android-pentest-environment-setup

# Android Penetration Testing Environment Setup > Skill by [ara.so](https://ara.so) — Security Skills collection. This skill covers setting up a complete Android application penetration testing environment using Android Studio emulators, including rooting with Magisk, installing security testing frameworks (Frida, LSPosed), and configuring traffic interception tools. ## What This Project Provides A comprehensive guide to building a modern (2026) Android app penetration testing lab environment on Android Studio, including: - Android Studio AVD (Android Virtual Device) configuration optimized for security testing - Root access via Magisk framework - Frida dynamic instrumentation framework - LSPosed/Xposed module framework for runtime hooking - SSL/TLS certificate pinning bypass capabilities - Traffic interception setup with Burp Suite/mitmproxy - Anti-emulator detection bypass techniques **Key Advantages:** - Reproducible environment using snapshots - No need for physical devices - Full system access for deep analysis - Support for Android 16 (API 36) **Limitations:** - Some apps detect emulators and refuse to run - Performance may be slower than physical devices ## Prerequisites - macOS, Linux, or Windows - 16GB+ RAM recommended - Android Studio installed - Proxy tool (Burp Suite, mitmproxy, Charles) for traffic analysis ## Installation ### 1. Install Android Studio and SDK ```bash # macOS/Linux - Download from official site # https://developer.android.google.cn/studio # After installation, configure SDK path (default recommended) # macOS: ~/Library/Android/sdk # Linux: ~/Android/Sdk # Windows: %LOCALAPPDATA%\Android\Sdk # Set environment variables (macOS/Linux bash) cat >> ~/.bash_profile << 'EOF' export ANDROID_HOME=$HOME/Library/Android/sdk export PATH=$PATH:$ANDROID_HOME/platform-tools export PATH=$PATH:$ANDROID_HOME/tools export PATH=$PATH:$ANDROID_HOME/tools/bin export PATH=$PATH:$ANDROID_HOME/emulator EOF source ~/.bash_profile # For zsh users cat >> ~/.zshrc << 'EOF' export ANDROID_HOME=$HOME/Library/Android/sdk export PATH=$PATH:$ANDROID_HOME/platform-tools export PATH=$PATH:$ANDROID_HOME/tools export PATH=$PATH:$ANDROID_HOME/tools/bin export PATH=$PATH:$ANDROID_HOME/emulator EOF source ~/.zshrc # Verify ADB is accessible adb version ``` **Windows PowerShell:** ```powershell # Add to System Environment Variables [Environment]::SetEnvironmentVariable("ANDROID_HOME", "$env:LOCALAPPDATA\Android\Sdk", "User") $path = [Environment]::GetEnvironmentVariable("Path", "User") [Environment]::SetEnvironmentVariable("Path", "$path;$env:ANDROID_HOME\platform-tools;$env:ANDROID_HOME\tools", "User") ``` ### 2. Create Android Virtual Device (AVD) ```bash # List available system images sdkmanager --list | grep system-images # Install Android 16 (API 36) Google APIs ARM64 sdkmanager "system-images;android-36;google_apis;arm64-v8a" # Create AVD via command line (alternative to GUI) avdmanager create avd \ -n pentest_pixel9 \ -k "system-images;android-36;google_apis;arm64-v8a" \ -d "pixel_9_pro" # Or use Android Studio GUI: # More Actions → Virtual Device Manager → Create Device # - Device: Pixel 9 Pro # - System Image: API 36 (Android 16), Google APIs, arm64-v8a # - Configuration: # * RAM: 4096 MB # * Internal Storage: 16384 MB # * VM heap: 512 MB # * Boot option: Cold Boot ``` **Important:** Choose **Google APIs** (NOT Google Play) to allow root access. ### 3. Root with Magisk (Method A: rootAVD - Recommended) ```bash # Clone rootAVD tool git clone https://gitlab.com/newbit/rootAVD.git cd rootAVD # Download latest Magisk APK and rename to Magisk.zip # https://github.com/topjohnwu/Magisk/releases curl -L -o Magisk.zip https://github.com/topjohnwu/Magisk/releases/download/v28.1/Magisk-v28.1.apk # List available AVDs ./rootAVD.sh ListAllAVDs # Root the specific system image ./rootAVD.sh system-images/android-36/google_apis/arm64-v8a/ramdisk.img # Start emulator (will auto-install Magisk) emulator -avd pentest_pixel9 -writable-system # Verify root adb shell su -c "id" # Expected output: uid=0(root) gid=0(root) ``` ### 