Android | h4rithd Pentest Notes

00 Basic

bash18 lines

## ------------------| Android Pentest Workflow
01. Scope validation
02. APK acquisition
03. App metadata extraction
04. Manifest review
05. Static code review
06. Secrets and endpoint discovery
07. Network security config review
08. Repack/sign/tamper test
09. Dynamic instrumentation
10. Traffic interception
11. Exported component testing
12. Deeplink and intent abuse testing
13. Local storage review
14. Crypto and Keystore review
15. WebView review
16. Root/debug/emulator/frida detection review
17. Framework-specific review: Flutter / React Native / Xamarin

Secret Codes

bash2 lines

## ------------------| Enable ADB + MTP
*#0808#

Modem commands

bash8 lines

## ------------------| Read basic info
AT+DEVCONINFO

## ------------------| Enter Download mode
AT+FUS?

## ------------------| Restart
AT+CFUN=1,1

00.1 ADB Commands

bash62 lines

## ------------------| Mount system as read and write
mount -o rw,remount /system

## ------------------| Install Split APKs
adb shell pm list packages | grep example
for f in $(adb shell pm path com.example | sed 's/package://g'); do adb pull "$f" .; done
adb install-multiple *.apk

## ------------------| List installed packages
adb shell pm list packages -3

## ------------------| List installed packages with paths
adb shell pm list packages -3 -f

## ------------------| Find the app's install directory
pm dump com.example | grep codePath

## ------------------| Dump package info and find the library path
pm dump com.example | grep nativeLibraryDir

## ------------------| List system packages
adb shell pm list packages -s
adb shell pm list packages | grep '<OEM/Carrier/App Name>'

## ------------------| Uninstall apk
adb shell pm uninstall -k --user 0 '<OEM/Carrier/App Name>'

## ------------------| Backup APK
adb pull <PATH> app.apk

## ------------------| Get information about system services
adb shell dumpsys package com.routerspace

## ------------------| Start Activity through ADB shell
adb shell am start -n com.routerspace/.MainActivity

## ------------------| List all debug-able apps
grep " 1 /" /data/system/packages.list

## ------------------| View ContentProvider
adb shell 'content query --uri content://com.routerspace/.MainActivity/users'

## ------------------| Global Proxy
adb shell settings put global http_proxy <IP>:<PORT>    ## Set Proxy
adb shell settings put global http_proxy :0             ## Remove Proxy
### No authentication
adb shell settings put global http_proxy <IP>:<PORT>
### With Authentication
adb shell settings put global http_proxy <IP>:<PORT>
adb shell settings put global global_http_proxy_host <IP>
adb shell settings put global global_http_proxy_port <PORT>
adb shell settings put global global_http_proxy_username <USER>
adb shell settings put global global_http_proxy_password <PASS>
### Disable proxy
adb shell settings delete global http_proxy
adb shell settings delete global global_http_proxy_host
adb shell settings delete global global_http_proxy_port
adb shell settings delete global global_http_proxy_username
adb shell settings delete global global_http_proxy_password
adb shell settings delete global global_http_proxy_exclusion_list
adb shell settings delete global global_proxy_pac_url
adb shell reboot

01 Static Analysis

01.0 APK Decompilation, Extraction & Analysis Preparation

bash45 lines

## ------------------| Install Required Tools
sudo apt update
sudo apt install -y apktool jadx adb aapt apksigner unzip zip file binutils ripgrep
brew install apktool jadx android-platform-tools ripgrep binutils ## macOS

## ------------------| One-Line APK Decompilation (APKTool + JADX)
APK="app.apk"; OUT="${APK%.apk}_decompiled"; apktool d "$APK" -o "$OUT/apktool" -f && jadx -d "$OUT/jadx" "$APK"

## ------------------| Extract Raw APK Contents
mkdir -p apk_raw
unzip -q app.apk -d apk_raw/
unzip -l app.apk        ## Inspect APK Archive Contents
unzip -Z1 app.apk | grep -E '(^|/)classes[0-9]*\.dex$'      ## List DEX Files
unzip -Z1 app.apk | grep -E '\.so$'     ## List Native Libraries
unzip -Z1 app.apk | grep -E '^lib/[^/]+/[^/]+\.so$' | cut -d/ -f2 | sort -u     ## Identify Supported Native Architectures

