<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing Mobile App Authentication Flows

## Frida Authentication Hooks
```javascript
// Hook BiometricPrompt for bypass
Java.perform(function() {
    var BP = Java.use("android.hardware.biometrics.BiometricPrompt");
    var CB = Java.use("android.hardware.biometrics.BiometricPrompt$AuthenticationCallback");
    var AR = Java.use("android.hardware.biometrics.BiometricPrompt$AuthenticationResult");
    CB.onAuthenticationSucceeded.implementation = function(result) {
        console.log("[*] Biometric auth succeeded (hooked)");
        this.onAuthenticationSucceeded(result);
    };
});

// Hook SharedPreferences for token interception
Java.perform(function() {
    var SP = Java.use("android.app.SharedPreferencesImpl");
    SP.getString.implementation = function(key, defValue) {
        var result = this.getString(key, defValue);
        if (key.match(/token|session|auth|jwt/i)) {
            console.log("[TOKEN] " + key + " = " + result);
        }
        return result;
    };
});
```

## objection Commands
```bash
objection -g com.target.app explore
# android keystore list                  # KeyStore entries
# android clipboard monitor              # Clipboard monitoring
# ios keychain dump                      # iOS Keychain dump
# ios nsuserdefaults get                 # NSUserDefaults
# android hooking watch class android.hardware.biometrics.BiometricPrompt
```

## JWT Analysis
```bash
# Decode JWT header and payload
echo "JWT" | cut -d. -f1 | base64 -d | python3 -m json.tool  # Header
echo "JWT" | cut -d. -f2 | base64 -d | python3 -m json.tool  # Payload

# Brute-force JWT HS256 secret
hashcat -a 0 -m 16500 jwt.txt wordlist.txt
john jwt.txt --wordlist=wordlist.txt --format=HMAC-SHA256
```

## OAuth 2.0 Testing
```bash
# Test redirect_uri validation
curl "https://auth.target.com/authorize?client_id=ID&redirect_uri=https://evil.com"
curl "https://auth.target.com/authorize?client_id=ID&redirect_uri=https://target.com.evil.com"

# Test authorization code reuse
curl -X POST https://auth.target.com/token -d "code=USED_CODE&grant_type=authorization_code"

# Check .well-known endpoints
curl https://auth.target.com/.well-known/openid-configuration | python3 -m json.tool
curl https://auth.target.com/.well-known/oauth-authorization-server
```
