View source for Frida: Root Detection & Certificate Pinning Bypass

[[File:Frida_logo.PNG|300px|thumb|right|Frida Logo]]
== Summary == 

This documentation provides detailed instructions for setting up and using Frida to bypass root detection and certificate pinning on an Android emulator. It includes steps for installing necessary tools, configuring the environment, and running specific commands to test and bypass security mechanisms in mobile applications.

== Requirements ==

* Operating System: Kali Linux
* Pip installed on your System
* Installed Android Studio ([https://wiki.elvis.science/index.php?title=Android_Studio:_Emulator Guide])
* Android Studio emulator with a Non-production android image ([https://wiki.elvis.science/index.php?title=Android_Studio:_Emulator Guide])
* Installed Apps on the emulator device (Twitter, Paypal, [https://github.com/satishpatnayak/AndroGoat AndroGoat])
* Installed [https://portswigger.net/burp Burpsuite]

== Setup ==
Install the following things using pip:
<pre>
pip install Frida

pip install objection

pip install frida-tools
</pre>

Add this path to ~./bashrc
<pre>
export PATH=$PATH:/home/kali/.local/bin
</pre>

Save & Exit the file.

Execute the bashrc file to make the changes effective:
<pre>
bash
source ~/.bashrc
</pre>
To check if variables are added to PATH:
<pre>
echo $PATH
</pre>

=== Install the frida-server ===
The frida-server will run on the emulator.

Find out which architecture the virtual device has.

If you followed the Android Studio setup the return should be: '''x86'''
<pre>
adb shell getprop ro.product.cpu.abi
</pre>
Download the frida-server from [https://github.com/frida/frida/releases Github].

At the time of testing the latest version is 16.2.1

'''frida-server-16.2.1-android-x86.xz'''

[[File:Frida_server_datei.PNG]]

Go to the Downloads directory
<pre>
cd Downloads/
</pre>
Unzip the downloaded file
<pre>
xz -d frida-server-16.2.1-android-x86.xz
</pre>
Rename the file
<pre>
mv frida-server-16.2.1-android-x86 frida-server
</pre>
Start adb as root (only possible if the emulator is without Google Play)
<pre>
adb root
</pre>
Push the frida-server to the emulator
<pre>
adb push frida-server /data/local/tmp/
</pre>
Make it executable
<pre>
adb shell "chmod +x /data/local/tmp/frida-server"
</pre>
Run the frida-server in the background
<pre>
adb shell "/data/local/tmp/frida-server" &
</pre>
List all processes running on the device to make sure frida-server is running
<pre>
frida-ps -Uia
</pre>

== Root detection bypass using frida-server ==

For testing purposes we use the Uncrackable L1 Apk from OWASP.

=== Download UnCrackable L1 Apk ===

Download the [https://mas.owasp.org/crackmes/ Android UnCrackable L1 Apk]

[[File:Frida_uncrackable.PNG]]

Run the emulator
<pre>
emulator -avd Pixel_6_Pro_API_28 -writable-system -no-snapshot
</pre>
Install the apk on the device
<pre>
adb install UnCrackable-Level1.apk
</pre>
This command outputs the package names for the processes running on the device, only works if the frida-server is still running
<pre>
frida-ps -Uia
</pre>
When opening the UnCrackable-Level1.apk it states the following:

[[File:Frida_uncrackable_devicescreen.PNG]]

To bypass this we use a frida codeshare command
<pre>
frida --codeshare dzonerzy/fridantiroot -f owasp.mstg.uncrackable1 -U
</pre>
The terminal should look like this:

[[File:Frida_rootbypass_cli.PNG]]

Now the UnCrackable-Level1.apk should start without the root detection warning:

[[File:Frida_uncrackable_devicescreen_afterbypass.PNG]]

==== Errors? ====
If any error with the frida-server occurs, it is possible that an old server is already running. 
For this you have to look up running servers in the shell. 
Don't forget to run '''adb as root'''.
<pre>
adb shell
</pre>
<pre>
ps -e | grep frida-server
</pre>
If any server is running, kill it.
<pre>
kill -9 <process-id>
</pre>
Now you can start a new server.