## ------------------| JADX GUI
jadx-gui app.apk

## ------------------| AAPT
aapt dump permissions app.apk                   ## Inspect APK Permissions
aapt dump xmltree app.apk AndroidManifest.xml   ## Inspect Android Manifest with AAPT
aapt dump badging app.apk | head -n 5           ## Get APK Package Name and Version

## ------------------| APKTool
apktool d app.apk -o apktool_out -f             ## Decode APK using APKTool
apktool d app.apk -o apktool_resources -s -f    ## Decode Resources Only (Skip Smali)
apktool d app.apk -o apktool_smali -r -f        ## Decode Smali Only (Skip Resources)
find apktool_out/assets/ -type f 2>/dev/null    ## List Extracted Assets
find apktool_out/lib/ -type f -name '*.so' 2>/dev/null      ## List Extracted Native Libraries
find apktool_out/res/ -path '*/values*/strings.xml' -type f -print  ## Inspect String Resources
find apktool_out/lib/ -type f -name '*.so' -exec file {} \; 2>/dev/null     ## Identify Native Library Architecture
find apktool_out/lib/ -type f -name '*.so' -exec strings -a {} \; 2>/dev/null   ## Extract Readable Strings from Native Libraries

## ------------------| JADX
jadx -d jadx_out app.apk                        ## Decompile APK to Java using JADX
jadx -r -d jadx_sources app.apk                 ## Decompile Only Java Sources
jadx -s -d jadx_resources app.apk               ## Decompile Only Resources
jadx --deobf -d jadx_deobf app.apk              ## Decompile with JADX Auto Deobfuscation
jadx --show-bad-code -d jadx_debug app.apk      ## Show Inconsistent Decompiled Code

## ------------------| Extract DEX Files
mkdir -p dex_out
find apk_raw -maxdepth 1 -type f -name 'classes*.dex' -exec cp {} dex_out/ \;
jadx -d dex_decompiled dex_out/classes.dex      ## Decompile Individual DEX File

01.1 APK Acquisition and Metadata Check

bash28 lines

## ------------------| APK static metadata
aapt dump badging app.apk
aapt dump permissions app.apk
aapt dump xmltree app.apk AndroidManifest.xml

## ------------------| Signing certificate and schemes
apksigner verify --verbose --print-certs app.apk

## ------------------| Identify package from device
adb shell pm list packages -3
adb shell pm list packages -3 -f | grep -i '<keyword>'

## ------------------| Get APK path
adb shell pm path com.example.app

## ------------------| Pull base APK and split APKs
mkdir -p apk_pull
for apk in $(adb shell pm path com.example.app | sed 's/package://g'); do
  adb pull "$apk" apk_pull/
done

## ------------------| Install split APK set
adb install-multiple apk_pull/*.apk

## ------------------| Dump package metadata
adb shell dumpsys package com.example.app > dumpsys_package.txt
adb shell dumpsys activity activities | grep -i com.example.app
adb shell dumpsys window | grep -E 'mCurrentFocus|mFocusedApp'

01.2 Manifest Triage Check

android:exported="true" means another app can launch that component by exact class name unless access is protected by permissions.

bash11 lines

## ------------------| Key manifest flags
grep -RniE 'debuggable|allowBackup|usesCleartextTraffic|networkSecurityConfig|exported|taskAffinity|permission|grantUriPermissions' app_decoded/AndroidManifest.xml

## ------------------| List activities/services/receivers/providers
grep -RniE '<activity|<service|<receiver|<provider' app_decoded/AndroidManifest.xml

## ------------------| Find exported components
grep -Rni 'android:exported="true"' app_decoded/AndroidManifest.xml

## ------------------| Find deeplink intent filters
grep -RniE 'android.intent.action.VIEW|android:scheme|android:host|android:path|android:autoVerify' app_decoded/AndroidManifest.xml

01.3 Secrets, Endpoints & Cloud Configuration

bash46 lines

## ------------------| Firebase / Google Configuration
grep -RniE 'google_api_key|google_app_id|firebase_database_url|google_storage_bucket|project_id|gcm_defaultSenderId|com\.google\.firebase\.crashlytics\.mapping_file_id' .

## ------------------| Find Firebase Configuration Files
find . -type f \( -name 'google-services.json' -o -name 'GoogleService-Info.plist' -o -name 'firebase.json' \)

## ------------------| Firebase Endpoints
grep -RniE 'firebaseio\.com|firebasedatabase\.app|appspot\.com|firebaseapp\.com|storage\.googleapis\.com' .

