Android

00. Basic

## ------------------| Android Pentest Workflow
01. Scope validation
02. APK acquisition
03. App metadata extraction
04. Manifest review
05. Static code review
06. Secrets and endpoint discovery
07. Network security config review
08. Repack/sign/tamper test
09. Dynamic instrumentation
10. Traffic interception
11. Exported component testing
12. Deeplink and intent abuse testing
13. Local storage review
14. Crypto and Keystore review
15. WebView review
16. Root/debug/emulator/frida detection review
17. Framework-specific review: Flutter / React Native / Xamarin

• Secret Codes

## ------------------| Enable ADB + MTP
*#0808#

• Modem commands

## ------------------| Read basic info
AT+DEVCONINFO

## ------------------| Enter Download mode
AT+FUS?

## ------------------| Restart 
AT+CFUN=1,1

00.1 ADB Commands

## ------------------| Mount system as read and write
mount -o rw,remount /system

## ------------------| Install Split APKs
adb shell pm list packages | grep example
for f in $(adb shell pm path com.example | sed 's/package://g'); do adb pull "$f" .; done
adb install-multiple *.apk

## ------------------| List installed packages 
adb shell pm list packages -3

## ------------------| List installed packages with paths
adb shell pm list packages -3 -f

## ------------------| Find the app's install directory
pm dump com.example | grep codePath

## ------------------| Dump package info and find the library path
pm dump com.example | grep nativeLibraryDir

## ------------------| List system packages 
adb shell pm list packages -s
adb shell pm list packages | grep '<OEM/Carrier/App Name>'

## ------------------| Uninstall apk
adb shell pm uninstall -k --user 0 '<OEM/Carrier/App Name>'

## ------------------| Backup APK 
adb pull <PATH> app.apk

## ------------------| Get information about system services
adb shell dumpsys package com.routerspace

## ------------------| Start Activity through ADB shell
adb shell am start -n com.routerspace/.MainActivity

## ------------------| List all debug-able apps
grep " 1 /" /data/system/packages.list

## ------------------| View ContentProvider
adb shell 'content query --uri content://com.routerspace/.MainActivity/users'

## ------------------| Global Proxy
adb shell settings put global http_proxy <IP>:<PORT>    ## Set Proxy
adb shell settings put global http_proxy :0             ## Remove Proxy
### No authentication
adb shell settings put global http_proxy <ip>:<port>
### With Authentication
adb shell settings put global http_proxy <ip>:<port>
adb shell settings put global global_http_proxy_host <ip>
adb shell settings put global global_http_proxy_port <port>
adb shell settings put global global_http_proxy_username <username>
adb shell settings put global global_http_proxy_password <password>
### Disable proxy
adb shell settings delete global http_proxy
adb shell settings delete global global_http_proxy_host
adb shell settings delete global global_http_proxy_port
adb shell settings delete global global_http_proxy_username
adb shell settings delete global global_http_proxy_password
adb shell settings delete global global_http_proxy_exclusion_list
adb shell settings delete global global_proxy_pac_url
adb shell reboot

01. Static Analysis

01.1 APK Acquisition and Metadata Check

## ------------------| APK static metadata
aapt dump badging app.apk
aapt dump permissions app.apk
aapt dump xmltree app.apk AndroidManifest.xml

## ------------------| Signing certificate and schemes
apksigner verify --verbose --print-certs app.apk

## ------------------| Identify package from device
adb shell pm list packages -3
adb shell pm list packages -3 -f | grep -i '<keyword>'

## ------------------| Get APK path
adb shell pm path com.example.app

## ------------------| Pull base APK and split APKs
mkdir -p apk_pull
for apk in $(adb shell pm path com.example.app | sed 's/package://g'); do
  adb pull "$apk" apk_pull/
done

## ------------------| Install split APK set
adb install-multiple apk_pull/*.apk

## ------------------| Dump package metadata
adb shell dumpsys package com.example.app > dumpsys_package.txt
adb shell dumpsys activity activities | grep -i com.example.app
adb shell dumpsys window | grep -E 'mCurrentFocus|mFocusedApp'

01.2 Manifest Triage Check

android:exported="true" means another app can launch that component by exact class name unless access is protected by permissions.

