Mobile Hacking

Mobile Hacking Skill

Overview

Android/mobile security testing workflow covering emulator setup, device rooting, traffic interception, dynamic instrumentation, and bypass techniques. Inspired by YesWeHack Android Lab methodology for bug bounty hunters. Covers the full pipeline from environment setup to detection bypass for authorized mobile security assessments.

When to Use

Trigger phrases:

• "mobile hacking"
• "Mobile app bug bounty programs (HackerOne, Bugcrowd mobile scope)"
• "Android security assessments with explicit authorization"
• "APK reverse engineering and static analysis"
• "Flutter app traffic interception"
• "Flutter BoringSSL TLS pinning bypass"
• "FlutterTap Zygisk module"

Money-Making Overview

Mobile application pentesting commands premium rates because every company with an app store presence needs it before launch or after major updates. Fintech, crypto, healthcare, and e-commerce are the highest-paying verticals.

Buyer Personas

• Fintech & Banking Apps: Payment apps, digital wallets, neobanks. Compliance-driven (PCI DSS, PSD2). $5K-8K per engagement.
• Crypto & DeFi Apps: Wallet apps, exchange apps, DEX frontends. High attack surface, high budget. $5K-10K.
• Health & MedTech: HIPAA-sensitive. Telehealth, fitness tracking, medical data protection. $4K-7K.
• Startup Mobile Apps: Pre-launch security review. Budget-conscious but motivated by investor due diligence. $2K-4K.

Pricing Tiers

First-Dollar Timeline

• Day 1-2: Client qualification, scope agreement, NDA/SOW signed
• Day 3: Environment setup, automated static analysis begins
• Day 4-10: Dynamic testing, API reverse engineering, bypass testing
• Day 11-12: Report drafting, finding validation, peer review
• Day 13: Delivery + debrief call. Payment due Net-15.

Workflow

Step 1: Environment Setup

Choose between emulator or physical device based on your target:

Genymotion — Lightweight, immediate root, x86 only. ARM translation available but mixed results. Free personal use. Good for quick APK inspection.

Android Studio AVD — More accurate emulation. Use google_apis images (debuggable, allows adb root). Avoid google_apis_playstore (not rootable). Launch with -writable-system flag for full filesystem access.

CLI Setup (no Android Studio needed):

sdkmanager "cmdline-tools;latest" "platform-tools" "platforms;android-34" "system-images;android-34;google_apis;x86_64"
avdmanager create avd -n test_device -k "system-images;android-34;google_apis;x86_64"
emulator -avd test_device -writable-system

Export ANDROID_HOME and add platform-tools and cmdline-tools > bin to PATH.

Physical Device — Google Pixel recommended. Easy bootloader unlock, excellent Magisk support, most realistic testing environment.

Step 2: Rooting and Device Prep

For physical devices, root with Magisk:

1. Unlock bootloader: Enable Developer Options -> OEM Unlocking -> adb reboot bootloader -> fastboot flashing unlock
2. Get factory image from https://developers.google.com/android/images, extract boot.img
3. Patch with Magisk: Install Magisk app -> Select and Patch a File -> choose boot.img
4. Flash patched image: adb push magisk_patched-XXXXX.img /sdcard/ then fastboot flash boot magisk_patched-XXXXX.img
5. Verify root: adb shell -> su -> whoami (should return root)

Key Magisk features:

• Systemless root (modifies boot partition only, preserves OTA)
• Zygisk (runtime process injection, successor to MagiskHide)
• Modules ecosystem (SSL pinning bypass, SafetyNet evasion, Frida integration)
• Shamiko (advanced root hiding without modifying system)

Step 3: Traffic Interception

Set up Burp Suite proxy for HTTPS traffic capture:

adb shell settings put global http_proxy HOST_IP:8082
# Export Burp CA cert in DER format (.cer) from Proxy -> Options -> Import/Export
adb push cacert.cer /data/media/0/Download/
# Install via Settings -> Security -> Install from storage, or:
adb shell am start -a android.intent.action.VIEW -t application/x-x509-ca-cert -d file:///sdcard/Download/cacert.cer

Configure Burp listener to bind to all interfaces (0.0.0.0 on port 8082). For Android 7+ user-installed CAs are not trusted by default — this is where Frida or Magisk modules become necessary.

