过
+    var Build = Java.use("android.os.Build");
+    Build.TAGS.value = "release-keys";
+});
+```
+
+### 反调试绕过
+
+```javascript
+Java.perform(function() {
+    // Debug.isDebuggerConnected
+    var Debug = Java.use("android.os.Debug");
+    Debug.isDebuggerConnected.implementation = function() {
+        console.log("[AntiDebug] isDebuggerConnected → false");
+        return false;
+    };
+    
+    // TracerPid 检测绕过（native 层）
+    var fopen = Module.findExportByName("libc.so", "fopen");
+    Interceptor.attach(fopen, {
+        onEnter: function(args) {
+            this.path = args[0].readUtf8String();
+        },
+        onLeave: function(retval) {
+            if (this.path && this.path.indexOf("/proc/") !== -1 && this.path.indexOf("/status") !== -1) {
+                // 可以进一步 hook fgets 修改 TracerPid
+            }
+        }
+    });
+});
+```
+
+### 模拟器检测绕过
+
+```javascript
+Java.perform(function() {
+    var Build = Java.use("android.os.Build");
+    Build.FINGERPRINT.value = "google/walleye/walleye:8.1.0/OPM1.171019.011/4448085:user/release-keys";
+    Build.MODEL.value = "Pixel 2";
+    Build.MANUFACTURER.value = "Google";
+    Build.BRAND.value = "google";
+    Build.DEVICE.value = "walleye";
+    Build.PRODUCT.value = "walleye";
+    Build.HARDWARE.value = "walleye";
+    
+    // TelephonyManager
+    var TelephonyManager = Java.use("android.telephony.TelephonyManager");
+    TelephonyManager.getDeviceId.implementation = function() { return "352099001761481"; };
+    TelephonyManager.getSubscriberId.implementation = function() { return "310260000000000"; };
+    TelephonyManager.getSimSerialNumber.implementation = function() { return "89014103211118510720"; };
+});
+```
+
+---
+
+## 数据存储 Hook
+
+### Hook SharedPreferences
+
+```javascript
+Java.perform(function() {
+    var SharedPreferencesImpl = Java.use("android.app.SharedPreferencesImpl");
+    
+    SharedPreferencesImpl.getString.implementation = function(key, defValue) {
+        var value = this.getString(key, defValue);
+        console.log("[SP.get] " + key + " = " + value);
+        return value;
+    };
+    
+    var Editor = Java.use("android.app.SharedPreferencesImpl$EditorImpl");
+    Editor.putString.implementation = function(key, value) {
+        console.log("[SP.put] " + key + " = " + value);
+        return this.putString(key, value);
+    };
+});
+```
+
+### Hook SQLite
+
+```javascript
+Java.perform(function() {
+    var SQLiteDatabase = Java.use("android.database.sqlite.SQLiteDatabase");
+    
+    SQLiteDatabase.rawQuery.implementation = function(sql, args) {
+        console.log("[SQL] " + sql);
+        if (args) console.log("  args: " + JSON.stringify(args));
+        return this.rawQuery(sql, args);
+    };
+    
+    SQLiteDatabase.execSQL.overload('java.lang.String').implementation = function(sql) {
+        console.log("[SQL.exec] " + sql);
+        this.execSQL(sql);
+    };
+});
+```
+
+---
+
+## 脱壳 Hook
+
+### 通用 DEX Dump
+
+```javascript
+Java.perform(function() {
+    Java.enumerateClassLoaders({
+        onMatch: function(loader) {
+            try {
+                var pathList = Java.cast(loader, Java.use("dalvik.system.BaseDexClassLoader")).pathList.value;
+                var dexElements = pathList.dexElements.value;
