android-app-pentest-environment

# Android App Penetration Testing Environment > Skill by [ara.so](https://ara.so) — Security Skills collection. This skill enables AI agents to help developers set up a complete Android application penetration testing environment using Android Studio emulators with root access, Magisk modules, SSL certificate management, and traffic interception capabilities. ## What This Project Provides A comprehensive guide and toolset for creating a 2026-ready Android app security testing environment including: - Rooted Android emulator (API 36 / Android 16) - Magisk (面具) for root management and module support - SSL/TLS certificate bypasses for traffic interception - Xposed framework integration - Frida dynamic instrumentation setup - BurpSuite/Charles proxy configuration ## Prerequisites ### Install Android Studio and SDK ```bash # Download Android Studio from official site # https://developer.android.google.cn/studio?hl=zh-cn # After installation, configure proxy if needed (for faster downloads) # Settings → Appearance & Behavior → System Settings → HTTP Proxy # Example: 127.0.0.1:7890 for ClashX # SDK will auto-install at: # macOS: /Users/$USER/Library/Android/sdk # Windows: C:\Users\$USER\AppData\Local\Android\Sdk # Linux: ~/Android/Sdk ``` ### Configure Environment Variables **macOS/Linux (bash):** ```bash # Edit ~/.bash_profile or ~/.zshrc export ANDROID_HOME=$HOME/Library/Android/sdk export PATH=$PATH:$ANDROID_HOME/platform-tools export PATH=$PATH:$ANDROID_HOME/tools export PATH=$PATH:$ANDROID_HOME/tools/bin export PATH=$PATH:$ANDROID_HOME/emulator # Apply changes source ~/.bash_profile # or ~/.zshrc ``` **Windows (PowerShell):** ```powershell # Add to system environment variables setx ANDROID_HOME "C:\Users\$env:USERNAME\AppData\Local\Android\Sdk" setx PATH "$env:PATH;$env:ANDROID_HOME\platform-tools;$env:ANDROID_HOME\emulator" ``` ### Verify ADB Installation ```bash # Test ADB is accessible adb version # Output: Android Debug Bridge version 1.0.41 ``` ## Create Android Emulator ### Recommended Configuration ```bash # Launch Android Studio → More Actions → Virtual Device Manager → Create Device # Recommended specs: # Device: Pixel 9 Pro # System Image: API 36 (Android 16), Google APIs, arm64-v8a # ⚠️ Use Google APIs (NOT Google Play - allows root) # Advanced settings: # - Boot option: Cold Boot # - Internal Storage: 16 GB # - SD Card: 4 GB # - RAM: 4096 MB (minimum) # - VM Heap: 512 MB ``` ### Launch Emulator via CLI ```bash # List available AVDs emulator -list-avds # Start specific AVD emulator -avd Pixel_9_Pro_API_36 & # Start with writable system (for manual modifications) emulator -avd Pixel_9_Pro_API_36 -writable-system & ``` ## Install Magisk (Root Framework) ### Method A: rootAVD (Recommended - Automated) ```bash # Clone rootAVD tool (migrated to GitLab) git clone https://gitlab.com/newbit/rootAVD.git cd rootAVD # Download latest Magisk APK # From: https://github.com/topjohnwu/Magisk/releases # Rename to Magisk.zip and place in rootAVD directory curl -L -o Magisk.zip https://github.com/topjohnwu/Magisk/releases/download/v28.1/Magisk-v28.1.apk # List all AVD ramdisk images ./rootAVD.sh ListAllAVDs # Root the specific system image ./rootAVD.sh system-images/android-36.1/google_apis/arm64-v8a/ramdisk.img # Restart emulator (cold boot) adb reboot ``` ### Method B: Manual Magisk Patching ```bash # Start emulator with writable system emulator -avd Pixel_9_Pro_API_36 -writable-system & # Get root access adb root # Install Magisk APK adb install Magisk-v28.1.apk # Push ramdisk to device adb push $ANDROID_HOME/system-images/android-36.1/google_apis/arm64-v8a/ramdisk.img /sdcard/Download/ # Open Magisk app on emulator → Install → Select and Patch File # Choose /sdcard/Download/ramdisk.img # Patched file saved to /sdcard/Download/magisk_patched_*.img # Pull patched ramdisk adb pull /sdcard/Download/magisk_patched_*.img ./ # Replace original ramdisk cp magisk_patched_*.img $ANDROID_HOME/system-images/android-36.1/google_apis/arm64-v8a/ramdisk.img # Restart emulator adb reboot ``` ### Verify Root Access ```bash # Check root in ADB adb root adb shell su -c "id" # Output: uid=0(root) gid=0(root) # Open