Quill — pr0t31n

How It Works

⚠️ Authorized Testing Only

This tool interacts with live systems and must only be used for testing that has been explicitly authorized by the asset owner. Unauthorized use of this tool to probe, scan, exploit, or otherwise interact with systems you do not have written permission to test is illegal under computer fraud and abuse laws (CFAA, CMA, and international equivalents). pr0t31n does not condone or recommend any unauthorized use. Always obtain a signed Rules of Engagement (RoE) or Statement of Work (SoW) before beginning any assessment.

Quill performs mobile application security analysis for both iOS (IPA) and Android (APK) packages. The tool unpacks the application archive and conducts static analysis across multiple security dimensions: manifest/plist inspection, permission analysis, cryptographic implementation review, hardcoded secret detection, insecure storage patterns, network security configuration, and third-party library vulnerability assessment.

For Android APKs, Quill uses apktool to decompile the application resources and jadx to decompile Dalvik bytecode back to Java source for code-level analysis. For iOS IPAs, it extracts the application bundle and parses Info.plist and entitlements to assess security configuration. Both platforms undergo string extraction for URLs, API keys, and credential patterns embedded in the binary or resources.

Optionally, Quill supports Frida-based dynamic analysis when a device or emulator is available, hooking into runtime functions to observe cryptographic operations, certificate pinning behaviour, and data storage calls. When run under Crucible (CRUCIBLE_MANAGED=1), it emits structured protocol tokens for live progress and finding delivery. The tool supports checkpoint/resume for long-running analyses.

Phase Pipeline

Phase 1 — Application Extraction
Phase 2 — Binary Analysis
Phase 3 — Network Traffic Analysis
Phase 4 — Data Storage Audit
Phase 5 — Findings Generation

Security

CLI tool. Processes IPA files locally. No network access during analysis.

Features

Analysis

Dual-Platform Mobile Security

Analyses both iOS (IPA) and Android (APK) applications in a single tool with platform auto-detection

Dynamic Analysis

Frida Runtime Hooking

Optional Frida-based dynamic analysis for observing runtime behaviour: SSL pinning bypass, cryptographic operations, and file I/O.

Output

Universal Schema Findings

Produces findings conforming to the pr0t31n universal schema with catalogue IDs, evidence files, and OWASP Mobile Top 10 mappings.

Security

iOS Entitlements Analysis

Checks for get-task-allow, wildcard app-id, ATS exceptions, URL schemes, and background modes in Info.plist

Android Permission Analysis

Flags 34 dangerous Android permissions, exported components, debuggable builds, allowBackup, and cleartext traffic settings

Hard-coded Credential Detection

9 pattern families for detecting secrets in app binaries, DEX files, smali code, and resources

Static Analysis

APK Decompilation

Decompiles Android APKs using apktool (resources) and jadx (Dalvik bytecode to Java) for comprehensive source-level analysis.

IPA Bundle Analysis

Extracts iOS application bundles and parses Info.plist, entitlements, and embedded frameworks for security configuration review.

Manifest/Permission Analysis

Reviews Android manifests and iOS entitlements for overly broad permissions, exported components, and insecure configurations.

Hardcoded Secret Detection

Scans decompiled source, resources, and binary strings for API keys, tokens, passwords, private keys, and other embedded secrets.

Network Security Configuration

Checks Android network security config and iOS App Transport Security settings for cleartext traffic allowances and certificate pinning.

Cryptographic Implementation Review

Identifies weak cryptographic algorithms, hardcoded keys, insecure random number generation, and deprecated cipher usage.

Insecure Storage Detection

Flags usage of SharedPreferences/UserDefaults for sensitive data, world-readable files, and unencrypted local databases.

Testing

Frida Dynamic Analysis

Pre-built Frida scripts for SSL pinning bypass, root/jailbreak detection bypass, data storage monitoring, crypto API monitoring, and WebView security testing

Use Cases

Mobile Application Penetration Test

Comprehensive security assessment of a mobile application as part of an authorised penetration test, covering OWASP Mobile Top 10 categories.

Pre-Release Security Review

Analyse a mobile application build before release to identify hardcoded secrets, insecure configurations, and vulnerable third-party libraries.

Medical Device Companion App Assessment

Evaluate the security of companion mobile applications for medical devices, checking for insecure data handling and communication patterns.

IoT Device Mobile Interface Review

Assess the mobile control application for IoT and hardware devices to identify API endpoint exposure, authentication weaknesses, and insecure local storage.

CLI Reference

Command Examples

Analyze IPA

python3 quill.py --ipa /path/to/app.ipa --output-dir /path/to/output

Run full iOS application security analysis.

Third-Party Tool Invocations

Commands and flags used when this tool invokes third-party dependencies during operation.

apktool

Decompiles Android APK resources and smali bytecode

apktool d application.apk -o output_dir

jadx

Decompiles Dalvik bytecode to readable Java source code

jadx -d output_dir application.apk

codesign

iOS entitlements extraction from IPA bundles

codesign -d --entitlements :- <app_dir>

strings

Binary string extraction for hard-coded credential scanning

strings <binary>

frida

Dynamic instrumentation for SSL pinning bypass, root/jailbreak detection bypass, and runtime security monitoring

frida -D <device> -n <target> -l <script.js> --no-pause -q

Finding Nomenclature

Quill findings use the QL-NNN catalogue ID prefix. Findings map to OWASP Mobile Top 10 categories where applicable (e.g., M1: Improper Platform Usage, M5: Insufficient Cryptography, M9: Reverse Engineering). Risk levels reflect the exploitability and impact: CRITICAL for hardcoded credentials or disabled certificate pinning, HIGH for insecure data storage of sensitive information, MEDIUM for excessive permissions, and LOW/INFO for informational configuration observations.

Action Items

Quill generates action items for findings requiring runtime testing — e.g., "Test jailbreak detection bypass", "Verify certificate pinning can be bypassed with Frida/objection", "Check if debug entitlement enables runtime injection".

Output Files

File	Format	Description
`meta.json`	JSON	Tool identity and engagement metadata
`findings.json`	JSON	Universal findings array v1.1
`findings.csv`	CSV	CSV mirror of findings
`summary.json`	JSON	Aggregated statistics
`scan.log`	TXT	Human-readable timestamped log
`scan.log.json`	JSONL	Machine-readable JSON log events
`errors.log`	TXT	ERROR-level entries only
`checkpoint.json`	JSON	Resumable scan checkpoint

Invocation Methods

Method	Usage
CLI — Direct	`cd /opt/pr0t31n/Quill && python3 quill.py [OPTIONS]` Run directly with command-line arguments.
Crucible-Managed	Launched and managed by Crucible (port 5100). Crucible handles start/stop/pause, log streaming, findings aggregation, and status tracking.

Integration

Used By

Crucible (manages)

Third-Party Dependencies & Credits

Tool / Library	Developer	Type	Link
strings (binutils)	GNU Project / Free Software Foundation	system	https://www.gnu.org/software/binutils/
codesign (macOS)	Apple	system	https://developer.apple.com/

Metadata

Name	Quill
Category	Analysis
Version	1.2.2
Install Path	`/opt/pr0t31n/Quill`
Main File	`quill.py`
GitHub	https://github.com/pr0t31n/Quill.git