0x7319$

Android Pentest Toolkit — Overview

2026-03-07 · Android · beginner

#android#burpsuite#frida#methodology#overview

⚠️ Authorization. Everything in this series targets devices you own or are explicitly authorized to test. Mobile pentesting without permission is illegal. These techniques are documented for legitimate security assessments and education only.

A practical, end-to-end methodology for intercepting traffic and bypassing security controls on rooted Android devices. The whole approach is built around a BurpSuite interception proxy with Frida for runtime hooking — the combination that handles the overwhelming majority of real-world apps.

What this series covers

TopicWhy it matters
Certificate injectionGet the app to trust your proxy CA (pre-14 vs. APEX-aware 14+)
Root detection bypassMany apps refuse to run on a rooted device
SSL/TLS pinning bypassApps pin certs; you need to defeat that to see traffic
Traffic redirectionForce the app’s traffic through your proxy
HTTP capture toolingInspect raw requests when Burp isn’t enough

The decision that drives everything: Android version

The single biggest fork in the workflow is the OS version, because of how the CA trust store works. There are three historical breakpoints, not just one:

adb shell getprop ro.build.version.release

  Android ≤ 6   ──►  apps trust USER store        no root needed
  Android 7–13  ──►  system store only            root required
  Android ≥ 14  ──►  APEX namespace injection     root + per-NS inject

Android 7 stopped apps from trusting user-installed CAs by default — which is why this entire series assumes a rooted device. Android 14 then moved the CA store under an APEX module with per-process mount namespaces forked from Zygote, so a cert file copy is no longer enough. The full breakdown of all four eras is its own part: The Android CA Trust Store Across Versions.

Series roadmap

  1. Overview — you are here
  2. The Android CA Trust Store Across Versions — pick your injection path
  3. ADB & Frida Setup — the foundation everything else needs
  4. Certificate Injection — Android < 14
  5. Certificate Injection — Android 14+ (APEX)
  6. Root Detection Bypass
  7. SSL Pinning Bypass
  8. Traffic Interception
  9. Tools & Scripts — the reusable scripts behind it all

End-to-end flow at a glance

For an Android 14+ target, a full HTTPS interception looks like this:

# 1. Convert and name the BurpSuite CA
openssl x509 -inform der -in burp.der -out burp.pem
HASH=$(openssl x509 -inform PEM -subject_hash_old -in burp.pem | head -1)
mv burp.pem "$HASH.0"

# 2. Inject the cert (APEX namespace injection)
adb push "$HASH.0" /data/local/tmp/"$HASH.0"
adb push script/install_cert.sh /data/local/tmp/install_cert.sh
adb shell chmod +x /data/local/tmp/install_cert.sh
adb shell /data/local/tmp/install_cert.sh "$HASH.0"

# 3. Point the device at BurpSuite
adb shell settings put global http_proxy "<BURP_IP>:8080"

# 4. Launch the app with root + SSL bypass
frida -U -f <package.name> -l script/frida_ssl.js

The rest of the series unpacks each of those steps.

📌 Nothing persists across reboots. Both the tmpfs cert mount and any iptables rules are memory-only. Re-apply after every device restart — this trips up everyone at least once.

See also

References