## ------------------| Decode APK
apktool d app.apk -o app_decoded
jadx -d app_jadx app.apk

## ------------------| Key manifest flags
grep -RniE 'debuggable|allowBackup|usesCleartextTraffic|networkSecurityConfig|exported|taskAffinity|permission|grantUriPermissions' app_decoded/AndroidManifest.xml

## ------------------| List activities/services/receivers/providers
grep -RniE '<activity|<service|<receiver|<provider' app_decoded/AndroidManifest.xml

## ------------------| Find exported components
grep -Rni 'android:exported="true"' app_decoded/AndroidManifest.xml

## ------------------| Find deeplink intent filters
grep -RniE 'android.intent.action.VIEW|android:scheme|android:host|android:path|android:autoVerify' app_decoded/AndroidManifest.xml

01.3 Network Security Config Review

## ------------------| Locate network security config
grep -Rni 'networkSecurityConfig' app_decoded/
find app_decoded/res -iname '*network*security*' -o -name 'network_security_config.xml'

## ------------------| Review cleartext and trust anchors
grep -RniE 'cleartextTrafficPermitted|trust-anchors|certificates|pin-set|debug-overrides' app_decoded/res/xml/

## ------------------| Find hardcoded URLs
grep -RniE 'https?://|wss?://' app_jadx/ app_decoded/ | tee urls.txt

## ------------------| Find common API keywords
grep -RniE 'api|graphql|oauth|token|refresh|client_id|secret|firebase|s3|bucket|amplitude|segment|mixpanel' app_jadx/ | tee interesting_keywords.txt

01.4 Exported Component Testing

## ------------------| Find exported components
grep -Rni 'android:exported="true"' app_decoded/AndroidManifest.xml

## ------------------| Start exported activity
adb shell am start -n com.example.app/.ui.TargetActivity

## ------------------| Start exported activity with extras
adb shell am start -n com.example.app/.ui.TargetActivity --es token test --es url 'https://attacker.example/' --ez isAdmin true

## ------------------| Send broadcast
adb shell am broadcast -a com.example.app.ACTION_TEST --es payload test

## ------------------| Start service
adb shell am startservice -n com.example.app/.service.TargetService --es command test

## ------------------| Query content provider
adb shell content query --uri content://com.example.app.provider/users

## ------------------| Insert into content provider
adb shell content insert --uri content://com.example.app.provider/users --bind name:s:test

01.5 Deeplink and App Link Testing

Deep links directly open app content and expand the attack surface when they route to sensitive functionality, especially when input validation and auth checks are weak. Android App Links improve this by verifying association between the app and website.

## ------------------| Basic deeplink launch
adb shell am start -a android.intent.action.VIEW -d 'myapp://example/path?token=test'

## ------------------| HTTPS app link launch
adb shell am start -a android.intent.action.VIEW -d 'https://example.com/reset-password?token=test'

## ------------------| Check Android app links verification
adb shell pm get-app-links com.example.app

## ------------------| Force app link verification
adb shell pm verify-app-links --re-verify com.example.app

## ------------------| Reset app link state
adb shell pm reset-app-links com.example.app

01.6 Local Storage Review

Auto Backup applies to apps targeting and running Android 6.0/API 23+ unless configured otherwise, and Android can back up app data to the user’s Google Drive; this makes allowBackup and backup rules security-relevant, especially for tokens/PII.