+                for (var i = 0; i < dexElements.length; i++) {
+                    var dexFile = dexElements[i].dexFile.value;
+                    if (dexFile) {
+                        console.log("[DEX] " + dexFile.getName());
+                        // 可以进一步 dump dex 内容
+                    }
+                }
+            } catch(e) {}
+        },
+        onComplete: function() {}
+    });
+});
+```
+
+### Hook ClassLoader.loadClass
+
+```javascript
+Java.perform(function() {
+    var ClassLoader = Java.use("java.lang.ClassLoader");
+    ClassLoader.loadClass.overload('java.lang.String').implementation = function(name) {
+        if (name.indexOf("com.target") !== -1) {
+            console.log("[ClassLoader] " + name);
+        }
+        return this.loadClass(name);
+    };
+});
+```
+
+---
+
+## 实用工具函数
+
+```javascript
+// 字节数组转十六进制
+function bytesToHex(bytes) {
+    if (!bytes) return "null";
+    var hex = [];
+    for (var i = 0; i < bytes.length; i++) {
+        hex.push(('0' + (bytes[i] & 0xFF).toString(16)).slice(-2));
+    }
+    return hex.join('');
+}
+
+// 打印调用栈
+function printStack() {
+    console.log(Java.use("android.util.Log").getStackTraceString(
+        Java.use("java.lang.Throwable").$new()));
+}
+
+// 打印对象所有字段
+function printFields(obj) {
+    var fields = obj.class.getDeclaredFields();
+    fields.forEach(function(field) {
+        field.setAccessible(true);
+        try {
+            console.log("  " + field.getName() + " = " + field.get(obj));
+        } catch(e) {}
+    });
+}
+
+// 搜索内存中的类实例
+function findInstances(className) {
+    Java.choose(className, {
+        onMatch: function(instance) {
+            console.log("[Instance] " + instance);
+            printFields(instance);
+        },
+        onComplete: function() {}
+    });
+}
+```
+
+---
+
+## 参考资源
+
+| 资源 | 说明 | 链接 |
+|------|------|------|
+| Frida 官方文档 | API 参考 | https://frida.re/docs/ |
+| Frida CodeShare | 社区脚本分享 | https://codeshare.frida.re/ |
+| awesome-frida | 资源大全 | https://github.com/dweinstein/awesome-frida |
+| frida-codeshare-scripts | 全网最全脚本收集 | https://github.com/zengfr/frida-codeshare-scripts |
+| Objection | Frida 封装工具 | https://github.com/sensepost/objection |
+| r2frida | radare2 + Frida 集成 | https://github.com/nowsecure/r2frida |

package/bundled-skills/attack-chain/SKILL.md

@@ -0,0 +1,185 @@
+---
+name: attack-chain
+description: "Authorized multi-stage attack-path planning and orchestration spanning reconnaissance, initial access, privilege escalation, lateral movement, and reporting. Entry point for full engagements and cross-phase operations."
+risk: offensive
+source: "https://github.com/zhaoxuya520/reverse-skill"
+source_repo: "zhaoxuya520/reverse-skill"
+source_type: community
+date_added: "2026-08-25"
+license: "MIT"
+license_source: "https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE"
+---
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
+# Attack Chain Orchestration Skill
+## When to Use
+
+- An authorized engagement spans multiple kill-chain phases.
+- Coordinating several specialist skills into one coherent attack path.
+
+
+## 何时路由到本 Skill
+
+以下场景**必须**先经过本 Skill 做全链路规划，再分发到具体子 Skill 执行：
+
+| 场景 | 为什么需要编排 |
+|------|--------------|
+| "帮我做一次完整的渗透测试" | 需要规划从信息收集到报告的全流程 |
