Mobile App Pentesting Lab Setup: The Complete 2026 Guide (Android, Burp, Frida)

# ADB + VirtualBox (Genymotion's backend) + xz (to unpack frida-server)
sudo apt update
sudo apt install -y adb virtualbox xz-utils

# Frida CLI + Objection, isolated with pipx
sudo apt install -y pipx
pipx ensurepath            # adds ~/.local/bin to PATH — restart your shell afterwards
pipx install frida-tools   # provides: frida, frida-ps, frida-trace (pulls in the frida core)
pipx install objection     # runtime exploration and one-command bypasses

frida --version            # e.g. 17.15.1

adb devices -l
# 192.168.56.106:5555   device product:vbox86p model:Pixel_9

adb shell getprop ro.build.version.release   # 14
adb shell getprop ro.product.cpu.abi         # x86_64

adb shell 'su -c id'   # su: inaccessible or not found
adb root               # adbd cannot run as root because the device is not rooted

adb reboot

adb wait-for-device
adb shell 'su -c id'                          # uid=0(root) ... context=u:r:magisk:s0
adb shell pm list packages | grep magisk      # package:com.topjohnwu.magisk

adb shell 'su -c "for c in all default wlan0 radio0 eth0; do sysctl -w net.ipv6.conf.$c.disable_ipv6=1; done"'

M=/tmp/noipv6; rm -rf $M; mkdir -p $M
printf 'id=noipv6\nname=Disable IPv6\nversion=1.0\nversionCode=1\nauthor=lab\ndescription=Force IPv4 (Genymotion IPv6 is not routable)\n' > $M/module.prop
printf '#!/system/bin/sh\nuntil [ "$(getprop sys.boot_completed)" = 1 ]; do sleep 2; done\nsleep 3\nfor c in all default wlan0 radio0 eth0; do sysctl -w net.ipv6.conf.$c.disable_ipv6=1 2>/dev/null; done\n' > $M/service.sh
chmod 644 $M/service.sh
( cd $M && zip -qr /tmp/noipv6.zip . )
adb push /tmp/noipv6.zip /data/local/tmp/noipv6.zip
adb shell 'su -c "magisk --install-module /data/local/tmp/noipv6.zip"'

adb shell 'toybox nc -w 6 google.com 443 </dev/null && echo CONNECTED'

BURP=127.0.0.1:8080                                          # your Burp listener
curl -s http://$BURP/cert -o burp.der
openssl x509 -inform der -in burp.der -out burp.pem
HASH=$(openssl x509 -subject_hash_old -noout -in burp.pem)   # e.g. 9a5ba575
cp burp.pem "$HASH.0"
echo "Cert file = $HASH.0"
adb push "$HASH.0" /data/local/tmp/

adb shell 'su -c "
  mkdir -p /data/misc/user/0/cacerts-added
  cp /data/local/tmp/'"$HASH"'.0 /data/misc/user/0/cacerts-added/
  chown system:system /data/misc/user/0/cacerts-added/'"$HASH"'.0
  chmod 644 /data/misc/user/0/cacerts-added/'"$HASH"'.0
  chcon u:object_r:keychain_data_file:s0 /data/misc/user/0/cacerts-added/'"$HASH"'.0
  stop && start
"'

PKG=org.mozilla.firefox
PROF=$(adb shell "su -c 'ls /data/data/$PKG/files/mozilla/ | grep .default'" | tr -d '\r')
UID=$(adb shell "su -c 'stat -c %u /data/data/$PKG'" | tr -d '\r')
printf 'user_pref("security.enterprise_roots.enabled", true);\n' > /tmp/user.js
adb push /tmp/user.js /data/local/tmp/user.js
adb shell "su -c 'cp /data/local/tmp/user.js /data/data/$PKG/files/mozilla/$PROF/user.js; \
  chown $UID:$UID /data/data/$PKG/files/mozilla/$PROF/user.js; \
  restorecon /data/data/$PKG/files/mozilla/$PROF/user.js; am force-stop $PKG'"

M=/tmp/burpca; rm -rf $M; mkdir -p $M/system/etc/security/cacerts
cp "$HASH.0" $M/system/etc/security/cacerts/$HASH.0      # $HASH from Step 1 above

cat > $M/module.prop <<EOF
id=burpca
name=Burp CA System Trust (A14)
version=1.0
versionCode=1
author=lab
description=Trust the Burp CA in the app (system + APEX) trust store.
EOF