## ------------------| App private directory on rooted device
adb shell su -c "ls -lah /data/data/com.example.app/"
adb shell su -c "find /data/data/com.example.app/ -type f -maxdepth 5"

## ------------------| Pull app data
mkdir -p data_pull
adb shell su -c "tar -czf /sdcard/appdata.tgz /data/data/com.example.app"
adb pull /sdcard/appdata.tgz data_pull/
tar -xzf data_pull/appdata.tgz -C data_pull/

## ------------------| Search sensitive data
grep -RniE 'token|refresh|access|bearer|jwt|password|secret|api[_-]?key|session|authorization|pin|otp' data_pull/ 2>/dev/null

## ------------------| List SQLite DBs
find data_pull/ -iname '*.db' -o -iname '*.sqlite' -o -iname '*.sqlite3'

## ------------------| Inspect SQLite
sqlite3 app.db ".tables"
sqlite3 app.db "select * from users limit 5;"

## ------------------| Debuggable app run-as access
adb shell run-as com.example.app id
adb shell run-as com.example.app ls -lah
adb shell run-as com.example.app find . -type f

01.7 WebView Security Review

WebView debugging should be disabled in production. OWASP recommends setting WebView.setWebContentsDebuggingEnabled(false) or enabling it only when the app is debuggable. Android also warns that native WebView bridges using addJavascriptInterface can create risks like XSS-driven manipulation of the host app and Java code execution with app permissions.

## ------------------| Find WebView usage
grep -RniE 'WebView|setJavaScriptEnabled|addJavascriptInterface|setAllowFileAccess|setAllowUniversalAccessFromFileURLs|setWebContentsDebuggingEnabled|loadUrl|loadDataWithBaseURL' app_jadx/

## ------------------| Find JavaScript bridges
grep -Rni 'addJavascriptInterface' app_jadx/

## ------------------| Find WebView debugging
grep -Rni 'setWebContentsDebuggingEnabled' app_jadx/

## ------------------| Find risky file access
grep -RniE 'setAllowFileAccess\(true\)|setAllowFileAccessFromFileURLs\(true\)|setAllowUniversalAccessFromFileURLs\(true\)' app_jadx/

01.8 Crypto and Android Keystore Review

he Android Keystore is designed to keep key material non-exportable and restrict key usage conditions, including user authentication requirements and allowed crypto modes. Your notes should distinguish between keys stored in Keystoreand hardcoded keys in APK code/resources; those are completely different risk levels.

## ------------------| Static crypto keyword search
grep -RniE 'Cipher|getInstance|AES|DES|RSA|ECB|CBC|GCM|MD5|SHA1|SHA-1|Random|SecureRandom|KeyStore|SecretKeySpec|IvParameterSpec|PBKDF2|Hmac' app_jadx/

## ------------------| Bad crypto patterns
grep -RniE 'AES/ECB|DES|MD5|SHA1|SHA-1|new Random\(|new SecureRandom\([^)]+\)|SecretKeySpec\(.*getBytes' app_jadx/

01.9 Repacking and Tamper Testing

## ------------------| Decode APK
apktool d app.apk -o app_decoded

## ------------------| Modify smali/resources
vi app_decoded/AndroidManifest.xml

## ------------------| Rebuild APK
apktool b app_decoded -o rebuilt-unsigned.apk

## ------------------| Zipalign
zipalign -p -f 4 rebuilt-unsigned.apk rebuilt-aligned.apk

## ------------------| Generate test keystore
keytool -genkeypair \
  -v \
  -keystore test.keystore \
  -alias test \
  -keyalg RSA \
  -keysize 2048 \
  -validity 10000

## ------------------| Sign APK
apksigner sign \
  --ks test.keystore \
  --ks-key-alias test \
  --out rebuilt-signed.apk \
  rebuilt-aligned.apk

## ------------------| Verify signature
apksigner verify --verbose --print-certs rebuilt-signed.apk

## ------------------| Install rebuilt APK
adb install -r rebuilt-signed.apk

01.10 Flutter / React Native / Xamarin Checks

## ------------------| Framework Notes
Flutter:
- Java SSL bypass may fail.
- Check libapp.so and libflutter.so.
- Native pinning often needs pattern patching or native hook.

React Native:
- Review index.android.bundle or Hermes bytecode.
- Search API endpoints, feature flags, analytics keys.
- Check native modules exposed to JS.

Xamarin:
- Review DLLs and managed assemblies.
- Check Frida-XamPwn style hooks.
- Validate native bridge exposure.