## ------------------| Extract Hardcoded URLs
grep -RnioE 'https?://[^"<>[:space:]]+' . | sort -u

## ------------------| API Endpoints and Routes
grep -RniE '/api/|/v[0-9]+/|graphql|swagger|openapi|base[_-]?url|api[_-]?url|endpoint' .

## ------------------| Hardcoded Credentials and Secrets
grep -RniE 'api[_-]?key|secret[_-]?key|client[_-]?secret|access[_-]?token|auth[_-]?token|bearer|password|passwd|private[_-]?key' .

## ------------------| OAuth / OIDC Configuration
grep -RniE 'client[_-]?id|client[_-]?secret|redirect[_-]?uri|oauth|openid|authorization_endpoint|token_endpoint' .

## ------------------| Cloud Infrastructure References
grep -RniE 'amazonaws\.com|cloudfront\.net|blob\.core\.windows\.net|azurewebsites\.net|digitaloceanspaces\.com|storage\.googleapis\.com' .

## ------------------| Search JWT Candidates
grep -RnioE 'eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}' .

## ------------------| Private Key Detection
grep -RniE 'BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY' .

## ------------------| WebSocket Endpoints
grep -RnioE 'wss?://[^"<>[:space:]]+' . | sort -u

## ------------------| Search Android Resource Files
grep -RniE 'url|host|endpoint|api[_-]?key|secret|token|firebase|oauth' res/values* 2>/dev/null

## ------------------| Search Smali Files
grep -RniE 'https?://|firebaseio|googleapis|amazonaws|api[_-]?key|client[_-]?secret' smali* 2>/dev/null

## ------------------| Search Native Libraries
find . -type f -name '*.so' -print0 | while IFS= read -r -d '' f; do
    strings -a "$f" | grep -Ei 'https?://|wss?://|firebaseio|googleapis|amazonaws|api[_-]?key|token'
done

## ------------------| Search Decompiled Java/Kotlin Source
grep -RniE 'https?://|wss?://|firebase|googleapis|amazonaws|api[_-]?key|client[_-]?secret|access[_-]?token|base[_-]?url|endpoint' jadx_out/

01.4 Network Security Config Review

bash15 lines

## ------------------| Locate network security config
grep -Rni 'networkSecurityConfig' app_decoded/
find app_decoded/res -iname '*network*security*' -o -name 'network_security_config.xml'

## ------------------| Review cleartext and trust anchors
grep -RniE 'cleartextTrafficPermitted|trust-anchors|certificates|pin-set|debug-overrides' app_decoded/res/xml/

## ------------------| Find hardcoded URLs
grep -RniE 'https?://|wss?://' app_jadx/ app_decoded/ | tee urls.txt

## ------------------| WebSocket Endpoints
grep -RnioE 'wss?://[^"<>[:space:]]+' . | sort -u

## ------------------| Find common API keywords
grep -RniE 'api|graphql|oauth|token|refresh|client_id|secret|firebase|s3|bucket|amplitude|segment|mixpanel' app_jadx/ | tee interesting_keywords.txt

01.5 Exported Component Testing

bash20 lines

## ------------------| Find exported components
grep -Rni 'android:exported="true"' app_decoded/AndroidManifest.xml

## ------------------| Start exported activity
adb shell am start -n com.example.app/.ui.TargetActivity

## ------------------| Start exported activity with extras
adb shell am start -n com.example.app/.ui.TargetActivity --es token test --es url 'https://attacker.example/' --ez isAdmin true

## ------------------| Send broadcast
adb shell am broadcast -a com.example.app.ACTION_TEST --es payload test

## ------------------| Start service
adb shell am startservice -n com.example.app/.service.TargetService --es command test

## ------------------| Query content provider
adb shell content query --uri content://com.example.app.provider/users

## ------------------| Insert into content provider
adb shell content insert --uri content://com.example.app.provider/users --bind name:s:test

01.6 Deeplink and App Link Testing

Deep links directly open app content and expand the attack surface when they route to sensitive functionality, especially when input validation and auth checks are weak. Android App Links improve this by verifying association between the app and website.