# Magic-mount injects /system/etc/security/cacerts automatically.
# post-fs-data.sh also injects the Conscrypt APEX store, before zygote, so apps inherit it.
cat > $M/post-fs-data.sh <<EOF
#!/system/bin/sh
MODDIR=\${0%/*}
CERT="\$MODDIR/system/etc/security/cacerts/$HASH.0"
APEX=/apex/com.android.conscrypt/cacerts
i=0; while [ ! -d "\$APEX" ] && [ \$i -lt 30 ]; do sleep 0.3; i=\$((i+1)); done
[ -d "\$APEX" ] || exit 0
TMP=/dev/.burpca; rm -rf "\$TMP"; mkdir -p "\$TMP"
cp -f "\$APEX"/* "\$TMP"/ 2>/dev/null; cp -f "\$CERT" "\$TMP"/
chmod 644 "\$TMP"/*; chcon u:object_r:system_security_cacerts_file:s0 "\$TMP"/* 2>/dev/null
mount -t tmpfs tmpfs "\$APEX"; cp -f "\$TMP"/* "\$APEX"/
chmod 644 "\$APEX"/*; chcon u:object_r:system_security_cacerts_file:s0 "\$APEX"/* 2>/dev/null
EOF
chmod 644 $M/post-fs-data.sh

( cd $M && zip -qr /tmp/burpca.zip . )
adb push /tmp/burpca.zip /data/local/tmp/burpca.zip
adb shell 'su -c "magisk --install-module /data/local/tmp/burpca.zip"'
adb reboot

adb wait-for-device; sleep 5
PID=$(adb shell "su -c 'pidof com.android.systemui'" | tr -d '\r')
adb shell "su -c 'ls /proc/$PID/root/system/etc/security/cacerts/$HASH.0 /proc/$PID/root/apex/com.android.conscrypt/cacerts/$HASH.0'"

adb shell settings put global http_proxy 192.168.56.1:8080     # enable  (host = 192.168.56.1)
adb shell settings put global http_proxy :0                    # disable

export BURP_PORT=8080              # your Burp listener
export BURP_IFACE=wlan0            # the host interface the VM can reach (vboxnet0 for Genymotion's static 192.168.56.1)

# Auto-detect the host IP from $BURP_IFACE and point the device at Burp
alias proxy_on='adb shell settings put global http_proxy $(ip -4 addr show "$BURP_IFACE" | grep -oP "(?<=inet\s)\d+(\.\d+){3}"):$BURP_PORT'
alias proxy_off='adb shell settings put global http_proxy :0'

#!/usr/bin/env bash
BURP_IFACE="${BURP_IFACE:-wlan0}"; BURP_PORT="${BURP_PORT:-8080}"
HOST_IP=$(ip -4 addr show "$BURP_IFACE" | grep -oP '(?<=inet\s)\d+(\.\d+){3}')   # auto-detect host IP
adb connect 192.168.56.106:5555 >/dev/null 2>&1     # your device serial (no-op if already connected)
adb shell "su -c 'for c in all default wlan0 radio0 eth0; do sysctl -w net.ipv6.conf.\$c.disable_ipv6=1 2>/dev/null; done'"
adb push ~/tools/frida-server /data/local/tmp/frida-server >/dev/null
adb shell "su -c 'chmod 755 /data/local/tmp/frida-server; pkill -f frida-server 2>/dev/null; setsid /data/local/tmp/frida-server >/dev/null 2>&1 </dev/null &'"
adb shell "settings put global http_proxy ${HOST_IP}:${BURP_PORT}"
echo "[ok] IPv6 disabled, frida-server running, proxy -> ${HOST_IP}:${BURP_PORT}"

chmod +x ~/tools/geny.sh

VER=$(frida --version)
ABI=$(adb shell getprop ro.product.cpu.abi | tr -d '\r')     # x86_64
wget -O frida-server.xz "https://github.com/frida/frida/releases/download/$VER/frida-server-$VER-android-$ABI.xz"
unxz frida-server.xz
mkdir -p ~/tools && mv frida-server ~/tools/frida-server

adb push ~/tools/frida-server /data/local/tmp/frida-server
adb shell "su -c 'chmod 755 /data/local/tmp/frida-server; setsid /data/local/tmp/frida-server >/dev/null 2>&1 </dev/null &'"
frida-ps -U | head

objection -g com.example.app explore --startup-command "android sslpinning disable"

objection -g com.example.app explore                                      # interactive REPL
objection -g com.example.app explore --startup-command "android sslpinning disable"
objection -g com.example.app explore -s "android root disable"            # multiple startup cmds with ;
objection -g com.example.app run android sslpinning disable               # one command, no REPL
objection -g com.example.app explore --startup-script hooks.js            # load a Frida script on start
objection patchapk -s target.apk                                          # repackage APK with Frida gadget (non-root)