## ------------------| Detect Flutter
find app_decoded/ -iname 'libflutter.so' -o -iname 'libapp.so' -o -iname 'flutter_assets'

## ------------------| Flutter strings and endpoints
strings app_decoded/lib/*/libapp.so | grep -Ei 'https?://|api|token|secret|graphql|firebase'

## ------------------| Detect React Native
find app_decoded/ -iname 'index.android.bundle' -o -iname '*.hbc'

## ------------------| React Native bundle strings
strings app_decoded/assets/index.android.bundle | grep -Ei 'https?://|api|token|secret|graphql|firebase'

## ------------------| Detect Xamarin
find app_decoded/ -iname '*.dll' -o -iname 'libmonodroid.so' -o -iname 'assemblies.blob'

02. Dynamic Analysis

## ------------------| Global Proxy
adb shell settings put global http_proxy <IP>:<PORT>    ## Set Proxy
adb shell settings put global http_proxy :0             ## Remove Proxy
### No authentication
adb shell settings put global http_proxy <ip>:<port>
### With Authentication
adb shell settings put global http_proxy <ip>:<port>
adb shell settings put global global_http_proxy_host <ip>
adb shell settings put global global_http_proxy_port <port>
adb shell settings put global global_http_proxy_username <username>
adb shell settings put global global_http_proxy_password <password>
### Disable proxy
adb shell settings delete global http_proxy
adb shell settings delete global global_http_proxy_host
adb shell settings delete global global_http_proxy_port
adb shell settings delete global global_http_proxy_username
adb shell settings delete global global_http_proxy_password
adb shell settings delete global global_http_proxy_exclusion_list
adb shell settings delete global global_proxy_pac_url
adb shell reboot

02.1 Emulator Setup

Android Studio Emulator on Apple Silicon

• Method I (Google Play API with Magisk Modules)

# ------------------| Download Command line tools
## Download command line tools from https://developer.android.com/studio
mkdir -p ~/Documents/Software/Android/sdk/cmdline-tools/latest/
mv cmdline-tools/* ~/Documents/Software/Android/sdk/cmdline-tools/latest/

# ------------------| Setup SDK
export ANDROID_AVD_HOME=~/.android/avd/
export ANDROID_HOME=~/Documents/Software/Android/sdk/
export ANDROID_SDK_ROOT=~/Documents/Software/Android/sdk/
export PATH=$PATH:$ANDROID_HOME/emulator:$ANDROID_HOME/tools:$ANDROID_HOME/tools/bin:$ANDROID_HOME/platform-tools
cd ~/Documents/Software/Android/sdk/cmdline-tools/latest/bin
./sdkmanager --list
./sdkmanager --install 'system-images;android-36;google_apis_playstore;arm64-v8a' 
./sdkmanager "platform-tools" "platforms;android-36"
./avdmanager create avd --name Pixel_7Pro --package "system-images;android-36;google_apis_playstore;arm64-v8a" --tag "google_apis_playstore" --abi "arm64-v8a" --device "pixel_7_pro"
~/Documents/Software/Android/sdk/emulator/emulator @Pixel_7Pro -no-snapshot-load -writable-system

# ------------------| Root 
git clone https://github.com/newbit1/rootAVD.git && cd rootAVD
./rootAVD.sh system-images/android-30/google_apis_playstore/arm64-v8a/ramdisk.img

# ------------------| Install Frida Modules
git clone https://github.com/ViRb3/magisk-frida.git && cd magisk-frida
python3 -m pip install requests
python3 main.py
adb push build/MagiskFrida-0.zip /sdcard/

# ------------------| Virtual keybord support
vi ~/.android/avd/Pixel_7Pro.avd/config.ini
## change hw.keyboard = yes

• Method II (Google Play API Native Flash)

# ------------------| Download Command line tools
## Download command line tools from https://developer.android.com/studio
mkdir -p ~/Documents/Software/Android/sdk/cmdline-tools/latest/
mv cmdline-tools/* ~/Documents/Software/Android/sdk/cmdline-tools/latest/