bash14 lines

## ------------------| Basic deeplink launch
adb shell am start -a android.intent.action.VIEW -d 'myapp://example/path?token=test'

## ------------------| HTTPS app link launch
adb shell am start -a android.intent.action.VIEW -d 'https://example.com/reset-password?token=test'

## ------------------| Check Android app links verification
adb shell pm get-app-links com.example.app

## ------------------| Force app link verification
adb shell pm verify-app-links --re-verify com.example.app

## ------------------| Reset app link state
adb shell pm reset-app-links com.example.app

01.7 Local Storage Review

Auto Backup applies to apps targeting and running Android 6.0/API 23+ unless configured otherwise, and Android can back up app data to the user’s Google Drive; this makes allowBackup and backup rules security-relevant, especially for tokens/PII.

bash24 lines

## ------------------| App private directory on rooted device
adb shell su -c "ls -lah /data/data/com.example.app/"
adb shell su -c "find /data/data/com.example.app/ -type f -maxdepth 5"

## ------------------| Pull app data
mkdir -p data_pull
adb shell su -c "tar -czf /sdcard/appdata.tgz /data/data/com.example.app"
adb pull /sdcard/appdata.tgz data_pull/
tar -xzf data_pull/appdata.tgz -C data_pull/

## ------------------| Search sensitive data
grep -RniE 'token|refresh|access|bearer|jwt|password|secret|api[_-]?key|session|authorization|pin|otp' data_pull/ 2>/dev/null

## ------------------| List SQLite DBs
find data_pull/ -iname '*.db' -o -iname '*.sqlite' -o -iname '*.sqlite3'

## ------------------| Inspect SQLite
sqlite3 app.db ".tables"
sqlite3 app.db "select * from users limit 5;"

## ------------------| Debuggable app run-as access
adb shell run-as com.example.app id
adb shell run-as com.example.app ls -lah
adb shell run-as com.example.app find . -type f

01.8 WebView Security Review

WebView debugging should be disabled in production. OWASP recommends setting WebView.setWebContentsDebuggingEnabled(false) or enabling it only when the app is debuggable. Android also warns that native WebView bridges using addJavascriptInterface can create risks like XSS-driven manipulation of the host app and Java code execution with app permissions.

bash11 lines

## ------------------| Find WebView usage
grep -RniE 'WebView|setJavaScriptEnabled|addJavascriptInterface|setAllowFileAccess|setAllowUniversalAccessFromFileURLs|setWebContentsDebuggingEnabled|loadUrl|loadDataWithBaseURL' app_jadx/

## ------------------| Find JavaScript bridges
grep -Rni 'addJavascriptInterface' app_jadx/

## ------------------| Find WebView debugging
grep -Rni 'setWebContentsDebuggingEnabled' app_jadx/

## ------------------| Find risky file access
grep -RniE 'setAllowFileAccess\(true\)|setAllowFileAccessFromFileURLs\(true\)|setAllowUniversalAccessFromFileURLs\(true\)' app_jadx/

01.9 Crypto and Android Keystore Review

he Android Keystore is designed to keep key material non-exportable and restrict key usage conditions, including user authentication requirements and allowed crypto modes. Your notes should distinguish between keys stored in Keystoreand hardcoded keys in APK code/resources; those are completely different risk levels.

bash5 lines

## ------------------| Static crypto keyword search
grep -RniE 'Cipher|getInstance|AES|DES|RSA|ECB|CBC|GCM|MD5|SHA1|SHA-1|Random|SecureRandom|KeyStore|SecretKeySpec|IvParameterSpec|PBKDF2|Hmac' app_jadx/

## ------------------| Bad crypto patterns
grep -RniE 'AES/ECB|DES|MD5|SHA1|SHA-1|new Random\(|new SecureRandom\([^)]+\)|SecretKeySpec\(.*getBytes' app_jadx/

01.10 Repacking and Tamper Testing

bash33 lines

## ------------------| Decode APK
apktool d app.apk -o app_decoded

## ------------------| Modify smali/resources
vi app_decoded/AndroidManifest.xml

## ------------------| Rebuild APK
apktool b app_decoded -o rebuilt-unsigned.apk

## ------------------| Zipalign
zipalign -p -f 4 rebuilt-unsigned.apk rebuilt-aligned.apk

## ------------------| Generate test keystore
keytool -genkeypair \
  -v \
  -keystore test.keystore \
  -alias test \
  -keyalg RSA \
  -keysize 2048 \
  -validity 10000