Step 4: Dynamic Instrumentation with Frida

Two deployment modes:

Frida Server — Binary pushed to rooted device, run manually each session:

# Download matching arch from https://github.com/frida/frida/releases
adb push frida-server /data/local/tmp/
adb shell "chmod 755 /data/local/tmp/frida-server && /data/local/tmp/frida-server &"

Frida Gadget — Shared library bundled into APK. Works without root, requires repackaging the APK with the gadget .so injected.

Key scripts:

SSL Pinning Bypass:

Java.perform(function() {
    var TrustManager = Java.registerClass({
        name: 'com.custom.TrustManager',
        implements: [Java.use('javax.net.ssl.X509TrustManager')],
        methods: {
            checkClientTrusted: function(chain, authType) {},
            checkServerTrusted: function(chain, authType) {},
            getAcceptedIssuers: function() { return []; }
        }
    });
    var ctx = Java.use('javax.net.ssl.SSLContext').getInstance('TLS');
    ctx.init(null, [TrustManager.$new()], null);
});

Root Detection Bypass:

Java.perform(function() {
    var RootChecker = Java.use('com.scottyab.rootbeer.RootBeer');
    RootChecker.isRooted.implementation = function() { return false; };
});

Emulator Detection Bypass:

Java.perform(function() {
    var Build = Java.use('android.os.Build');
    Build.MODEL.value = 'Pixel 7';
    Build.MANUFACTURER.value = 'Google';
    Build.BRAND.value = 'google';
    Build.HARDWARE.value = 'tensor';
});

Usage:

frida -U -f com.target.app -l frida-ssl-unpinning.js --no-pause

Community scripts: https://codeshare.frida.re/

Step 5: Automated Analysis with Medusa

Frida automation framework with 90+ prebuilt modules: https://github.com/Ch0pin/medusa/

Key modules:

• http_communications/multiple_unpinter — SSL pinning bypass
• root_detection/universal_root_detection_bypass — hide root traces
• crypto_hooks — intercept and dump cryptographic keys in real-time

medusa
> use http_communications/multiple_unpinner
> run com.target.app

Step 6: Detection Bypass

Know what you are bypassing before attempting circumvention:

Root Detection methods:

• Binary checks: presence of su, busybox, magisk in PATH
• Package checks: Magisk app package name installed
• System property checks: ro.debuggable=1, ro.secure=0
• Filesystem checks: writable /system, known root files

Emulator Detection methods:

• Build properties: goldfish, ranchu, generic in Build.HARDWARE/FINGERPRINT
• Missing hardware: no IMEI, no SIM, no Bluetooth adapter
• Sensor checks: accelerometer/gyroscope returning constant zero
• Filesystem artifacts: /dev/qemu_pipe, /dev/qemu_trace
• Network artifacts: MAC address 02:00:00:00:00:00, emulator IP ranges

Step 7: Flutter App Traffic Interception with FlutterTap

FlutterTap (https://github.com/script-or-script/FlutterTap) is a Zygisk module that intercepts Flutter app traffic and bypasses BoringSSL TLS pinning — no Frida session, no CA cert install, no app repackaging required.

Why Flutter needs special handling:

• Flutter apps bundle their own BoringSSL and ignore Android's TLS stack
• Standard CA cert install + Frida Java hooks don't work on Flutter apps
• Traffic leaves the device without passing through system proxy settings

FlutterTap approach:

• Native Zygisk module (C++ with Capstone + Dobby) — persists across reboots
• Hooks libflutter.so internals: verify_cert_chain, GetSockAddr, socket()
• Per-app targeting: unloads itself (DLCLOSE) for non-target apps (near-zero detection surface)
• Config via /data/adb/fluttertap/config.json — automatable for CI/headless
• Compatible with Magisk, KernelSU, SukiSu Ultra, APatch (Zygisk Next / NeoZygisk)
• Works with Zygisk Next Linker (fixed 3 real loader bugs)

Prerequisites:

• Physical device (Google Pixel recommended) — FlutterTap validated on physical hardware only (OnePlus 5 Android 10, Pixel 8a Android 17)
• Emulator option — x86_64 host: Magisk + Zygisk runs on x86_64 AVD (google_apis / google_apis_ps16k images) via ramdisk patching — but FlutterTap ships arm64-v8a / x86_64, so x86_64 AVD works only if your target app bundles x86_64 libflutter.so (most Flutter apps are arm64-only)
• Emulator option — Apple Silicon (M1/M2/M3): ARM64 AVD (system-images;android-XX;google_apis;arm64-v8a) runs natively via Hypervisor — the practical emulator route for arm64-only Flutter apps
• Magisk / KernelSU / SukiSu Ultra / APatch with Zygisk enabled
• Android 10–17 (API 29–37), arm64-v8a / x86_64