# --- Session / help ---
help                                   # list all commands (help <cmd> for detail)
commands                               # full command tree
reconnect                              # reconnect to the agent
jobs list                              # show active hooks/jobs (each hook is a job)
jobs kill <job-id>                     # remove a specific hook
exit                                   # quit

# --- SSL pinning / root / debug bypasses ---
android sslpinning disable             # kill certificate pinning (OkHttp, TrustManager, Conscrypt, …)
android sslpinning disable --quiet     # same, without per-call logging
android root disable                   # bypass common root-detection checks
android root simulate                  # make the app believe the device IS rooted (testing)

# --- Recon: environment & components ---
env                                    # app data dirs, code paths, libraries
frida                                  # Frida runtime + device info
android hooking list activities        # all activities
android hooking list services          # all services
android hooking list receivers         # all broadcast receivers
android hooking get current_activity   # the activity on screen right now
android hooking list classes           # every loaded class (large)
android hooking search classes login   # find loaded classes by keyword
android hooking search methods <pattern>            # find methods by keyword
android hooking list class_methods com.example.app.AuthManager   # methods of one class

# --- Method hooking / runtime tampering ---
android hooking watch class com.example.app.AuthManager          # log every call into a class
android hooking watch class_method com.example.app.Login.check --dump-args --dump-return --dump-backtrace
android hooking set return_value com.example.app.RootCheck.isRooted false
android hooking set return_value com.example.app.License.isValid true
android hooking generate simple com.example.app.AuthManager      # print a ready-to-edit Frida hook

# --- Local storage & secrets ---
android keystore list                  # entries in the Android Keystore
android keystore watch                 # log Keystore usage live
android keystore clear                 # wipe Keystore entries (destructive)
sqlite connect /data/data/<pkg>/databases/app.db    # open a DB → then: .tables / .schema / SQL
android clipboard monitor              # dump clipboard contents as they change

# --- Filesystem (operates inside the app sandbox) ---
pwd ; ls ; cd /data/data/<pkg>         # browse the sandbox
file cat /data/data/<pkg>/shared_prefs/prefs.xml     # print a file
file download /data/data/<pkg>/shared_prefs/prefs.xml ./prefs.xml
file upload payload.txt /data/local/tmp/payload.txt
rm /data/local/tmp/payload.txt

# --- Memory ---
memory list modules                    # loaded native modules
memory list exports libssl.so          # exported symbols of a module
memory search "api_key" --string       # scan process memory for a string
memory dump all app_memory.bin         # dump the full process memory
memory dump from_base <module> <offset> <size> out.bin

# --- UI / screenshots ---
android ui screenshot shot.png         # capture the current screen
android ui FLAG_SECURE false           # disable FLAG_SECURE (allow screenshots of "secure" screens)

# --- Intents / deep links ---
android intent launch_activity com.example.app.DeepLinkActivity
android intent launch_service com.example.app.SyncService

# --- Run a raw shell command / load a custom Frida script ---
android shell_exec "id"                # run a device shell command from the REPL
import myhook.js                        # load and run a custom Frida script in the app

git clone https://github.com/httptoolkit/frida-interception-and-unpinning.git ~/tools/htk-unpin
# Edit ~/tools/htk-unpin/config.js: paste burp.pem into CERT_PEM, set PROXY_HOST=192.168.56.1, PROXY_PORT=8080

gh release download -R t0thkr1s/allsafe-android --pattern '*.apk' --dir ~/tools --clobber   # or download from the Releases page
adb install -r ~/tools/allsafe.apk        # package: infosecadventures.allsafe

