Introduction to Dynamic Android App Penetration Testing

Dynamic analysis is a critical phase in Android application penetration testing, allowing security researchers to interact with an application while it’s running. This provides invaluable insights into its runtime behavior, API calls, data handling, and potential vulnerabilities that static analysis might miss. At the forefront of dynamic analysis tools are Frida and Objection, a powerful combination that provides unparalleled control over Android applications.

Frida is a dynamic instrumentation toolkit that lets you inject snippets of JavaScript or your own library into native apps on Windows, macOS, Linux, iOS, Android, and QNX. Objection, built on top of Frida, automates many common tasks, making dynamic analysis faster and more efficient for penetration testers.

Setting Up Your Dynamic Analysis Environment

Before diving into Frida and Objection, ensure you have a properly configured environment. This typically involves a rooted Android device or an Android emulator (e.g., Genymotion, Android Studio AVD) and necessary tools installed on your host machine.

Prerequisites:

• Rooted Android Device/Emulator: Essential for installing Frida server and gaining necessary permissions.
• ADB (Android Debug Bridge): For interacting with the Android device from your host machine.
• Python 3: Required for Frida and Objection.
• Frida-tools: The Python package for Frida.
• Objection: The wrapper for Frida.

Installation Steps:

1. Install Python Packages:

   pip3 install frida-tools objection

2. Download Frida Server:Identify your Android device’s architecture (e.g., arm, arm64, x86, x86_64) using adb shell getprop ro.product.cpu.abi. Download the corresponding frida-server-<version>-android-<arch> from Frida’s GitHub releases.
3. Push and Run Frida Server:

   adb push /path/to/frida-server /data/local/tmp/frida-serveradb shell "chmod 755 /data/local/tmp/frida-server"adb shell "/data/local/tmp/frida-server &"

   Verify Frida server is running by executing frida-ps -U on your host machine. You should see a list of running processes on your Android device.

Frida Basics: Diving into Runtime Instrumentation

Frida allows you to attach to a running process and execute JavaScript code within its context. This enables you to hook functions, inspect memory, and modify behavior on the fly.

Attaching and Listing Processes:

frida-ps -Uai # List installed applications with their package namesfrida -U -f com.example.targetapp -l my_script.js --no-pause # Attach to app and inject scriptfrida -U com.example.targetapp # Attach to a running process

Simple Hooking Example (JavaScript):

Let’s say an app uses the android.util.Log class. We can hook its methods to see what’s being logged:

Java.perform(function () {  var Log = Java.use("android.util.Log");  Log.d.overload('java.lang.String', 'java.lang.String').implementation = function (tag, msg) {    console.log("[D] " + tag + ": " + msg);    return this.d(tag, msg);  };  Log.e.overload('java.lang.String', 'java.lang.String').implementation = function (tag, msg) {    console.log("[E] " + tag + ": " + msg);    return this.e(tag, msg);  };});

Save this as `log_hook.js` and inject it with frida -U -f com.example.targetapp -l log_hook.js --no-pause. Now, every time Log.d or Log.e is called, you’ll see it in your Frida console.

Objection: Frida on Steroids for Pen Testers

Objection streamlines many common dynamic analysis tasks, providing a powerful command-line interface to interact with Frida. It’s especially useful for Android penetration testing due to its built-in modules.

Attaching with Objection:

objection -g com.example.targetapp explore # Attach to app, spawn if not runningobjection -g com.example.targetapp explore --startup-command 'android sslpinning disable' # Disable SSL pinning on startup

Common Objection Commands:

• android sslpinning disable: Bypasses common SSL pinning implementations.
• android hooking search classes <keyword>: Searches for classes matching a keyword.
• android hooking search methods <class_name> <keyword>: Searches for methods within a class.
• android hooking watch class <class_name>: Watches all method calls within a class, including arguments and return values.
• android hooking watch method <class_name>.<method_name>: Watches a specific method.
• android heap search instances <class_name>: Dumps all live instances of a specific class.
• env: Shows environment variables.

Practical Use Cases & Advanced Techniques

Bypassing SSL Pinning:

SSL pinning is a common security control. Objection provides an instant bypass:

objection -g com.example.targetapp exploreandroid sslpinning disable

For more advanced or custom pinning scenarios, you might need a dedicated Frida script. Objection’s module essentially injects a Frida script designed to hook various certificate validation methods (e.g., checkServerTrusted, verify).

Bypassing Root Detection:

Many apps check for root to prevent tampering. Root detection often involves checking for specific files (e.g., /system/xbin/su), installed packages, or properties. You can use Objection to search for relevant methods and then hook them.

1. Search for keywords:

   android hooking search classes rootandroid hooking search methods com.example.targetapp.RootChecker isRooted

2. Hook the relevant method:If you find a method like com.example.targetapp.RootChecker.isRooted() that returns a boolean, you can hook it to always return false.

android hooking set return_value com.example.targetapp.RootChecker.isRooted false

Alternatively, using a custom Frida script:

Java.perform(function () {  var RootChecker = Java.use("com.example.targetapp.RootChecker");  RootChecker.isRooted.implementation = function () {    console.log("Root detection bypassed!");    return false;  };});

Exploring Application Logic & Modifying Return Values:

Suppose an app has a method com.example.targetapp.AuthManager.checkPassword(String password) that returns a boolean. You can observe its calls:

android hooking watch method com.example.targetapp.AuthManager.checkPassword

To force it to return true, bypassing authentication logic:

android hooking set return_value com.example.targetapp.AuthManager.checkPassword true

This demonstrates how you can dynamically alter an application’s execution flow without recompiling or modifying its bytecode.

Best Practices and Troubleshooting

• Start Simple: Begin with basic hooks and gradually increase complexity.
• Use Logs: Frida’s console.log() is your best friend for debugging scripts.
• Isolate Issues: If a script fails, try to narrow down the problematic part.
• Check Architectures: Ensure your Frida server matches your device’s CPU architecture.
• Keep Frida Server Running: The & at the end of the adb shell command ensures it runs in the background.
• Read Documentation: Frida’s and Objection’s official documentation are excellent resources.

Conclusion

Frida and Objection form an indispensable toolkit for dynamic Android application penetration testing. From bypassing complex security mechanisms like SSL pinning and root detection to deeply understanding and manipulating application logic at runtime, their capabilities empower security professionals to uncover vulnerabilities effectively. Mastering these tools elevates your mobile security testing to an expert level, providing a dynamic edge in the ever-evolving threat landscape.