Installation (via MMRL — recommended):

# In MMRL: Repositories → Add → paste:
https://raw.githubusercontent.com/script-or-script/FlutterTap-mmrl/main/json/modules.json
# Then install FlutterTap module + Manager APK in one tap

Manual installation:

1. Flash FlutterTap-<version>.zip via root manager (Magisk/KernelSU/SukiSu/APatch). Reboot.
2. Install FlutterTap-manager-<version>.apk, grant root.
3. Configure proxy IP/port (Burp machine on same Wi-Fi) and tick target apps.
4. Force-stop target app and reopen (hook only enters new processes).

Burp setup — critical:

• Listener: bind to 0.0.0.0:8083 (or your port)
• Enable "Support invisible proxying" (Request handling tab)
• Without this, Burp drops connections — FlutterTap sends ordinary requests, not proxy-directed

Config automation (headless/CI): Write /data/adb/fluttertap/config.json directly via adb shell su -c:

{
  "enabled": true,
  "proxy_ip": "192.168.1.10",
  "proxy_port": 8083,
  "target_packages": ["com.target.app"]
}

Verification checklist (Flutter-specific):

• Target app confirmed as Flutter (check for libflutter.so in APK lib/*/)
• FlutterTap module installed and enabled in root manager
• Manager app shows "Root access granted", "Module installed", "Enabled"
• Burp invisible proxying enabled on listener port
• Target app force-stopped and reopened after config
• HTTPS traffic appears decrypted in Burp (no device CA cert installed)
• user-agent: Dart/X.X (dart:io) confirms Flutter origin

When to use FlutterTap vs Frida:

Key references:

• FlutterTap repo: https://github.com/script-or-script/FlutterTap
• Architecture docs: https://github.com/script-or-script/FlutterTap/blob/master/docs/ARCHITECTURE.md
• MMRL repo: https://raw.githubusercontent.com/script-or-script/FlutterTap-mmrl/main/json/modules.json

Decision Framework

When NOT to Use

• Task is outside your authorization scope
• You need to implement controls (use implementing-* skills)
• Task is about analysis, not action (use analyzing-* skills)
• You don't have access to target systems
• Task requires compliance expertise (consult professionals)
• Task is about defense, not offense (use defensive skills)

Red Flags

• Testing apps you do not have explicit written authorization to test
• Distributing modified APKs or repackaged applications
• Extracting user data, credentials, or PII from test devices
• Aggressive instrumentation against production backend services
• Ignoring program scope rules or testing out-of-scope mobile endpoints
• Sharing Frida scripts or findings that expose zero-days without coordination

Verification

Before claiming a mobile security assessment is complete:

• Traffic interception confirmed working (HTTPS requests visible in Burp)
• SSL pinning successfully bypassed for the target application
• Root and/or emulator detection circumvented (app runs without tamper alerts)
• All findings include PoC screenshots or screen recordings
• Frida hooks documented with script snippets and hook points
• Test environment cleaned after assessment (device wiped, certs removed)
• Findings reported within program scope and safe harbor provisions

FlutterTap-specific verification (when testing Flutter apps):

• Target app confirmed as Flutter (libflutter.so present in APK lib/*/)
• FlutterTap module installed and enabled in root manager
• Manager app shows: "Root access granted", "Module installed", "Enabled"
• Burp listener has invisible proxying enabled on configured port
• Target app force-stopped and reopened after FlutterTap config
• HTTPS traffic appears decrypted in Burp (no device CA cert installed)
• user-agent: Dart/X.X (dart:io) confirms Flutter HTTP client origin
• Config persisted at /data/adb/fluttertap/config.json with correct target package

Key References

• Android Factory Images: https://developers.google.com/android/images
• Frida CodeShare: https://codeshare.frida.re/
• Medusa Framework: https://github.com/Ch0pin/medusa/
• Magisk Releases: https://github.com/topjohnwu/Magisk/releases
• scrcpy (device mirroring): https://github.com/Genymobile/scrcpy
• FlutterTap: https://github.com/script-or-script/FlutterTap
• FlutterTap Architecture: https://github.com/script-or-script/FlutterTap/blob/master/docs/ARCHITECTURE.md
• FlutterTap MMRL: https://raw.githubusercontent.com/script-or-script/FlutterTap-mmrl/main/json/modules.json

First Action in 60 Minutes

Create a file called mobile-pentest-quickstart.sh with this content:

#!/bin/bash
# mobile-pentest-quickstart.sh
# Prerequisites: adb, java, apktool, jadx
TARGET_APK="$1"
WORK_DIR="$PWD/mobile-test-$(date +%Y%m%d)"
mkdir -p "$WORK_DIR/reports" "$WORK_DIR/decompiled"
cd "$WORK_DIR" || exit 1

echo "[+] Checking environment..."
command -v adb >/dev/null || { echo "adb not found"; exit 1; }
command -v apktool >/dev/null || { echo "apktool not found"; exit 1; }

echo "[+] Decompiling with apktool..."
apktool d -f "$TARGET_APK" -o "decompiled/apktool-out" 2>&1 | tail -3

echo "[+] Converting to Java with jadx..."
if command -v jadx >/dev/null; then
    jadx -d "decompiled/jadx-out" "$TARGET_APK" 2>&1 | tail -3
else
    echo "[!] jadx not installed — skipping Java decompilation"
fi

echo "[+] Extracting manifest..."
cp "decompiled/apktool-out/AndroidManifest.xml" "reports/manifest.xml"

echo "[+] Checking for common issues..."
grep -E 'android\.permission\.(READ_SMS|RECORD_AUDIO|CAMERA|ACCESS_FINE_LOCATION|READ_CONTACTS|READ_CALL_LOG)' \
  "reports/manifest.xml" > "reports/dangerous-permissions.txt" 2>/dev/null
grep -E 'android:exported="true"' "reports/manifest.xml" > "reports/exported-components.txt" 2>/dev/null
grep -E 'android:debuggable="true"' "reports/manifest.xml" > "reports/debuggable.txt" 2>/dev/null
grep -E 'android:allowBackup="true"' "reports/manifest.xml" > "reports/backup-enabled.txt" 2>/dev/null

echo ""
echo "=== Quick Wins ==="
echo "1. Dangerous permissions:   $(wc -l < reports/dangerous-permissions.txt) found"
echo "2. Exported components:     $(wc -l < reports/exported-components.txt)"
echo "3. Debuggable:              $(grep -c . reports/debuggable.txt 2>/dev/null || echo 0)"
echo "4. Backup enabled:          $(grep -c . reports/backup-enabled.txt 2>/dev/null || echo 0)"
echo ""
echo "NEXT: frida -U -f com.target.app -l frida-ssl-unpinning.js --no-pause"

Run it: bash mobile-pentest-quickstart.sh target.apk

In 60 minutes you'll have a reports/ directory with the extracted AndroidManifest.xml, dangerous permissions listing, exported components inventory, debuggable flag check, and backup status analysis.

Deliverable Format

Use this template for every mobile pentest engagement deliverable:

MOBILE APPLICATION SECURITY ASSESSMENT REPORT

Client: [Name]
Application: [Package name] v[Version]
Platform: Android / iOS / Both
Date: [Start] - [End]
Tester: [Name]
Classification: CONFIDENTIAL

1. EXECUTIVE SUMMARY
   - Scope: [tested features, endpoints, API versions]
   - Risk Level: Critical / High / Medium / Low
   - Total Findings: X (Y Critical, Z High, ...)
   - One-paragraph bottom line for non-technical stakeholders

2. METHODOLOGY
   - Static analysis (jadx, apktool, MobSF)
   - Dynamic analysis (Frida, Objection)
   - Network traffic analysis (Burp Suite, mitmproxy)
   - Storage analysis (shared_prefs, SQLite, internal storage dump)
   - API testing (authentication, authorization, rate limiting)

3. FINDINGS (per finding)
   - ID, Title, OWASP MASTG reference, CVSS v3 score
   - Affected component / endpoint
   - Steps to reproduce (numbered, exact commands)
   - Screenshot or screen recording
   - Remediation guidance with code example

4. SECURITY CONTROLS ASSESSED
   - Authentication & session management
   - Authorization (IDOR / BOLA checks)
   - Local data storage (SharedPreferences, SQLite, Keystore)
   - Network communication (TLS version, ciphers, pinning)
   - Code hardening (ProGuard, obfuscation, debug flags)
   - Reverse engineering resistance (root/jailbreak detection, tamper detection)

5. APPENDIX
   - Environment and device specs
   - Tool versions
   - Test accounts and data (redacted)
   - Screenshot index

Billable deliverable: branded PDF report + CSV findings tracker. Include 30-day retest window in the SOW.

Anti-Rationalization Table