+| "从外网打到域控" | 跨越边界突破→提权→横向→AD 多个阶段 |
+| "HW 攻防演练" | 需要完整攻击链 + 隐蔽性 + 痕迹清理 |
+| "评估这个目标的攻击面" | 需要多维度信息收集 + 路径规划 |
+| "我拿到了一个 webshell，下一步怎么办" | 需要从当前据点规划后续路径 |
+| "帮我规划攻击路径" | 明确需要路径编排 |
+| "从这个漏洞能打到什么程度" | 需要评估漏洞的链式利用价值 |
+| "Bug Bounty 持续监控" | 需要自动化多阶段流程 |
+| "内网渗透全流程" | 横向移动 + 提权 + 域攻击组合 |
+| "近源渗透方案" | 物理接入 + 内网渗透组合 |
+| "供应链攻击路径" | 跨组织多跳攻击 |
+| "钓鱼 + 后渗透" | 初始访问 + 后续利用组合 |
+
+**单阶段任务不需要经过本 Skill**：
+- 只做端口扫描 → 直接去 `pentest-tools/`
+- 只做 SQL 注入 → 直接去 `pentest-tools/`
+- 只做 APK 逆向 → 直接去 `apk-reverse/`
+- 只做域渗透 → 直接去 `windows-ad/SKILL.md`
+
+---
+
+## 编排原则
+
+### 本 Skill 的角色
+
+```
+用户提出多阶段任务
+    ↓
+attack-chain/SKILL.md（本文件）
+    ↓ 规划攻击路径、确定阶段顺序
+    ↓ 评估每阶段所需工具和方法
+    ↓
+分发到具体子 Skill 执行：
+    ├── pentest-tools/     → 工具调用、漏洞利用
+    ├── apk-reverse/       → 移动端渗透
+    ├── js-reverse/        → Web 前端突破
+    ├── reverse-engineering/ → 二进制分析
+    ├── ida-reverse/       → 深度逆向
+    └── browser-automation/ → 自动化操作
+    ↓
+每阶段完成后回到本 Skill 评估下一步
+    ↓
+全部完成 → docs-generator 生成报告
+```
+
+### 路径规划决策树
+
+```
+拿到目标后：
+1. 目标是什么？（Web/内网/云/移动/IoT）
+2. 当前有什么？（外部视角/已有凭据/已有据点）
+3. 最终目标是什么？（域控/数据/特定系统/证明影响）
+4. 约束条件？（时间/隐蔽性/不可触碰的系统）
+    ↓
+根据以上信息规划最短路径
+    ↓
+一条路走不通 → 回到本 Skill 重新规划备选路径
+```
+
+---
+
+## 完整攻击链阶段
+
+---
+
+
+For detailed phase methodology, toolchains, and playbooks, refer to:
+- [Attack Chain Phases & Playbooks](references/phases.md)
+
+## 红队行动铁律
+
+### 三条底线
+
+1. **所有操作必须获得书面授权**
+2. **数据渗出需进行匿名化处理**
+3. **清理所有攻击痕迹（包括内存驻留）**
+
+### 行动纪律
+
+- 每个操作前评估风险等级（低/中/高/严重）
+- 高风险操作前通知项目经理
+- 保持操作日志（时间、动作、结果）
+- 发现高危漏洞立即上报，不扩大利用
+- 不影响业务可用性（禁止 DoS）
+- 不访问/下载真实用户数据
+
+### 典型失败案例
+
+| 失败原因 | 后果 | 教训 |
+|---------|------|------|
+| 未清除 Mimikatz 内存 dump | 蓝队溯源完整攻击路径 | 操作后立即清理 |
+| C2 域名被威胁情报标记 | 首次连接即被拦截 | 使用新注册域名 + 域前置 |
+| 钓鱼邮件触发 DLP 告警 | 蓝队提前预警 | 测试邮件网关规则 |
+| 横向移动触发蜜罐 | 暴露攻击意图 | 先识别蜜罐再行动 |
+
+---
+
+## 工具速查表
+
+### 信息收集
+`subfinder` `amass` `httpx` `naabu` `katana` `gau` `dnsx` `nmap` `whatweb` `wpscan`
+
+### 漏洞利用
+`nuclei` `sqlmap` `sstimap` `xsstrike` `burpsuite` `metasploit`
+
+### 权限提升
+`winPEAS` `linpeas` `GodPotato` `PrintSpoofer` `watson`
+
+### 横向移动
+`mimikatz` `crackmapexec/netexec` `impacket` `bloodhound` `certipy` `coercer` `responder` `evil-winrm`
+
+### C2 框架
+`cobalt-strike` `sliver` `havoc` `mythic` `adaptixc2`
+
+### 近源渗透
+`fluxion` `aircrack-ng` `proxmark3` `rubber-ducky` `wifi-pineapple`
+
+---
+
+## 与本包其他 Skill 的关系
+
+| 需求 | 路由到 |
+|------|--------|
+| Web 漏洞深度利用 | `pentest-tools/SKILL.md` |
+| 内网 AD 攻击详细步骤 | `windows-ad/SKILL.md` |
+| 逆向分析恶意样本 | `reverse-engineering/SKILL.md` |
+| APK 逆向（移动端渗透） | `apk-reverse/SKILL.md` |
+| JS 前端签名绕过 | `js-reverse/SKILL.md` |
+| 自动化群体渗透 | Pentest Swarm AI（`pentestswarm scan --swarm`） |
+| AI 辅助渗透 | `mcp-kali-server` / `metasploitmcp` / `hexstrike-ai` |
+| 报告生成 | `docs-generator/SKILL.md` |
+| 攻击路径图 | `diagram-generator/SKILL.md` |
+
+
+## 任务完成自检（声称完成前 MUST 通过）
+
+- [ ] 我是否执行了工作流中的每一步（而不是只阅读）？
+- [ ] 我是否基于 `tool-index` 使用了真实工具路径？
+- [ ] 我是否产出了可复现证据（命令/脚本/截图/报告）？
+- [ ] 我是否完成并回写了 RULES 要求的 Checklist 项？
+
+## Limitations
+
+- Execution of attack stages requires written authorization per target.
+- Assumes supporting tooling (recon/exploit kits) is installed and licensed where applicable.
+
+> Adapted from [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) (MIT).