Module 2 · Android Pentesting with Objection & Frida 🔒

This module walks through an Android pentest with the two tools that do most of the heavy lifting: Objection (Frida-powered dynamic analysis) and Frida (runtime hooking framework). Setup, SSL-pinning bypass, local-storage inspection, method hooking — in practice, not theory.

Lab prerequisites

• Rooted Android device or emulator (Genymotion + Magisk works reliably)
• Frida server binary for the device’s architecture on port 27042
• Python + pip install frida-tools objection
• The target APK installed on the device
• Burp Suite (or mitmproxy) with CA cert installed in the user or system cert store

Starting Frida server on the device

adb push frida-server-16.x-android-arm64 /data/local/tmp/frida-server
adb shell
su
chmod 755 /data/local/tmp/frida-server
/data/local/tmp/frida-server &

# From host — confirm
frida-ps -U | head

# Output shows running processes on the device

Attaching Objection

# Package name is what you see in the manifest / Play Store URL
objection --gadget com.target.app explore

# You're now in an interactive REPL on the running app
com.target.app on (Android: 13) [usb] # help

SSL pinning bypass

Apps that pin the server certificate reject Burp’s proxy cert unless you bypass. Objection has a one-liner:

android sslpinning disable

# This hooks OkHttp3, HttpsURLConnection, WebView, TrustManager, and more
# Most apps — traffic now flows through Burp after this single command

When the Objection bypass does not work — custom pinning library, native implementation, or WebView with strict client auth — write a custom Frida script. Example for a specific function:

// ssl-bypass.js
Java.perform(function() {
  var CertificatePinner = Java.use('com.target.app.security.CertPinner');
  CertificatePinner.validate.implementation = function() {
    console.log('[+] cert validation called — forcing return true');
    return true;
  };
});

// Run: frida -U -l ssl-bypass.js com.target.app

# Inside the objection REPL
env                                    # shows app paths on device
ls /data/data/com.target.app           # lists app's internal storage
cat /data/data/com.target.app/shared_prefs/AuthPrefs.xml
sqlite connect /data/data/com.target.app/databases/users.db
  .tables
  .schema users
  SELECT * FROM users LIMIT 5;

# Hook a specific class and log every method call
android hooking watch class com.target.app.auth.TokenManager --dump-args --dump-return

# Find which methods exist
android hooking list class_methods com.target.app.auth.TokenManager