## ------------------| Sign APK
apksigner sign \
  --ks test.keystore \
  --ks-key-alias test \
  --out rebuilt-signed.apk \
  rebuilt-aligned.apk

## ------------------| Verify signature
apksigner verify --verbose --print-certs rebuilt-signed.apk

## ------------------| Install rebuilt APK
adb install -r rebuilt-signed.apk

01.11 Flutter / React Native / Xamarin Checks

bash15 lines

## ------------------| Framework Notes
Flutter:
- Java SSL bypass may fail.
- Check libapp.so and libflutter.so.
- Native pinning often needs pattern patching or native hook.

React Native:
- Review index.android.bundle or Hermes bytecode.
- Search API endpoints, feature flags, analytics keys.
- Check native modules exposed to JS.

Xamarin:
- Review DLLs and managed assemblies.
- Check Frida-XamPwn style hooks.
- Validate native bridge exposure.

bash14 lines

## ------------------| Detect Flutter
find app_decoded/ -iname 'libflutter.so' -o -iname 'libapp.so' -o -iname 'flutter_assets'

## ------------------| Flutter strings and endpoints
strings app_decoded/lib/*/libapp.so | grep -Ei 'https?://|api|token|secret|graphql|firebase'

## ------------------| Detect React Native
find app_decoded/ -iname 'index.android.bundle' -o -iname '*.hbc'

## ------------------| React Native bundle strings
strings app_decoded/assets/index.android.bundle | grep -Ei 'https?://|api|token|secret|graphql|firebase'

## ------------------| Detect Xamarin
find app_decoded/ -iname '*.dll' -o -iname 'libmonodroid.so' -o -iname 'assemblies.blob'

02 Dynamic Analysis

bash20 lines

## ------------------| Global Proxy
adb shell settings put global http_proxy <IP>:<PORT>    ## Set Proxy
adb shell settings put global http_proxy :0             ## Remove Proxy
### No authentication
adb shell settings put global http_proxy <IP>:<PORT>
### With Authentication
adb shell settings put global http_proxy <IP>:<PORT>
adb shell settings put global global_http_proxy_host <IP>
adb shell settings put global global_http_proxy_port <PORT>
adb shell settings put global global_http_proxy_username <USER>
adb shell settings put global global_http_proxy_password <PASS>
### Disable proxy
adb shell settings delete global http_proxy
adb shell settings delete global global_http_proxy_host
adb shell settings delete global global_http_proxy_port
adb shell settings delete global global_http_proxy_username
adb shell settings delete global global_http_proxy_password
adb shell settings delete global global_http_proxy_exclusion_list
adb shell settings delete global global_proxy_pac_url
adb shell reboot

02.1 Emulator Setup

Android Studio Emulator on Apple Silicon

Method I (Google Play API with Magisk Modules)

bash30 lines

# ------------------| Download Command line tools
## Download command line tools from https://developer.android.com/studio
mkdir -p ~/Documents/Software/Android/sdk/cmdline-tools/latest/
mv cmdline-tools/* ~/Documents/Software/Android/sdk/cmdline-tools/latest/

# ------------------| Setup SDK
export ANDROID_AVD_HOME=~/.android/avd/
export ANDROID_HOME=~/Documents/Software/Android/sdk/
export ANDROID_SDK_ROOT=~/Documents/Software/Android/sdk/
export PATH=$PATH:$ANDROID_HOME/emulator:$ANDROID_HOME/tools:$ANDROID_HOME/tools/bin:$ANDROID_HOME/platform-tools
cd ~/Documents/Software/Android/sdk/cmdline-tools/latest/bin
./sdkmanager --list
./sdkmanager --install 'system-images;android-36;google_apis_playstore;arm64-v8a'
./sdkmanager "platform-tools" "platforms;android-36"
./avdmanager create avd --name Pixel_7Pro --package "system-images;android-36;google_apis_playstore;arm64-v8a" --tag "google_apis_playstore" --abi "arm64-v8a" --device "pixel_7_pro"
~/Documents/Software/Android/sdk/emulator/emulator @Pixel_7Pro -no-snapshot-load -writable-system

# ------------------| Root
git clone https://github.com/newbit1/rootAVD.git && cd rootAVD
./rootAVD.sh system-images/android-30/google_apis_playstore/arm64-v8a/ramdisk.img