'use strict';
// MASTER Android root-detection bypass.  Spawn with:  frida -U -f <pkg> -l ~/tools/root-bypass.js
// For a stubborn custom flag, add "fully.qualified.Class.method" to CONFIG_EXTRA.
var CONFIG_EXTRA = [
  // 'com.example.security.RootUtil.isDeviceRooted',
];
var ROOT_TOKENS = ['su','busybox','magisk','magiskhide','magiskinit','superuser','supersu','daemonsu',
  'kingouser','kingoroot','xposed','substrate','riru','zygisk','topjohnwu','eu.chainfire',
  '/sbin/su','/system/xbin/su','/system/bin/su','/su/bin','which su'];
var ROOT_PKGS = ['com.topjohnwu.magisk','eu.chainfire.supersu','com.koushikdutta.superuser',
  'com.noshufou.android.su','com.thirdparty.superuser','com.yellowes.su','com.kingouser.com','me.weishu.kernelsu'];
var SECURE_PROPS = {'ro.debuggable':'0','ro.secure':'1','ro.build.type':'user','ro.build.tags':'release-keys',
  'ro.build.selinux':'1','service.adb.root':'0','ro.boot.veritymode':'enforcing'};
function rooty(s){ if(!s) return false; s=(''+s).toLowerCase(); for(var i=0;i<ROOT_TOKENS.length;i++) if(s.indexOf(ROOT_TOKENS[i])!==-1) return true; return false; }
var n = { file:0, exec:0, pm:0, prop:0, rootbeer:0, generic:0, native:0 };

Java.perform(function () {
  // 1) java.io.File checks
  try {
    var File = Java.use('java.io.File');
    ['exists','canRead','canExecute','isFile','isDirectory'].forEach(function(m){
      if (!File[m]) return;
      File[m].overload().implementation = function(){ if (rooty(this.getAbsolutePath())) { n.file++; return false; } return this[m](); };
    });
  } catch(e){}
  // 2) Runtime.exec / ProcessBuilder
  try {
    var RT = Java.use('java.lang.Runtime'); var IOE = Java.use('java.io.IOException');
    var blk = function(c){ if (rooty(c)) { n.exec++; throw IOE.$new('not found'); } };
    RT.exec.overload('java.lang.String').implementation = function(c){ blk(c); return this.exec(c); };
    RT.exec.overload('[Ljava.lang.String;').implementation = function(c){ blk(c.join(' ')); return this.exec(c); };
    RT.exec.overload('java.lang.String','[Ljava.lang.String;').implementation = function(c,e){ blk(c); return this.exec(c,e); };
    RT.exec.overload('[Ljava.lang.String;','[Ljava.lang.String;').implementation = function(c,e){ blk(c.join(' ')); return this.exec(c,e); };
    var PB = Java.use('java.lang.ProcessBuilder');
    PB.start.implementation = function(){
      try { if (rooty(this.command().toString())) { n.exec++; throw IOE.$new('not found'); } } catch(e){ if((''+e).indexOf('not found')!==-1) throw e; }
      return this.start();
    };
  } catch(e){}
  // 3) PackageManager — hide root-management apps
  try {
    var PM = Java.use('android.app.ApplicationPackageManager'); var NNFE = Java.use('android.content.pm.PackageManager$NameNotFoundException');
    ['getPackageInfo','getApplicationInfo'].forEach(function(m){
      if (!PM[m]) return;
      PM[m].overloads.forEach(function(ov){
        if (ov.argumentTypes.length && ov.argumentTypes[0].className === 'java.lang.String') {
          ov.implementation = function(){ if (ROOT_PKGS.indexOf(arguments[0])!==-1){ n.pm++; throw NNFE.$new(arguments[0]); } return ov.apply(this, arguments); };
        }
      });
    });
  } catch(e){}
  // 4) System.getProperty + Build.TAGS
  try { Java.use('java.lang.System').getProperty.overload('java.lang.String').implementation = function(k){ if (k==='ro.build.tags'){ n.prop++; return 'release-keys'; } return this.getProperty(k); }; } catch(e){}
  try { Java.use('android.os.Build').TAGS.value = 'release-keys'; } catch(e){}
  // 5) RootBeer — every detection method -> false
  try {
    var RB = Java.use('com.scottyab.rootbeer.RootBeer');
    ['isRooted','isRootedWithEmulatorCheck','isRootedWithBusyBoxCheck','isRootedWithoutBusyBoxCheck','checkForBinary',
     'checkForSuBinary','checkForBusyBoxBinary','checkSuExists','checkForRWPaths','checkForDangerousProps','checkForRootNative',
     'detectRootManagementApps','detectPotentiallyDangerousApps','detectRootCloakingApps','detectTestKeys','checkForMagiskBinary','isSelinuxFlagInEnabled']
      .forEach(function(m){ if (RB[m]) { RB[m].overloads.forEach(function(o){ o.implementation = function(){ return false; }; }); n.rootbeer++; } });
  } catch(e){}
  // explicit user overrides
  CONFIG_EXTRA.forEach(function(fq){ try { var d=fq.lastIndexOf('.'); Java.use(fq.substring(0,d))[fq.substring(d+1)].overloads.forEach(function(o){ o.implementation=function(){ return false; }; }); } catch(e){} });
  console.log('[*] Java hooks installed');
});

