View source for Objection: Root Detection & Certificate Pinning Bypass

[[File:Objection.png|400px|thumb|right|Objection Logo]]
== Summary ==

In this documentation, we will perform a root detection bypass and a certificate pinning bypass on a test app and on Twitter using Objection.

== Requirements ==

* Operating System: Kali Linux
* You must already have done the [[Android Studio: Emulator]] documentation
* You must already have done the [[Frida: Root Detection & Certificate Pinning Bypass]] documentation

== Installation and Commands ==

Download objection
<pre>
pip install objection
</pre>

Start Frida on the emulator
<pre>
adb root
</pre>
<pre>
adb shell "/data/local/tmp/frida-server" &
</pre>

Start your app with objection
<pre>
objection -g &lt;APP-PACKAGE-NAME&gt; explore
</pre>
Example:
<pre>
objection -g owasp.sat.agoat explore
</pre>
[[File:Agoat.png]]

Root detection bypass command
<pre>
android root disable
</pre>
[[File:O-root.png | 1200px]]

SSL pinning bypass command
<pre>
android sslpinning disable
</pre>
[[File:O-ssl.png | 1200px]]

== Basic Functionality Testing ==

Before we use objection for a real-life scenario, we will test the functionality of the root detection bypass and certificate pinning bypass on a testing app called AndroGoat.
In this app, we can test if we successfully bypassed root and certificate pinning.

Download the [https://github.com/satishpatnayak/MyTest/blob/master/AndroGoat.apk AndroGoat.apk]

=== Root Detection ===

Under the section Root Detection in the AndroGoat app, there is a check to verify if the device is rooted or not.
Without anything done, it will say the emulator is rooted.

[[File:Root-detection.png | 350px]]

We close the app and start it again with objection
<pre>
objection -g owasp.sat.agoat explore
</pre>

With the following command, we bypass the root detection
<pre>
android root disable
</pre>
[[File:O-root2.png | 550px]]

Now the check should say that the device isn't rooted anymore, which means we successfully bypassed root detection.

[[File:Root-detection2.png | 350px]]

=== Certificate Pinning ===

Under the section Network Intercepting, there are three options to choose from.

To know if a check passed, we have to be able to capture the request in a tool like Burpsuite.

The check for HTTP and HTTPS can be seen in Burpsuite without doing anything.

But the certificate pinning check can't be seen in the proxy history since this check will test the certificate.

In order to bypass this, we use another objection command:
<pre>
android sslpinning disable
</pre>
[[File:O-ssl2.png | 1200px]]

Now we can finally see the request of this check in Burpsuite, which means we bypassed certificate pinning as well.

[[File:Agoat-request.png]]

== Testing on Twitter (X) ==

When normally starting Twitter, we can log in without any errors.

But in order to read the messages sent between the device and server, we want to use Burpsuite.

Now the login doesn't work anymore because Twitter has SSL pinning and detects that we want to listen in on the conversation with Burpsuite.

[[File:Twitter.png | 350px]]

So we have to disable SSL pinning with objection to log in and read the sent messages.

Find out the package name of Twitter with Frida
<pre>
frida-ps -Uia
</pre>

Start the Twitter app with the following command
<pre>
objection -g com.twitter.android explore
</pre>

Disable SSL pinning
<pre>
android sslpinning disable
</pre>

If it doesn't work on the first click, try clicking a second time on login.

Now you will be able to read the messages sent, but unfortunately, the payload is encrypted, which means we can't actually read the credentials.

== References ==

* [https://mas.owasp.org/MASTG/tools/generic/MASTG-TOOL-0038/ OWASP Mobile Security Testing Guide]
* [https://github.com/sensepost/objection GitHubObjection]

[[Category:Documentation]]
[[Category:Pentesting]]