# ------------------| Setup SDK
export ANDROID_HOME=~/Documents/Software/Android/sdk
export ANDROID_SDK_ROOT=$ANDROID_HOME
export ANDROID_AVD_HOME=~/.android/avd
export PATH=$PATH:$ANDROID_HOME/emulator
export PATH=$PATH:$ANDROID_HOME/tools
export PATH=$PATH:$ANDROID_HOME/tools/bin
export PATH=$PATH:$ANDROID_HOME/platform-tools
export PATH=$PATH:$ANDROID_HOME/cmdline-tools/latest/bin
cd ~/Documents/Software/Android/cmdline-tools/bin
./sdkmanager --list
./sdkmanager --install 'system-images;android-30;google_apis;arm64-v8a' 
./sdkmanager "platform-tools" "platforms;android-30"
./avdmanager create avd --name Pixel_7Pro --package "system-images;android-30;google_apis;arm64-v8a" --tag "google_apis" --abi "arm64-v8a" --device "pixel_7_pro"
~/Documents/Software/Android/sdk/emulator/emulator @Pixel_7Pro -no-snapshot-load -writable-system

# ------------------| Root 
git clone https://github.com/newbit1/rootAVD.git && cd rootAVD
./rootAVD.sh system-images/android-30/google_apis/arm64-v8a/ramdisk.img

# ------------------| Make system file writeble
wget https://github.com/wuxianlin/android_tools/raw/master/adbd-Insecure-v2.00.apk
adb install adbd-Insecure-v2.00.apk
adb reboot
adb root
adb remount
## Now you can write anything on /system

# ------------------| Install Google Play
## Download pico gapps
https://opengapps.org
unzip open_gapps-x86_64-6.0-pico-20170304.zip 
rm Core/setup*
lzip -d Core/*.lz
for f in $(ls Core/*.tar); do tar -x --strip-components 2 -f $f; done
adb remount
adb push etc /system
adb push framework /system
adb push app /system
adb push priv-app /system
adb shell stop
adb shell start

# ------------------| Virtual keybord support
vi ~/.android/avd/Pixel_7Pro.avd/config.ini
## change hw.keyboard = yes

Install Anbox on kali linux

## ------------------| Setup
sudo apt install anbox
sudo apt install android-tools-adb
sudo /sbin/modprobe ashmem_linux
sudo /sbin/modprobe binder_linux
ls -1 /dev/{ashmem,binder}
wget https://build.anbox.io/android-images/2018/07/19/android_amd64.img
sudo mv android_amd64.img /var/lib/anbox/android.img
sudo service anbox-container-manager restart

# ------------------| Start 
anbox launch --package=org.anbox.appmgr --component=org.anbox.appmgr.AppViewActivity

# ------------------| Install F-Droid
wget https://f-droid.org/F-Droid.apk
adb install F-Droid.apk

Installing Android on VMWare Workstation

# ------------------| Download ISO
https://www.android-x86.org/

# ------------------| Setup VMWare and Install
Choose Other Linux 4.x
Advanced options... --> Auto_Installation --> Reboot

# ------------------| Fix boot-up freeze
## Step 01: Open grub editor (e)
## Step 02: Replace 'quiet' to 'nomodeset xforcevesa' and press enter
## Step 03: Press b
## Step 04: When you see Android logo press Alt+F1
## Step 05: Type following commands
mkdir /mnt/sda
mount /dev/block/sda1 /mnt/sda
vi /mnt/sda/grub/menu.lst
## Step 05: Replace 'quiet' to 'nomodeset xforcevesa' and save and reboot 

Install BurpSuite Certificate

## ------------------| Using Magisk 
wget https://github.com/h4rithd/BurpSuitCert/releases/download/1.0.0/BurpSuiteCert.zip
adb push BurpSuiteCert.zip /data/local/tmp/
adb shell
su
magisk --install-module /data/local/tmp/BurpSuiteCert.zip
reboot

## ------------------| Manual Mode
cacert.der
openssl x509 -inform DER -in cacert.der -out cacert.pem  
mv cacert.pem $(openssl x509 -inform PEM -subject_hash_old -in cacert.pem |head -1).0
adb shell
adb push 9a5ba575.0 /sdcard/
mount -o rw,remount /system
mv /sdcard/9a5ba575.0 /system/etc/security/cacerts/  
chmod 644 /system/etc/security/cacerts/9a5ba575.0

