Objection: Root Detection & Certificate Pinning Bypass
Summary
In this documentation, we will perform a root detection bypass and a certificate pinning bypass on a test app and on Twitter using Objection.
Requirements
- Operating System: Kali Linux
- You must already have done the Android Studio: Emulator documentation
- You must already have done the Frida: Root Detection & Certificate Pinning Bypass documentation
Installation and Commands
Download objection
pip install objection
Start Frida on the emulator
adb root
adb shell "/data/local/tmp/frida-server" &
Start your app with objection
objection -g <APP-PACKAGE-NAME> explore
Example:
objection -g owasp.sat.agoat explore
Root detection bypass command
android root disable
SSL pinning bypass command
android sslpinning disable
Basic Functionality Testing
Before we use objection for a real-life scenario, we will test the functionality of the root detection bypass and certificate pinning bypass on a testing app called AndroGoat. In this app, we can test if we successfully bypassed root and certificate pinning.
Download the AndroGoat.apk
Root Detection
Under the section Root Detection in the AndroGoat app, there is a check to verify if the device is rooted or not. Without anything done, it will say the emulator is rooted.
We close the app and start it again with objection
objection -g owasp.sat.agoat explore
With the following command, we bypass the root detection
android root disable
Now the check should say that the device isn't rooted anymore, which means we successfully bypassed root detection.
Certificate Pinning
Under the section Network Intercepting, there are three options to choose from.
To know if a check passed, we have to be able to capture the request in a tool like Burpsuite.
The check for HTTP and HTTPS can be seen in Burpsuite without doing anything.
But the certificate pinning check can't be seen in the proxy history since this check will test the certificate.
In order to bypass this, we use another objection command:
android sslpinning disable
Now we can finally see the request of this check in Burpsuite, which means we bypassed certificate pinning as well.
Testing on Twitter (X)
When normally starting Twitter, we can log in without any errors.
But in order to read the messages sent between the device and server, we want to use Burpsuite.
Now the login doesn't work anymore because Twitter has SSL pinning and detects that we want to listen in on the conversation with Burpsuite.
So we have to disable SSL pinning with objection to log in and read the sent messages.
Find out the package name of Twitter with Frida
frida-ps -Uia
Start the Twitter app with the following command
objection -g com.twitter.android explore
Disable SSL pinning
android sslpinning disable
If it doesn't work on the first click, try clicking a second time on login.
Now you will be able to read the messages sent, but unfortunately, the payload is encrypted, which means we can't actually read the credentials.