Android Pentesting Tricks

# Frida Script Templates for Android Testing

> **AI LOAD INSTRUCTION**: Load this when you need ready-to-use Frida scripts for Android application testing. Covers SSL pinning bypass, root detection bypass, method tracing, crypto hooks, and WebView debugging. Assumes the main [SKILL.md](./SKILL.md) is already loaded for general Android testing methodology.

---

## 1. UNIVERSAL SSL PINNING BYPASS

```javascript
// frida_ssl_bypass.js — hooks multiple SSL validation points
Java.perform(function() {

    // Hook TrustManager
    var TrustManager = Java.registerClass({
        name: 'com.frida.TrustManager',
        implements: [Java.use('javax.net.ssl.X509TrustManager')],
        methods: {
            checkClientTrusted: function(chain, authType) {},
            checkServerTrusted: function(chain, authType) {},
            getAcceptedIssuers: function() { return []; }
        }
    });

    var SSLContext = Java.use('javax.net.ssl.SSLContext');
    SSLContext.init.overload(
        '[Ljavax.net.ssl.KeyManager;',
        '[Ljavax.net.ssl.TrustManager;',
        'java.security.SecureRandom'
    ).implementation = function(km, tm, sr) {
        this.init(km, [TrustManager.$new()], sr);
    };

    // Hook OkHttp3 CertificatePinner
    try {
        var CertPinner = Java.use('okhttp3.CertificatePinner');
        CertPinner.check.overload('java.lang.String', 'java.util.List')
            .implementation = function(hostname, peerCerts) {
            return; // skip pinning check
        };
    } catch(e) {}

    // Hook OkHttp3 CertificatePinner.check$okhttp
    try {
        var CertPinner = Java.use('okhttp3.CertificatePinner');
        CertPinner['check$okhttp'].implementation = function(hostname, fn) {
            return;
        };
    } catch(e) {}

    // Hook HttpsURLConnection
    try {
        var HttpsConn = Java.use('javax.net.ssl.HttpsURLConnection');
        HttpsConn.setSSLSocketFactory.implementation = function(factory) {
            return; // prevent custom factory
        };
        HttpsConn.setHostnameVerifier.implementation = function(verifier) {
            return; // prevent custom verifier
        };
    } catch(e) {}

    console.log('[+] SSL Pinning bypassed');
});
```

---

## 2. ROOT DETECTION BYPASS

```javascript
// frida_root_bypass.js — comprehensive root detection bypass
Java.perform(function() {

    // Hook File.exists for su binary checks
    var File = Java.use('java.io.File');
    var rootPaths = ['/system/xbin/su', '/sbin/su', '/system/bin/su',
        '/system/su', '/data/local/xbin/su', '/data/local/bin/su',
        '/su/bin/su', '/magisk/.core/bin/su'];

    File.exists.implementation = function() {
        var path = this.getAbsolutePath();
        for (var i = 0; i < rootPaths.length; i++) {
            if (path === rootPaths[i]) {
                console.log('[Root Bypass] File.exists blocked: ' + path);
                return false;
            }
        }
        return this.exists();
    };

    // Hook Build.TAGS
    var Build = Java.use('android.os.Build');
    Build.TAGS.value = 'release-keys';

    // Hook PackageManager for Magisk/SuperSU detection
    var PM = Java.use('android.app.ApplicationPackageManager');
    var rootPackages = ['com.topjohnwu.magisk', 'eu.chainfire.supersu',
        'com.koushikdutta.superuser', 'com.noshufou.android.su'];

    PM.getPackageInfo.overload('java.lang.String', 'int').implementation = function(name, flags) {
        for (var i = 0; i < rootPackages.length; i++) {
            if (name === rootPackages[i]) {
                console.log('[Root Bypass] PM.getPackageInfo blocked: ' + name);
                throw Java.use('android.content.pm.PackageManager$NameNotFoundException').$new(name);
            }
        }
        return this.getPackageInfo(name, flags);
    };

    // Hook Runtime.exec for "which su" checks
    var Runtime = Java.use('java.lang.Runtime');
    Runtime.exec.overload('java.lang.String').implementation = function(cmd) {