# ------------------| Install Frida Modules
git clone https://github.com/ViRb3/magisk-frida.git && cd magisk-frida
python3 -m pip install requests
python3 main.py
adb push build/MagiskFrida-0.zip /sdcard/

# ------------------| Virtual keybord support
vi ~/.android/avd/Pixel_7Pro.avd/config.ini
## change hw.keyboard = yes

Method II (Google Play API Native Flash)

bash51 lines

# ------------------| Download Command line tools
## Download command line tools from https://developer.android.com/studio
mkdir -p ~/Documents/Software/Android/sdk/cmdline-tools/latest/
mv cmdline-tools/* ~/Documents/Software/Android/sdk/cmdline-tools/latest/

# ------------------| Setup SDK
export ANDROID_HOME=~/Documents/Software/Android/sdk
export ANDROID_SDK_ROOT=$ANDROID_HOME
export ANDROID_AVD_HOME=~/.android/avd
export PATH=$PATH:$ANDROID_HOME/emulator
export PATH=$PATH:$ANDROID_HOME/tools
export PATH=$PATH:$ANDROID_HOME/tools/bin
export PATH=$PATH:$ANDROID_HOME/platform-tools
export PATH=$PATH:$ANDROID_HOME/cmdline-tools/latest/bin
cd ~/Documents/Software/Android/cmdline-tools/bin
./sdkmanager --list
./sdkmanager --install 'system-images;android-30;google_apis;arm64-v8a'
./sdkmanager "platform-tools" "platforms;android-30"
./avdmanager create avd --name Pixel_7Pro --package "system-images;android-30;google_apis;arm64-v8a" --tag "google_apis" --abi "arm64-v8a" --device "pixel_7_pro"
~/Documents/Software/Android/sdk/emulator/emulator @Pixel_7Pro -no-snapshot-load -writable-system

# ------------------| Root
git clone https://github.com/newbit1/rootAVD.git && cd rootAVD
./rootAVD.sh system-images/android-30/google_apis/arm64-v8a/ramdisk.img

# ------------------| Make system file writeble
wget https://github.com/wuxianlin/android_tools/raw/master/adbd-Insecure-v2.00.apk
adb install adbd-Insecure-v2.00.apk
adb reboot
adb root
adb remount
## Now you can write anything on /system

# ------------------| Install Google Play
## Download pico gapps
https://opengapps.org
unzip open_gapps-x86_64-6.0-pico-20170304.zip
rm Core/setup*
lzip -d Core/*.lz
for f in $(ls Core/*.tar); do tar -x --strip-components 2 -f $f; done
adb remount
adb push etc /system
adb push framework /system
adb push app /system
adb push priv-app /system
adb shell stop
adb shell start

# ------------------| Virtual keybord support
vi ~/.android/avd/Pixel_7Pro.avd/config.ini
## change hw.keyboard = yes

Install Anbox on kali linux

bash16 lines

## ------------------| Setup
sudo apt install anbox
sudo apt install android-tools-adb
sudo /sbin/modprobe ashmem_linux
sudo /sbin/modprobe binder_linux
ls -1 /dev/{ashmem,binder}
wget https://build.anbox.io/android-images/2018/07/19/android_amd64.img
sudo mv android_amd64.img /var/lib/anbox/android.img
sudo service anbox-container-manager restart

# ------------------| Start
anbox launch --package=org.anbox.appmgr --component=org.anbox.appmgr.AppViewActivity

# ------------------| Install F-Droid
wget https://f-droid.org/F-Droid.apk
adb install F-Droid.apk

Installing Android on VMWare Workstation

bash17 lines

# ------------------| Download ISO
https://www.android-x86.org/

# ------------------| Setup VMWare and Install
Choose Other Linux 4.x
Advanced options... --> Auto_Installation --> Reboot

# ------------------| Fix boot-up freeze
## Step 01: Open grub editor (e)
## Step 02: Replace 'quiet' to 'nomodeset xforcevesa' and press enter
## Step 03: Press b
## Step 04: When you see Android logo press Alt+F1
## Step 05: Type following commands
mkdir /mnt/sda
mount /dev/block/sda1 /mnt/sda
vi /mnt/sda/grub/menu.lst
## Step 05: Replace 'quiet' to 'nomodeset xforcevesa' and save and reboot

