<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing Mobile App Transport Security

## Android Network Security Config
```xml
<!-- res/xml/network_security_config.xml -->
<network-security-config>
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>
    <domain-config cleartextTrafficPermitted="false">
        <domain includeSubdomains="true">api.example.com</domain>
    </domain-config>
</network-security-config>
```

## iOS ATS Keys (Info.plist)
| Key | Type | Risk if Enabled |
|-----|------|----------------|
| `NSAllowsArbitraryLoads` | Bool | ATS globally disabled |
| `NSAllowsArbitraryLoadsForMedia` | Bool | Media over cleartext |
| `NSAllowsArbitraryLoadsInWebContent` | Bool | WebView cleartext |
| `NSExceptionAllowsInsecureHTTPLoads` | Bool | Domain cleartext |
| `NSExceptionMinimumTLSVersion` | String | TLS downgrade |

## Frida Scripts
```javascript
// Hook SSLContext.init to detect custom TrustManagers
Java.perform(function() {
    var SSLContext = Java.use("javax.net.ssl.SSLContext");
    SSLContext.init.overload('[Ljavax.net.ssl.KeyManager;',
        '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom')
        .implementation = function(km, tm, sr) {
            console.log("[*] SSLContext.init called with TrustManager: " + tm);
            this.init(km, tm, sr);
        };
});
```

## objection Commands
```bash
objection -g com.target.app explore
# android sslpinning disable
# ios sslpinning disable
# env                              # show data directories
# android hooking list classes      # enumerate loaded classes
```

## nmap TLS Scripts
```bash
nmap --script ssl-enum-ciphers -p 443 host     # Enumerate ciphers
nmap --script ssl-cert -p 443 host              # Certificate details
nmap --script ssl-heartbleed -p 443 host        # Heartbleed check
```

## mitmproxy
```bash
mitmproxy --mode transparent --showhost         # Transparent proxy
mitmproxy --mode regular --listen-port 8080     # Regular proxy
mitmdump -r capture.flow --set flow_detail=3    # Dump flow detail
```

## testssl.sh
```bash
testssl.sh api.target.com                       # Full scan
testssl.sh --severity HIGH api.target.com       # High severity only
testssl.sh --protocols api.target.com           # Protocol support
testssl.sh --headers api.target.com             # Security headers
```
