apk-redteam-pipeline

1## When to use this skill
2 
3Trigger when:
4- Recon surfaces 1+ mobile apps under the target's developer name (Play Store dev page)
5- A web app hosts `*.apk` files directly (e.g. `Recruitz.apk` found on a subdomain during one engagement)
6- APK package IDs leaked via stealer logs (e.g. `com.<brand>.app`, `com.<brand>.<sub-brand>` patterns in stealer dump format)
7- Customer-facing app, dealer/partner portal, or employee mobile companion app is in scope
8- Bug bounty program lists Android in scope
9 
10DO NOT use for:
11- iOS-only targets (different pipeline — IPA reverse, MobSF, frida-ios-dump)
12- React Native / Flutter web apps already covered by JS bundle analysis
13- Server-side only assessments
14 
15---
16 
17## Stage 0 — Inventory all org-owned apps
18 
19### Play Store developer-page scrape
20```bash
21# Find developer page from the target's brand name
22curl -sk -A "Mozilla/5.0" "https://play.google.com/store/apps/developer?id=<Brand+Name>" -o /tmp/dev.html
23 
24# Extract package IDs
25grep -oE 'id=[a-zA-Z0-9._]+' /tmp/dev.html | sort -u
26```
27 
28Example output (anonymized — 7 packages typical for a multi-brand conglomerate):
29```
30com.events.<brand>build
31com.<corp>.<sub-brand-1>
32com.<corp>.<sub-brand-2>
33com.<corp>.<flagship>
34com.<corp>.<product-line-1>
35com.<corp>.<product-line-2>
36com.<corp>.<sub-brand-3>
37```
38 
39### Cross-reference with stealer logs
40Stealer-log format includes package names like `*@com.<corp>.<app>` — extract these from `creds_userpass.txt` if you have a leaked dump.
41…