4. Root with Magisk (Method B: Manual Patch - If rootAVD Fails) ```bash # Start emulator with writable system emulator -avd pentest_pixel9 -writable-system & sleep 30 adb root adb remount # Install Magisk APK adb install Magisk-v28.1.apk # Push ramdisk to device RAMDISK="$ANDROID_HOME/system-images/android-36/google_apis/arm64-v8a/ramdisk.img" adb push "$RAMDISK" /sdcard/Download/ramdisk.img # In Magisk app: Install → Select and Patch a File → Choose ramdisk.img # Wait for patching to complete # Pull patched ramdisk adb pull /sdcard/Download/magisk_patched_*.img ./ # Replace original ramdisk cp magisk_patched_*.img "$ANDROID_HOME/system-images/android-36/google_apis/arm64-v8a/ramdisk.img" # Restart emulator adb reboot ``` ## Key Commands ### ADB (Android Debug Bridge) ```bash # List connected devices adb devices # Connect to specific emulator adb -s emulator-5554 shell # Install APK adb install app.apk adb install -r app.apk # Reinstall keeping data # Pull/Push files adb pull /data/data/com.example.app/databases/app.db ./ adb push burp-cert.der /sdcard/ # Forward ports adb forward tcp:8080 tcp:8080 # Get root shell adb root adb shell # Remount system as writable adb remount # Log viewing adb logcat | grep -i "com.example.app" adb logcat -c # Clear logs # Screen capture adb shell screencap /sdcard/screen.png adb pull /sdcard/screen.png # Start/Stop app adb shell am start -n com.example.app/.MainActivity adb shell am force-stop com.example.app ``` ### Magisk Module Management ```bash # Install module via ADB adb push module.zip /sdcard/Download/ adb shell su -c "magisk --install-module /sdcard/Download/module.zip" # List installed modules adb shell su -c "ls /data/adb/modules" # Enable Zygisk (required for LSPosed) adb shell su -c "magisk --sqlite 'UPDATE settings SET value=1 WHERE key=\"zygisk\"'" adb reboot # Check Magisk status adb shell su -c "magisk -v" ``` ## Installing Security Testing Frameworks ### 1. Install Frida ```bash # Get Android architecture adb shell getprop ro.product.cpu.abi # Output: arm64-v8a # Download Frida server (match version with frida-tools) FRIDA_VERSION=$(pip3 show frida | grep Version | cut -d' ' -f2) wget "https://github.com/frida/frida/releases/download/${FRIDA_VERSION}/frida-server-${FRIDA_VERSION}-android-arm64.xz" unxz frida-server-*-android-arm64.xz # Push to device adb root adb push frida-server-*-android-arm64 /data/local/tmp/frida-server adb shell chmod 755 /data/local/tmp/frida-server # Start Frida server adb shell "/data/local/tmp/frida-server &" # Verify on host pip3 install frida-tools frida-ps -U # Should list running processes ``` **Persistent Frida with Magisk Module:** ```bash # Create Magisk module structure mkdir -p frida-module/system/bin cp frida-server-*-android-arm64 frida-module/system/bin/frida-server # Create module.prop cat > frida-module/module.prop << 'EOF' id=frida_server name=Frida Server version=16.5.0 versionCode=16050 author=Frida description=Frida dynamic instrumentation toolkit EOF # Create service script cat > frida-module/service.sh << 'EOF' #!/system/bin/sh /system/bin/frida-server & EOF # Package and install cd frida-module zip -r ../frida-module.zip . adb push ../frida-module.zip /sdcard/ adb shell su -c "magisk --install-module /sdcard/frida-module.zip" adb reboot ``` ### 2. Install LSPosed (Xposed Framework) ```bash # Download LSPosed Zygisk version # https://github.com/LSPosed/LSPosed/releases wget https://github.com/LSPosed/LSPosed/releases/download/v1.9.2/LSPosed-v1.9.2-7024-zygisk-release.zip # Install via Magisk adb push LSPosed-v1.9.2-7024-zygisk-release.zip /sdcard/ adb shell su -c "magisk --install-module /sdcard/LSPosed-v1.9.2-7024-zygisk-release.zip" adb reboot # Access LSPosed Manager (after reboot) # Notification will appear, or run: adb shell am start -n org.lsposed.manager/.ui.activity.MainActivity ``` **Common LSPosed Modules for Pentesting:** ```bash # TrustMeAlready - Bypass SSL pinning # https://github.com/ViRb3/TrustMeAlready/releases # JustTrustMe - Alternative SSL bypass # Install via LSPosed Manager → Repository # XPrivacyLua - Privacy/permission