Errors

• Auto start frida-server

#!/system/bin/sh
(
    while [ "$(getprop sys.boot_completed)" != "1" ]; do
        sleep 2
    done
    sleep 20
    /data/local/tmp/frida-server -D
    echo "Frida started at $(date)" >> /data/local/tmp/frida_boot.log
) &

### adb push start_frida.sh /data/local/tmp/start_frida.sh
### mv /data/local/tmp/start_frida.sh /data/adb/service.d/
### chmod +x /data/adb/service.d/start_frida.sh
### chown root:root /data/adb/service.d/start_frida.sh
### chmod 755 /data/local/tmp/frida-server

• Fix NET::ERR_CERT_AUTHORITY_INVALID Issue

### Get the base64 encoded SHA256 fingerprint of the certificate
openssl x509 -in 9a5ba575.0 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
### Create a chflag file with the following content
### chrome --ignore-certificate-errors-spki-list=<base64_encoded_fingerprint>
echo 'chrome --ignore-certificate-errors-spki-list=zbu8GKlP5w8KK7vU+fV059UOM7O1RKVOsz2Gdc3oB1Y=' > chflag
### Execute the following commands to push the chflag file to the device
adb push chflag /sdcard/chflag
adb su
chmod 555 /sdcard/chflag
cp /sdcard/chflag /data/local/chrome-command-line
cp /sdcard/chflag /data/local/android-webview-command-line
cp /sdcard/chflag /data/local/webview-command-line
cp /sdcard/chflag /data/local/content-shell-command-line
cp /sdcard/chflag /data/local/tmp/chrome-command-line
cp /sdcard/chflag /data/local/tmp/android-webview-command-line
cp /sdcard/chflag /data/local/tmp/webview-command-line
cp /sdcard/chflag /data/local/tmp/content-shell-command-line

02.2 Frida Framework

Basic

## ------------------| List running apps
frida-ps -Ua

## ------------------| List installed apps
frida-ps -Uia

## ------------------| Auto-trace Java methods (Android)
frida-trace -U -j "com.package.ClassName!methodName"

## ------------------| Auto-trace ObjC methods (iOS)
frida-trace -U -m "-[ClassName *]" "AppName"

## ------------------| Auto-trace C functions (by name)
frida-trace -U -i "functionName" "AppName"

## ------------------| frida-trace to trace specific functions (quick)
frida-trace -U -i "SSL_*" -i "crypto_*" -n com.example.app

## ------------------| Spawn app and attach (resume)
frida -U -f com.example.app -l hook.js --no-pause

## ------------------| Attach to running process by name
frida -U -n com.example.app -l hook.js

## ------------------| Attach to running process by PID
frida -U -p 1234 -l hook.js

## ------------------| Remote device (adb forward first)
adb forward tcp:27042 tcp:27042
frida -H 127.0.0.1:27042 -n com.example.app -l hook.js

Scripts

## ------------------| [SCRIPT] Basic Android Root Bypass
# Save as root_bypass.js and load with 'frida -U -l root_bypass.js -f com.package.name'
Java.perform(function() {
    var RootClass = Java.use("com.app.security.RootDetector");
    RootClass.isDeviceRooted.implementation = function() {
        console.log("[+] Bypassing root detection!");
        return false;
    };
});

## ------------------| [SCRIPT] Find all loaded classes (Android)
# Run in Frida REPL (frida -U -f com.package.name)
Java.perform(function() {
    Java.enumerateLoadedClasses({
        onMatch: function(className) {
            console.log(className);
        },
        onComplete: function() {
            console.log("[+] Class enumeration complete.");
        }
    });
});