== Certificate Pinning Bypass using frida-server ==

In order to intercept the communication to the internet of the device, you have to connect it to the Burp Suite proxy.

Frida should be running on the device.

If it is not already use this command to start the server.
Don't forget to run adb as root before.
<pre>
adb shell "/data/local/tmp/frida-server" &
</pre>

Run the codeshare command to bypass certificate pinning:
<pre>
frida --codeshare masbog/frida-android-unpinning-ssl -U -f <APP-PACKAGE_NAME> -U
</pre>

=== Twitter ===

Twitter has certificate pinning checks, which means we have to start it with the frida command to intercept the traffic.
Otherwise, Twitter won't allow you to open the login page.
<pre>
frida --codeshare masbog/frida-android-unpinning-ssl -U -f com.twitter.android -U
</pre>
Now we can click on login and capture the encrypted messages in Burp Suite.

'''Twitter:'''

[[File:Frida_twitter_login.PNG]]

'''Burp Suite:'''

[[File:Frida_burpsuite_twitter_login.PNG]]

=== PayPal ===

Another popular app which has certificate pinning is PayPal.
But unlike Twitter, PayPal doesn't encrypt their login requests.
This means we are able to read credentials in cleartext, once we bypassed the certificate pinning.

Download the newest version of PayPal onto your device and find out the package name with frida.
<pre>
frida-ps -Uia
</pre>
When starting PayPal normally it will display an error about the internet connection.
This is because the certificate pinning check will detect your Burp Suite proxy.

[[File:Frida_paypal_login.PNG]]

We start the app again with frida
<pre>
frida --codeshare masbog/frida-android-unpinning-ssl -U -f com.paypal.android.p2pmobile -U
</pre>
Now we won't get any error message when logging in.
When looking into Burp Suite we can see a request to /v1/mfsauth/proxy-auth/token.

In the middle of the green text, the password is highlighted, also as the last the pair, email information is visible.

[[File:Frida_burpsuite_paypal_login.PNG]]

== Root and SSL bypass as one ==

So far we've only tried doing either just root detection or just SSL pinning alone.
But in order to bypass both of them at the same time we can use the frida codeshare.

* For our test we use the root detection bypass by dzonerzy: https://codeshare.frida.re/@dzonerzy/fridantiroot/

* And the SSL pinning bypass by masbog: https://codeshare.frida.re/@masbog/frida-android-unpinning-ssl/

To use both at the same time we will copy the code of those bypasses and paste them into a text file on our local machine.

Now we have a file, for example '''rootandssl.txt''' where both codes are contained.

Here is '''our file containing both bypasses''' uploaded to: https://file.io/6fxSi8IMHqwZ

It is possible to add as many scripts as you like.

To execute our own file we will use the following frida command:
<pre>
frida -l rootandssl.txt -f <APP_PACKAGE_NAME> -U
</pre>
In an app like AndroGoat.apk we can check if both test cases will work.

[[File:Frida_custom_script_execution.PNG]]

== References ==

* [https://frida.re/ Frida]
* [https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0045/ OWASP Testing Root Detection]
* [http://web.archive.org/web/20230315203625/https://mas.owasp.org/MASTG/Android/0x05j-Testing-Resiliency-Against-Reverse-Engineering/ OWASP Testing Resiliency Against Reverse Engineering]
* [https://www.indusface.com/learning/how-to-implement-root-detection-in-android-applications/ Root Detection Explaination]
* [https://sec-consult.com/de/blog/detail/android-mobile-root-detection-allheilmittel-gegen-angriffe/ Root Detection Explaination]
* [https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0012/ OWASP Bypassing Certificate Pinning]
* [https://owasp.org/www-community/controls/Certificate_and_Public_Key_Pinning Certificate Pinning Explaination]
* [https://portswigger.net/burp Burpsuite]
* [https://github.com/satishpatnayak/MyTest/blob/master/AndroGoat.apk AndroGoat APK]
* [https://www.apkmirror.com/ APKMirror] 

[[Category:Documentation]][[Category:Pentesting]]