Frida

Frida is an amazing piece of software. My favourite use is mitm proxy “attack” to have an in-depth API investigation of apps that I use frequently. This setup will allow you to easily bypass any SSL certificate pinning.

Execute these steps in 3 different shells

1. Create docker volume for mitm

   $ docker volume create mitmproxy

2. Start the container

   $ docker run --rm -it -v mitmproxy:/home/mitmproxy/.mitmproxy -p 4817:8080 -p 4818:8081 mitmproxy/mitmproxy mitmweb --web-host 0.0.0.0 --ignore-hosts gateway.icloud.com

3. Set your browser to use the HTTP proxy you just created
4. Navigate with your browser to mitm.it and download the certificate to ~/Downloads/YOUR_MITM_CERT
5. You will also conveniently see all the HTTP(S) requests here
6. TIP: disable the proxy in the browser to limit the noise

1. Create a Python VENV

   $ python3 -m venv frida-venv

2. Activate the environment

   $ source frida-venv/bin/activate

3. Install Frida

   (frida-venv) $ python3 -m pip install Frida
   (frida-venv) $ python3 -m pip install objection
   (frida-venv) $ python3 -m pip install frida-tools

4. Download the Android side binary

   (frida-venv) $ version=$(frida --version) && curl -Lo ~/Downloads/frida-server.xz https://github.com/frida/frida/releases/download/$version/frida-server-$version-android-x86_64.xz

5. Unpack the Android side binary

   (frida-venv) $ xz -d ~/Downloads/frida-server.xz

1. Install Android Studio

   $ snap install --classic android-studio

2. Set the right variables in your environment

   $ export ANDROID_HOME=$HOME/Android/Sdk
   $ export PATH=$PATH:$ANDROID_HOME/emulator
   $ export PATH=$PATH:$ANDROID_HOME/tools
   $ export PATH=$PATH:$ANDROID_HOME/tools/bin
   $ export PATH=$PATH:$ANDROID_HOME/platform-tools
   $ export PATH=~/Android/Sdk/cmdline-tools/latest/bin:$PATH

3. Open Android Studio, click on “More Actions”>“SDK Manager” and tick “Show Package Details”.
   1. Select the “SDK Platforms” you want to emulate
   2. In the “SDK Tools”, select the respective “Android SDK Build-Tools” and the latest “Android SDK Command-line Tools”
   3. Finally click “Apply”
4. Prepare your emulator

   $ avdmanager create avd --force --name pixel-android-api-29 --package "system-images;android-29;google_apis;x86_64" --device "pixel"

5. Launch your emulator

   $ emulator -avd pixel-android-api-29 -writable-system &> /dev/null &

6. Using the emulator UI, click the three dots on the side menu, Settings, Proxy and set the mitm proxy address and port
7. Get root access

   $ adb root

8. Upload mitm CA certificate

   $ adb push ~/Downloads/YOUR_MITM_CERT.cer /data/local/tmp/cert-der.crt

9. Upload Frida

   $ adb push ~/Downloads/frida-server /data/local/tmp

10. Fix permissions

    $ adb shell "chmod +x /data/local/tmp/frida-server"

11. Start Frida

    $ adb shell "/data/local/tmp/frida-server&" &

12. Get your APK from a phone or apkmirror
13. Install the APK

    $ adb install YOUR_APK.apk &

Great, you are ready to go!

1. Go back to the shell that's currently running in the Frida Python VENV
2. Start your app (assuming it's com.google.com)

   (frida-venv) $ frida --codeshare akabe1/frida-multiple-unpinning -U -f com.google.com

3. Observe the magic happening in your browser :)