// 6) Native libc hooks (catches checks done in C/C++)
(function(){
  function lib(name){
    try { if (typeof Module.findExportByName==='function') return Module.findExportByName('libc.so', name); } catch(e){}
    try { if (typeof Module.getGlobalExportByName==='function') return Module.getGlobalExportByName(name); } catch(e){}
    try { return Process.getModuleByName('libc.so').findExportByName(name); } catch(e){}
    return null;
  }
  try {
    var bogus = Memory.allocUtf8String('/nonexistent_blocked_by_frida');
    ['fopen','open','openat','access','stat','lstat','stat64','lstat64'].forEach(function(fn){
      var p = lib(fn); if (!p) return; var idx = (fn==='openat') ? 1 : 0;
      Interceptor.attach(p, { onEnter: function(a){ try { if (rooty(a[idx].readUtf8String())) { a[idx]=bogus; n.native++; } } catch(e){} } });
    });
    var sysp = lib('system');
    if (sysp) Interceptor.attach(sysp, { onEnter: function(a){ try { if (rooty(a[0].readUtf8String())) { a[0]=Memory.allocUtf8String('exit 1'); n.native++; } } catch(e){} } });
    var spg = lib('__system_property_get');
    if (spg) Interceptor.attach(spg, {
      onEnter: function(a){ try { this.key=a[0].readUtf8String(); this.val=a[1]; } catch(e){} },
      onLeave: function(){ try { if (this.key && SECURE_PROPS[this.key]!==undefined){ this.val.writeUtf8String(SECURE_PROPS[this.key]); n.native++; } } catch(e){} }
    });
    console.log('[*] Native hooks installed');
  } catch(e){ console.log('[!] native: '+e); }
})();

// 7) Generic heuristic — custom isRooted()/isJailbroken()/isTampered() on APP classes only (fast)
setTimeout(function(){ Java.perform(function(){
  var TOK=/(rootbeer|rooted|rootcheck|rootdetect|rootutil|rootmanager|jailbreak|jailbroken|tamper|magisk|supersu)/;
  var FW=/^(android|androidx|java|javax|kotlin|com\.google|com\.android|dalvik|libcore|sun|jdk|org\.bouncycastle|okhttp|retrofit)/;
  var MN=/(isrooted|isdevicerooted|isrootavailable|checkroot|detectroot|isjailbroken|isjailbreak|istampered|checktamper|ismagisk)/;
  try { Java.enumerateLoadedClasses({ onMatch: function(cn){
    var simple = cn.substring(cn.lastIndexOf('.')+1).toLowerCase();
    if (cn.indexOf('[')!==-1 || FW.test(cn) || !TOK.test(simple)) return;
    try { var C = Java.use(cn); var ms = C.class.getDeclaredMethods();
      for (var i=0;i<ms.length;i++){ if (ms[i].getReturnType().getName()!=='boolean') continue;
        var mn = ms[i].getName(); if (!MN.test(mn.toLowerCase())) continue;
        try { C[mn].overloads.forEach(function(o){ o.implementation=function(){ n.generic++; return false; }; });
              console.log('[generic] forced false: '+cn+'.'+mn+'()'); } catch(e){} }
    } catch(e){}
  }, onComplete: function(){} }); } catch(e){}
  console.log('[+] MASTER root bypass active  ' + JSON.stringify(n));
}); }, 1500);

frida -U -f infosecadventures.allsafe -l ~/tools/root-bypass.js

~/tools/geny.sh                     # IPv6 off, frida-server up, proxy on
cd ~/tools/htk-unpin
frida -U -f com.target.app \
  -l config.js \
  -l native-tls-hook.js \
  -l android/android-certificate-unpinning.js \
  -l android/android-certificate-unpinning-fallback.js
# add  -l android/android-disable-root-detection.js              if it detects root
# add  -l android/android-disable-flutter-certificate-pinning.js  for Flutter apps
# add  -l native-connect-hook.js  (and enable Burp "Support invisible proxying")  for raw/gRPC sockets

# 1. Open Burp (bound to All interfaces) and start the Genymotion device.

# 2. Arm the lab — IPv6 off, frida-server up, proxy on:
~/tools/geny.sh

# 3. Browsers work immediately. For an app, disable pinning:
objection -g com.example.app explore --startup-command "android sslpinning disable"
#    (For a hardened app, use the Part 10 suite instead.)

# When finished:
proxy_off