Install BurpSuite Certificate

bash17 lines

## ------------------| Using Magisk
wget https://github.com/h4rithd/BurpSuitCert/releases/download/1.0.0/BurpSuiteCert.zip
adb push BurpSuiteCert.zip /data/local/tmp/
adb shell
su
magisk --install-module /data/local/tmp/BurpSuiteCert.zip
reboot

## ------------------| Manual Mode
cacert.der
openssl x509 -inform DER -in cacert.der -out cacert.pem
mv cacert.pem $(openssl x509 -inform PEM -subject_hash_old -in cacert.pem |head -1).0
adb shell
adb push 9a5ba575.0 /sdcard/
mount -o rw,remount /system
mv /sdcard/9a5ba575.0 /system/etc/security/cacerts/
chmod 644 /system/etc/security/cacerts/9a5ba575.0

Errors

Auto start frida-server

bash15 lines

#!/system/bin/sh
(
    while [ "$(getprop sys.boot_completed)" != "1" ]; do
        sleep 2
    done
    sleep 20
    /data/local/tmp/frida-server -D
    echo "Frida started at $(date)" >> /data/local/tmp/frida_boot.log
) &

### adb push start_frida.sh /data/local/tmp/start_frida.sh
### mv /data/local/tmp/start_frida.sh /data/adb/service.d/
### chmod +x /data/adb/service.d/start_frida.sh
### chown root:root /data/adb/service.d/start_frida.sh
### chmod 755 /data/local/tmp/frida-server

Fix NET::ERR_CERT_AUTHORITY_INVALID Issue

bash17 lines

### Get the base64 encoded SHA256 fingerprint of the certificate
openssl x509 -in 9a5ba575.0 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
### Create a chflag file with the following content
### chrome --ignore-certificate-errors-spki-list=<base64_encoded_fingerprint>
echo 'chrome --ignore-certificate-errors-spki-list=zbu8GKlP5w8KK7vU+fV059UOM7O1RKVOsz2Gdc3oB1Y=' > chflag
### Execute the following commands to push the chflag file to the device
adb push chflag /sdcard/chflag
adb su
chmod 555 /sdcard/chflag
cp /sdcard/chflag /data/local/chrome-command-line
cp /sdcard/chflag /data/local/android-webview-command-line
cp /sdcard/chflag /data/local/webview-command-line
cp /sdcard/chflag /data/local/content-shell-command-line
cp /sdcard/chflag /data/local/tmp/chrome-command-line
cp /sdcard/chflag /data/local/tmp/android-webview-command-line
cp /sdcard/chflag /data/local/tmp/webview-command-line
cp /sdcard/chflag /data/local/tmp/content-shell-command-line

02.2 Frida Framework

Basic

bash30 lines

## ------------------| List running apps
frida-ps -Ua

## ------------------| List installed apps
frida-ps -Uia

## ------------------| Auto-trace Java methods (Android)
frida-trace -U -j "com.package.ClassName!methodName"

## ------------------| Auto-trace ObjC methods (iOS)
frida-trace -U -m "-[ClassName *]" "AppName"

## ------------------| Auto-trace C functions (by name)
frida-trace -U -i "functionName" "AppName"

## ------------------| frida-trace to trace specific functions (quick)
frida-trace -U -i "SSL_*" -i "crypto_*" -n com.example.app

## ------------------| Spawn app and attach (resume)
frida -U -f com.example.app -l hook.js --no-pause

## ------------------| Attach to running process by name
frida -U -n com.example.app -l hook.js

## ------------------| Attach to running process by PID
frida -U -p 1234 -l hook.js

## ------------------| Remote device (adb forward first)
adb forward tcp:27042 tcp:27042
frida -H 127.0.0.1:27042 -n com.example.app -l hook.js

Scripts

bash88 lines

## ------------------| [SCRIPT] Basic Android Root Bypass
# Save as root_bypass.js and load with 'frida -U -l root_bypass.js -f com.package.name'
Java.perform(function() {
    var RootClass = Java.use("com.app.security.RootDetector");
    RootClass.isDeviceRooted.implementation = function() {
        console.log("[+] Bypassing root detection!");
        return false;
    };
});