Magisk app on emulator - should show: # - Magisk: Installed (28.1) # - Ramdisk: Yes ``` ### Configure Magisk ```bash # Enable Zygisk (via Magisk app Settings) # Settings → Zygisk → Enable → Reboot # Hide Magisk app (anti-detection) # Settings → Hide Magisk App → Randomize package name # Configure MagiskHide (if targeting specific apps) adb shell su -c "magiskhide enable" adb shell su -c "magiskhide add <package.name>" ``` ## Install Magisk Modules ### LSPosed (Xposed Framework) ```bash # Download LSPosed Zygisk release # https://github.com/LSPosed/LSPosed/releases curl -L -o LSPosed.zip https://github.com/LSPosed/LSPosed/releases/download/v1.9.2/LSPosed-v1.9.2-7024-zygisk-release.zip # Install via Magisk app adb push LSPosed.zip /sdcard/Download/ # Magisk → Modules → Install from storage → Select LSPosed.zip # Reboot emulator adb reboot ``` ### SSL Certificate Unpinning Modules **JustTrustMe:** ```bash # Download from Xposed repo or GitHub adb push JustTrustMe.apk /sdcard/Download/ adb install /sdcard/Download/JustTrustMe.apk # Enable in LSPosed: # LSPosed → Modules → JustTrustMe → Enable → Select target apps ``` **TrustMeAlready:** ```bash # Magisk module for system-wide certificate trust adb push TrustMeAlready.zip /sdcard/Download/ # Magisk → Modules → Install → TrustMeAlready.zip → Reboot ``` ### MagiskTrustUserCerts ```bash # Auto-trust user certificates as system certs # Download: https://github.com/NVISOsecurity/MagiskTrustUserCerts adb push MagiskTrustUserCerts.zip /sdcard/Download/ # Magisk → Modules → Install → MagiskTrustUserCerts.zip → Reboot ``` ## SSL Certificate Installation ### Install BurpSuite/Charles Certificate ```bash # Export certificate from Burp/Charles as DER format: cacert.der # Convert to PEM and get hash openssl x509 -inform DER -in cacert.der -out cacert.pem HASH=$(openssl x509 -inform PEM -subject_hash_old -in cacert.pem | head -1) # Rename certificate cp cacert.pem ${HASH}.0 # Push to emulator adb root adb remount adb push ${HASH}.0 /system/etc/security/cacerts/ adb shell chmod 644 /system/etc/security/cacerts/${HASH}.0 adb reboot ``` ### Verify Certificate Installation ```bash # Check installed certificates adb shell ls -la /system/etc/security/cacerts/ | grep $(openssl x509 -inform PEM -subject_hash_old -in cacert.pem | head -1) # Or via Settings on emulator: # Settings → Security → Encryption & credentials → Trusted credentials → System ``` ## Traffic Interception Setup ### Configure Proxy ```bash # Set WiFi proxy on emulator # Settings → Network & Internet → WiFi → AndroidWifi → Proxy → Manual # Hostname: 10.0.2.2 (host loopback for emulator) # Port: 8080 (BurpSuite default) # Or via ADB: adb shell settings put global http_proxy 10.0.2.2:8080 # Remove proxy: adb shell settings put global http_proxy :0 ``` ### BurpSuite Configuration ```bash # Proxy → Options → Proxy Listeners # Add: 0.0.0.0:8080 # Enable "Support invisible proxying" # Ensure firewall allows incoming on 8080 ``` ### Test Traffic Capture ```bash # Install test app adb install target_app.apk # Launch app and verify traffic in Burp # If no traffic appears: # 1. Check proxy settings # 2. Verify certificate installed # 3. Enable JustTrustMe module for app # 4. Check app doesn't use proxy detection ``` ## Install Frida for Dynamic Analysis ### Install Frida Server ```bash # Download Frida server for Android # https://github.com/frida/frida/releases # Choose: frida-server-*-android-arm64 curl -L -o frida-server https://github.com/frida/frida/releases/download/16.5.9/frida-server-16.5.9-android-arm64.xz unxz frida-server-16.5.9-android-arm64.xz # Push to device adb push frida-server /data/local/tmp/ adb shell chmod 755 /data/local/tmp/frida-server # Run Frida server adb shell "/data/local/tmp/frida-server &" ``` ### Install Frida Tools (Host) ```bash # Install via pip pip3 install frida-tools # Verify connection frida-ps -U # Should list running processes on emulator ``` ### Basic Frida Usage ```python # example_frida_hook.py import frida import sys def on_message(message, data): print(f"[*] {message}") # Attach to app device = frida.get_usb_device() session = device.attach("com.target.app") # Hook script script_code = """ Java.perform(function() { var MainActivity = Java.use('com.target.app.MainActivity'); MainActivity.secretMethod.implementation = function() { console.log('[*] secretMethod called'); return this.secretMethod(); }; }); """ script = session.create_script(script_code) script.on('message', on_message) script.load() sys.stdin.read() ``` ```bash # Run Frida script python3 example_frida_hook.py ``` ## Common Commands Reference ### ADB Essentials ```bash # List devices adb devices # Install APK adb install app.apk adb install -r app.apk # reinstall # Uninstall app adb uninstall com.package.name # List installed packages adb shell pm list packages adb shell pm list packages -3 # third-party only # Pull APK from device adb shell pm path com.package.name adb pull /data/app/~~hash/com.package.name-hash/base.apk # Get app data directory adb shell run-as com.package.name # (only works for debuggable apps) # Logcat (filter by app) adb logcat | grep "com.package.name" adb logcat -c # clear log # Screen capture adb exec-out screencap -p > screenshot.png # Screen record adb shell screenrecord /sdcard/demo.mp4 adb pull /sdcard/demo.mp4 ``` ### File System Access ```bash # Mount system as writable adb root adb remount # Push/pull files adb push local_file /sdcard/ adb pull /sdcard/remote_file ./ # Browse file system adb shell cd /data/data/com.package.name ls -la ``` ### Process and App Management ```bash # Start activity adb shell am start -n com.package.name/.MainActivity # Stop app adb shell am force-stop com.package.name # Clear app data adb shell pm clear com.package.name # Get running processes adb shell ps | grep package.name ``` ## Troubleshooting ### Emulator Won't Boot After Magisk ```bash # Restore from snapshot (if created) # Android Studio → Device Manager → AVD → Show on Disk → snapshots/ # Or recreate ramdisk: cd $ANDROID_HOME/system-images/android-36.1/google_apis/arm64-v8a/ # Delete ramdisk.img and re-run Android Studio setup to redownload ``` ### ADB Not Detecting Emulator ```bash # Kill and restart ADB server adb kill-server adb start-server # Check emulator is in list adb devices # If still not showing: # - Restart emulator # - Check $ANDROID_HOME/platform-tools is in PATH ``` ### SSL Pinning Still Active ```bash # Ensure MagiskTrustUserCerts is installed # Verify JustTrustMe is enabled for specific app in LSPosed # Try alternative modules: # - SSLUnpinning # - TrustMeAlready # - Use Frida script for runtime bypass: # frida_ssl_bypass.js Java.perform(function() { var CertificatePinner = Java.use('okhttp3.CertificatePinner'); CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function() { console.log('[*] SSL Pinning bypassed'); }; }); # Run: frida -U -f com.target.app -l frida_ssl_bypass.js ``` ### Magisk Modules Not Working ```bash # Check Zygisk is enabled adb shell su -c "magisk --denylist status" # Ensure app is not in denylist adb shell su -c "magisk --denylist rm com.package.name" # Reinstall module # Magisk → Modules → Remove → Reinstall → Reboot ``` ### App Detects Emulator/Root ```bash # Hide Magisk package name (Settings → Hide Magisk App) # Use MagiskHide (deprecated but sometimes works) adb shell su -c "magiskhide enable" adb shell su -c "magiskhide add com.package.name" # Install Shamiko module (Zygisk-based hiding) # Download: https://github.com/LSPosed/LSPosed.github.io/releases # Modify build.prop to appear as physical device adb shell su -c "mount -o rw,remount /system" adb shell su -c "sed -i 's/ro.build.fingerprint=.*/ro.build.fingerprint=google\/redfin\/redfin:13\/TP1A.220624.021\/8877034:user\/release-keys/' /system/build.prop" ``` ### Traffic Not Appearing in Proxy ```bash # Verify proxy settings adb shell settings get global http_proxy # Output: 10.0.2.2:8080 # Check certificate hash adb shell ls /system/etc/security/cacerts/ | grep $(openssl x509 -inform PEM -subject_hash_old -in cacert.pem | head -1) # Ensure BurpSuite listening on all interfaces # Proxy → Options → Edit → Bind to address: All interfaces # Test with curl adb shell curl -x http://10.0.2.2:8080 https://www.google.com ``` ## Advanced Patterns ### Automated APK Analysis Script ```bash #!/bin/bash # analyze_apk.sh APK=$1