Java.perform(function () {
    Java.enumerateLoadedClasses({
        onMatch: function (name) {
            if (
                name.toLowerCase().includes('root') ||
                name.toLowerCase().includes('ssl') ||
                name.toLowerCase().includes('pin') ||
                name.toLowerCase().includes('frida') ||
                name.toLowerCase().includes('emulator') ||
                name.toLowerCase().includes('integrity')
            ) {
                console.log(name);
            }
        },
        onComplete: function () {
            console.log('[+] Class search complete');
        }
    });
});

## ------------------| [SCRIPT] Trace all methods in a class (Android)
# Run in Frida REPL or save to file
Java.perform(function() {
    var targetClass = 'com.package.name.TargetClass';
    var methods = Java.use(targetClass).class.getDeclaredMethods();
    
    methods.forEach(function(method) {
        var methodName = method.getName();
        console.log("[+] Hooking: " + methodName);
        
        Java.use(targetClass)[methodName].implementation = function() {
            console.log("[*] Called: " + targetClass + "." + methodName);
            return this[methodName].apply(this, arguments);
        };
    });
});

## ------------------| [SCRIPT] Dump strings and memory (useful quick)
# Run in Frida REPL or save to file
var ranges = Process.enumerateRanges('--x');
ranges.forEach(function(r){
    try {
        var s = Memory.readUtf8String(r.base, 256);
        if (s && s.length > 4) console.log(r.base + " -> " + s);
    } catch(e){}
});

## ------------------| [SCRIPT] OkHttp CertificatePinner bypass for test build
Java.perform(function () {
    try {
        const CertificatePinner = Java.use('okhttp3.CertificatePinner');

        CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function (hostname, peerCertificates) {
            console.log('[+] OkHttp pin bypass: ' + hostname);
            return;
        };

        CertificatePinner.check.overload('java.lang.String', '[Ljava.security.cert.Certificate;').implementation = function (hostname, certs) {
            console.log('[+] OkHttp pin bypass: ' + hostname);
            return;
        };
    } catch (e) {
        console.log('[-] OkHttp CertificatePinner not found: ' + e);
    }
});

Best Scripts

• OneRule by h4rithd

---

02.3 Magisk

Best Magisk Modules

Name	Usage
LSPosed	Zygisk‑based Xposed framework. Install module ZIP via Magisk, activate it in Zygisk > DenyList, then enable per-app hooks in the LSPosed app.
BurpSuitCert	Systemlessly installs Burp Suite’s CA cert. Flash the Magisk ZIP, reboot, and trust the Burp CA for HTTPS interception.
MagiskHidePropsConf	Spoofs system props (e.g. fingerprint, device model). Install ZIP, use its GUI to set “safetynet” or “pixel” profiles, reboot.
Shizuku	Run apps with elevated privileges via ADB or root. Install Shizuku APK, activate service (via Magisk module or ADB), grant permissions in-app.
ZygiskNext	Extends Zygisk control/system patching. Install ZIP via Magisk, enable it, configure filters in its app.
Zygisk-SSL-Unpinning	Bypasses SSL pinning automatically. Flash the ZIP, reboot, enable module in Zygisk and it hooks SSL at runtime.
IAmNotADeveloper	Hides developer/dev debug flags. Flash ZIP, reboot, and it suppresses “developer” checks in apps.
safetynet-fix	Fixes SafetyNet attestation. Install release ZIP via Magisk, reboot, test with SafetyNet API.
PlayIntegrityFork	Spoofs/bypasses Play Integrity API responses. Flash ZIP, reboot, and it hooks Play Integrity at runtime.
Hide-My-Applist	Hides selected apps from detection. Install module, open its interface and pick which apps to conceal, reboot.
Zygisk-Assistant	UI manager for Zygisk modules. Flash module via Magisk, then use its app to order, enable/disable modules easily.
KernelSU	Kernel-level root alternative. Flash custom KernelSU ZIP (replacing Magisk), reboot to get root without Magisk footprints.
APatch	Runtime app patching via Zygisk. Flash module, enable in Zygisk, use its interface to apply live patches (e.g. bypass checks).

• Best Android RATs

  • https://github.com/ScRiPt1337/Teardroid-phprat

  • https://github.com/D3VL/L3MON

  • https://github.com/anirudhmalik/xhunter