## ------------------| [SCRIPT] Find all loaded classes (Android)
# Run in Frida REPL (frida -U -f com.package.name)
Java.perform(function() {
    Java.enumerateLoadedClasses({
        onMatch: function(className) {
            console.log(className);
        },
        onComplete: function() {
            console.log("[+] Class enumeration complete.");
        }
    });
});

Java.perform(function () {
    Java.enumerateLoadedClasses({
        onMatch: function (name) {
            if (
                name.toLowerCase().includes('root') ||
                name.toLowerCase().includes('ssl') ||
                name.toLowerCase().includes('pin') ||
                name.toLowerCase().includes('frida') ||
                name.toLowerCase().includes('emulator') ||
                name.toLowerCase().includes('integrity')
            ) {
                console.log(name);
            }
        },
        onComplete: function () {
            console.log('[+] Class search complete');
        }
    });
});

## ------------------| [SCRIPT] Trace all methods in a class (Android)
# Run in Frida REPL or save to file
Java.perform(function() {
    var targetClass = 'com.package.name.TargetClass';
    var methods = Java.use(targetClass).class.getDeclaredMethods();

    methods.forEach(function(method) {
        var methodName = method.getName();
        console.log("[+] Hooking: " + methodName);

        Java.use(targetClass)[methodName].implementation = function() {
            console.log("[*] Called: " + targetClass + "." + methodName);
            return this[methodName].apply(this, arguments);
        };
    });
});

## ------------------| [SCRIPT] Dump strings and memory (useful quick)
# Run in Frida REPL or save to file
var ranges = Process.enumerateRanges('--x');
ranges.forEach(function(r){
    try {
        var s = Memory.readUtf8String(r.base, 256);
        if (s && s.length > 4) console.log(r.base + " -> " + s);
    } catch(e){}
});

## ------------------| [SCRIPT] OkHttp CertificatePinner bypass for test build
Java.perform(function () {
    try {
        const CertificatePinner = Java.use('okhttp3.CertificatePinner');

        CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function (hostname, peerCertificates) {
            console.log('[+] OkHttp pin bypass: ' + hostname);
            return;
        };

        CertificatePinner.check.overload('java.lang.String', '[Ljava.security.cert.Certificate;').implementation = function (hostname, certs) {
            console.log('[+] OkHttp pin bypass: ' + hostname);
            return;
        };
    } catch (e) {
        console.log('[-] OkHttp CertificatePinner not found: ' + e);
    }
});

Best Scripts

OneRule by h4rithd

02.3 Magisk

Best Magisk Modules

Name	Usage
LSPosed	Zygisk‑based Xposed framework. Install module ZIP via Magisk, activate it in Zygisk > DenyList, then enable per-app hooks in the LSPosed app.
BurpSuitCert	Systemlessly installs Burp Suite’s CA cert. Flash the Magisk ZIP, reboot, and trust the Burp CA for HTTPS interception.
MagiskHidePropsConf	Spoofs system props (e.g. fingerprint, device model). Install ZIP, use its GUI to set “safetynet” or “pixel” profiles, reboot.
Shizuku	Run apps with elevated privileges via ADB or root. Install Shizuku APK, activate service (via Magisk module or ADB), grant permissions in-app.
ZygiskNext	Extends Zygisk control/system patching. Install ZIP via Magisk, enable it, configure filters in its app.
Zygisk-SSL-Unpinning	Bypasses SSL pinning automatically. Flash the ZIP, reboot, enable module in Zygisk and it hooks SSL at runtime.
IAmNotADeveloper	Hides developer/dev debug flags. Flash ZIP, reboot, and it suppresses “developer” checks in apps.
safetynet-fix	Fixes SafetyNet attestation. Install release ZIP via Magisk, reboot, test with SafetyNet API.
PlayIntegrityFork	Spoofs/bypasses Play Integrity API responses. Flash ZIP, reboot, and it hooks Play Integrity at runtime.
Hide-My-Applist	Hides selected apps from detection. Install module, open its interface and pick which apps to conceal, reboot.
Zygisk-Assistant	UI manager for Zygisk modules. Flash module via Magisk, then use its app to order, enable/disable modules easily.
KernelSU	Kernel-level root alternative. Flash custom KernelSU ZIP (replacing Magisk), reboot to get root without Magisk footprints.
APatch	Runtime app patching via Zygisk. Flash module, enable in Zygisk, use its interface to apply live patches (e.g. bypass checks).

Best Android RATs