control # Useful for testing permission bypasses ``` ### 3. Install ZygiskNext (Improved Zygisk) ```bash # Download ZygiskNext wget https://github.com/Dr-TSNG/ZygiskNext/releases/download/v4.0.1/Zygisk-Next-4.0.1-release.zip # Disable built-in Zygisk first adb shell su -c "magisk --sqlite 'UPDATE settings SET value=0 WHERE key=\"zygisk\"'" # Install ZygiskNext adb push Zygisk-Next-4.0.1-release.zip /sdcard/ adb shell su -c "magisk --install-module /sdcard/Zygisk-Next-4.0.1-release.zip" adb reboot ``` ## SSL/TLS Certificate Pinning Bypass ### Method 1: System Certificate Installation ```bash # Convert PEM cert to Android format openssl x509 -inform PEM -subject_hash_old -in burp-cert.pem | head -1 # Output: 9a5ba575 # Rename cert cp burp-cert.pem 9a5ba575.0 # Push to system store adb root adb remount adb push 9a5ba575.0 /system/etc/security/cacerts/ adb shell chmod 644 /system/etc/security/cacerts/9a5ba575.0 adb reboot ``` ### Method 2: Using Magisk Modules **Install TrustMeAlready:** ```bash # Download from LSPosed Manager or: adb push TrustMeAlready.apk /sdcard/ adb install /sdcard/TrustMeAlready.apk # Enable in LSPosed: # 1. Open LSPosed Manager # 2. Modules → TrustMeAlready → Enable # 3. Select target apps # 4. Reboot ``` **Install Shamiko (Hide root from apps):** ```bash wget https://github.com/LSPosed/LSPosed.github.io/releases/download/shamiko-354/Shamiko-v0.7.4-354-release.zip adb push Shamiko-v0.7.4-354-release.zip /sdcard/ adb shell su -c "magisk --install-module /sdcard/Shamiko-v0.7.4-354-release.zip" adb reboot ``` ## Traffic Interception Setup ### Configure Proxy on Emulator ```bash # Method 1: Via ADB (requires root) adb shell settings put global http_proxy <HOST_IP>:8080 # Method 2: Via emulator settings # Settings → Network & Internet → Wi-Fi → AndroidWifi → # Proxy → Manual → Hostname: <HOST_IP>, Port: 8080 # Disable proxy adb shell settings put global http_proxy :0 # Verify proxy settings adb shell settings get global http_proxy ``` ### Burp Suite Configuration ```bash # 1. Export Burp CA certificate (DER format) # Proxy → Options → Import/Export CA Certificate → Export DER # 2. Push to emulator adb push burp-cert.der /sdcard/ # 3. Install via Settings # Settings → Security → Install from SD card → Select burp-cert.der # 4. For system-level trust (Android 7+) openssl x509 -inform DER -in burp-cert.der -out burp-cert.pem openssl x509 -inform PEM -subject_hash_old -in burp-cert.pem | head -1 # e.g., output: 9a5ba575 cp burp-cert.pem 9a5ba575.0 adb root adb remount adb push 9a5ba575.0 /system/etc/security/cacerts/ adb shell chmod 644 /system/etc/security/cacerts/9a5ba575.0 adb reboot ``` ## Frida Scripts for Common Tasks ### Bypass SSL Pinning (Universal Script) ```javascript // ssl-pinning-bypass.js Java.perform(function() { console.log("[*] Bypassing SSL Pinning..."); // OkHttp3 try { var CertificatePinner = Java.use('okhttp3.CertificatePinner'); CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function() { console.log('[+] OkHttp3 pinning bypassed'); return; }; } catch(err) { console.log('[-] OkHttp3 not found'); } // TrustManager var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager'); var SSLContext = Java.use('javax.net.ssl.SSLContext'); var TrustManager = Java.registerClass({ name: 'dev.asd.test.TrustManager', implements: [X509TrustManager], methods: { checkClientTrusted: function(chain, authType) {}, checkServerTrusted: function(chain, authType) {}, getAcceptedIssuers: function() { return []; } } }); var TrustManagers = [TrustManager.$new()]; var SSLContext_init = SSLContext.init.overload( '[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom' ); SSLContext_init.implementation = function(keyManager, trustManager, secureRandom) { console.log('[+] TrustManager bypassed'); SSLContext_init.call(this, keyManager, TrustManagers, secureRandom); }; }); ``` **Run the script:** ```bash frida -U -f com.example.app -l ssl-pinning-bypass.js --no-pause ``` ### Extract Shared Preferences ```javascript // extract-prefs.js Java.perform(function() { var context = Java.use('android.app.ActivityThread') .currentApplication()