# Objection Android Pentest

> Use Objection for runtime Android mobile app exploration and security testing. Use this skill whenever the user needs to perform dynamic analysis on Android apps, bypass SSL pinning, disable root detection, hook methods, inspect memory, or explore app internals at runtime. Trigger for any Android pentesting task involving Frida, runtime manipulation, or mobile security assessment.

- Skill: `abelrguezr/objection-android-pentest` (Agent Skill, multi-file: 6 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/objection-android-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/objection-android-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/objection-android-pentest

---


# Objection Android Pentest Skill

A skill for using [Objection](https://github.com/sensepost/objection) to perform runtime exploration and security testing on Android applications.

## What Objection Does

Objection is a runtime mobile exploration toolkit powered by Frida. It lets you:
- Bypass security controls (SSL pinning, root detection)
- Hook and inspect methods at runtime
- Explore app internals without decompiling
- Manipulate app behavior dynamically
- Inspect memory, SQLite databases, and more

**Important:** Objection does NOT bypass jailbreak/root restrictions. You're still limited by the device's sandbox.

## Setup

### Installation

```bash
pip3 install objection
```

### Connection Requirements

1. **ADB Connection**: Establish a regular ADB connection to the device
2. **Frida Server**: Start Frida server on the device and verify it's working
3. **Target App**: Identify the app package name using `frida-ps -Uai`

### Starting Objection

```bash
# For rooted devices (specify gadget)
objection --gadget <package.name> explore

# For non-rooted devices
objection explore
```

## Common Workflows

### 1. Environment Exploration

Gather initial reconnaissance about the app environment:

```bash
# View environment variables (may contain passwords, paths)
env

# Get Frida information
frida
```

### 2. Security Control Bypass

#### Disable SSL Pinning

```bash
android sslpinning disable
```

#### Disable Root Detection

```bash
# Disable root detection
android root disable

# Simulate rooted environment (for testing)
android root simulate
```

### 3. App Structure Discovery

#### List Components

```bash
# List all activities
android hooking list activities

# List all services
android hooking list services

# List all receivers
android hooking list receivers
```

#### Get Current Activity

```bash
android hooking get current_activity
```

#### Search Classes

```bash
# Search for classes by package name
android hooking search classes <package.name>

# List all loaded classes (grows as app is used)
android hooking list classes
```

#### Search Methods

```bash
# Search methods in a specific class
android hooking search methods <package.name> <ClassName>

# List declared methods with parameters
android hooking list class_methods <package.name>.<ClassName>
```

### 4. Method Hooking

#### Watch a Single Method

```bash
android hooking watch class_method <package.name>.<Class>.<method> \
  --dump-args \
  --dump-backtrace \
  --dump-return
```

#### Watch an Entire Class

```bash
android hooking watch class <package.name>.<Class> \
  --dump-args \
  --dump-return
```

**Warning:** Hooking entire classes can crash the application. Use with caution.

#### Modify Return Values

To force a method to return a specific value:

```bash
# Example: Force checkPin() to always return true
android hooking watch class_method <package.name>.<Class>.checkPin \
  --return true
```

### 5. Memory Operations

#### Dump Memory

```bash
# Dump all memory
memory dump all <local_destination>

# Dump specific range
memory dump from_base <base_address> <size_to_dump> <local_destination>
```

#### List Modules

```bash
memory list modules
```

#### Search and Write

```bash
# Search for patterns
memory search "<hex_pattern>" --string --offsets-only

# Write to memory
memory write "<address>" "<hex_pattern>" --string
```

### 6. Class Instances

```bash
# Print live instances of a class
android heap print_instances <fully.qualified.ClassName>
```

### 7. Keystore and Intents

```bash
# List keystore entries
android keystore list

# Launch activities/services
android intents launch_activity
android intent launch_service
```

### 8. SQLite Database Access

```bash
sqlite
# Interactive SQLite shell
```

### 9. File Operations

```bash
# Download from device
file download <remote_path> [<local_path>]

# Upload to device
file upload <local_path> [<remote_path>]
```

### 10. Screenshots

```bash
# Take screenshot
android ui screenshot /tmp/screenshot

# Disable FLAG_SECURE (enables hardware screenshot)
android ui FLAG_SECURE false
```

### 11. Shell Commands

```bash
android shell_exec <command>
```

## File Transfer

```bash
# Import custom Frida script
import <local_path_to_frida_script>
```

## Exit

```bash
exit
```

## Best Practices

1. **Static Analysis First**: Use static analysis to identify targets before dynamic hooking
2. **Start Small**: Hook individual methods before entire classes
3. **Watch for Crashes**: Extensive hooking can destabilize the app
4. **Document Findings**: Keep track of hooked methods and their behavior
5. **Use Scripts**: For repetitive tasks, create custom Frida scripts

## Limitations

- Hooking methods can crash applications (Frida limitation)
- Cannot call instance methods directly on discovered objects
- Cannot create new class instances through Objection
- No built-in crypto method hooking shortcuts

## References

- [Objection GitHub](https://github.com/sensepost/objection)
- [Frida Gadget Documentation](https://frida.re/docs/gadget/)
- [Modding Mobile Apps with Frida](https://pit.bearblog.dev/modding-and-distributing-mobile-apps-with-frida/)