Android Penetration Testing with Frida: A Comprehensive Guide with Examples

As mobile devices become increasingly integral to our daily lives, securing Android applications against potential vulnerabilities is of paramount importance. Android penetration testing involves assessing the security of Android applications and the underlying operating system to identify and mitigate potential risks. One powerful tool in the arsenal of penetration testers is Frida, an open-source dynamic instrumentation toolkit. In this comprehensive guide, we will explore Android penetration testing using Frida, covering its installation, basic usage, and advanced techniques through detailed examples.

Understanding Android Penetration Testing:

Android penetration testing involves simulating real-world attacks to uncover vulnerabilities in applications and the Android OS. Common security concerns include insecure data storage, improper session handling, and insecure communication. By employing Frida, a dynamic instrumentation tool, penetration testers gain the ability to inject custom scripts into running Android applications, allowing for real-time manipulation and analysis.

Installing Frida:

Before delving into Android penetration testing with Frida, it’s crucial to install the toolkit. Frida supports various platforms, including Windows, macOS, and Linux. In this example, we’ll focus on installing Frida on a Linux system.

# Install Frida using pip
pip install frida-tools

For Android devices, Frida requires an agent to be installed. Frida provides a standalone application, “Frida Server,” that needs to be run on the Android device. Download the appropriate version of Frida Server for Android from the official Frida GitHub repository.

# Push Frida Server to the Android device
adb push frida-server /data/local/tmp/

# Set executable permissions
adb shell chmod 755 /data/local/tmp/frida-server

# Start Frida Server on the Android device
adb shell /data/local/tmp/frida-server &

Basic Frida Usage:

Once Frida is installed and the server is running on the Android device, we can start with basic Frida usage.

Example 1: Hooking Android Functions

Frida allows users to hook into Android functions dynamically. In this example, let’s hook the “getDeviceId” method in the TelephonyManager class to monitor device information.

// Android hooking script using Frida
Java.perform(function() {
  var TelephonyManager = Java.use('android.telephony.TelephonyManager');
  
  TelephonyManager.getDeviceId.implementation = function() {
    var deviceId = this.getDeviceId();
    console.log('[+] Device ID:', deviceId);
    return deviceId;
  };
});

This script intercepts the “getDeviceId” method, logs the device ID, and then allows the method to proceed as usual.

Example 2: Bypassing Certificate Pinning

Many Android applications implement certificate pinning to enhance security. Frida can be used to bypass this protection dynamically.

// Bypassing certificate pinning using Frida
Java.perform(function() {
  var CertificatePinner = Java.use('okhttp3.CertificatePinner');
  
  CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function() {
    console.log('[+] Bypassing Certificate Pinning');
    return;
  };
});

This script intercepts the certificate pinning check, effectively bypassing the protection.

Advanced Frida Techniques:

As penetration testers become more proficient with Frida, they can explore advanced techniques to address complex scenarios.

Example 3: Dynamic API Hooking

Frida allows dynamic hooking of native functions as well. In this example, let’s hook the native function “malloc” to log memory allocations.

// Dynamic API hooking with Frida
Interceptor.attach(Module.findExportByName(null, 'malloc'), {
  onEnter: function(args) {
    var size = args[0].toInt32();
    console.log('[+] Memory Allocation:', size, 'bytes');
  },
});

This script attaches to the “malloc” function and logs the size of each memory allocation.

Example 4: Custom Frida Modules

Frida supports the creation of custom modules to encapsulate functionality. In this example, let’s create a custom module to perform custom actions on Android SMS messages.

// Custom Frida module for SMS manipulation
var SmsModule = {
  sendSMS: function(number, message) {
    var SmsManager = Java.use('android.telephony.SmsManager');
    SmsManager.getDefault().sendTextMessage(number, null, message, null, null);
    console.log('[+] SMS Sent to', number, ':', message);
  }
};

// Export the module for use in scripts
rpc.exports = SmsModule;

This script defines a custom module for sending SMS messages and exports it for use in other Frida scripts.

Integrating Frida with Burp Suite:

Penetration testers often use Burp Suite for web application testing. Integrating Frida with Burp Suite allows for a more comprehensive assessment of both web and mobile applications.

Example 5: Intercepting Network Traffic with Frida and Burp Suite

// Frida script for intercepting network traffic
Java.perform(function() {
  var OkHttpClient = Java.use('okhttp3.OkHttpClient');
  
  OkHttpClient.newCall.implementation = function(request) {
    console.log('[+] Intercepting HTTP Request:', request.url().toString());
    var response = this.newCall(request).execute();
    console.log('[+] Intercepting HTTP Response:', response.body().string());
    return response;
  };
});

This script intercepts HTTP requests made by the OkHttpClient class, allowing penetration testers to inspect and manipulate network traffic using Burp Suite.

Conclusion:

Android penetration testing with Frida provides a powerful and flexible approach to assess the security of Android applications. From basic hooking to advanced techniques and integration with tools like Burp Suite, penetration testers can uncover and address vulnerabilities effectively. Continuous learning and exploration of Frida’s capabilities contribute to a robust skill set for securing mobile applications in today’s dynamic cybersecurity landscape.

DockerHub Link

To try out a demo environment for different vulnerabilities, you can visit our DockerHub repository here https://hub.docker.com/u/pawanjswal

Video Tutorial

Video tutorials for exploiting vulnerabilities are available here https://www.youtube.com/@OpenExploit

About OpenExploit

OpenExploit is a learning platform dedicated to exploring and understanding vulnerabilities in open-source and widely used applications. We focus on manual exploitation techniques, enabling security enthusiasts to learn and build their skills without over-reliance on automation scripts. Visit the blog here https://blog.openexploit.in