Objection is a toolkit utilizing Frida making various little tasks in playing with Android accessible and easy to use.
Prerequisites
- Install frida & Objection
- `pip3 install objection
- Root the target device
- Download and push frida-server onto device
- Select correct plattform! :)
- i.e. /data/local/tmp , chmod +x
- Connect to phone via ADB and start frida-server
Circumenvent Cert Pinning
Identify target
Run frida-ps -U to fetch process information from target device. Don’t forget to start the target app!
PID Name
---- -------------------------------------------------------
1591 .dataservices
1002 adbd
921 adsprpcd
780 android.hardware.audio@2.0-service
975 android.hardware.biometrics.fingerprint@2.1-service.fpc
782 android.hardware.bluetooth@1.0-service-qti
599 android.hardware.boot@1.0-service
784 android.hardware.camera.provider@2.4-service
787 android.hardware.cas@1.0-service
616 android.hardware.configstore@1.1-service
789 android.hardware.contexthub@1.0-service
790 android.hardware.drm@1.0-service
791 android.hardware.drm@1.1-service.clearkey
792 android.hardware.drm@1.1-service.widevine
793 android.hardware.dumpstate@1.0-service.wahoo
600 android.hardware.gatekeeper@1.0-service-qti
794 android.hardware.gnss@1.0-service-qti
617 android.hardware.graphics.allocator@2.0-service
615 android.hardware.graphics.composer@2.1-service
796 android.hardware.health@2.0-service.wahoo
601 android.hardware.keymaster@3.0-service-qti
798 android.hardware.light@2.0-service
799 android.hardware.memtrack@1.0-service
800 android.hardware.nfc@1.1-service
801 android.hardware.oemlock@1.0-service
805 android.hardware.power@1.2-service.wahoo-libperfmgr
815 android.hardware.sensors@1.0-service
817 android.hardware.usb@1.1-service.wahoo
818 android.hardware.vibrator@1.2-service.wahoo
819 android.hardware.vr@1.0-service.wahoo
822 android.hardware.wifi@1.0-service
777 android.hidl.allocator@1.0-service
6018 android.process.acore
5827 android.process.media
857 audioserver
858 bufferhubd
934 cameraserver
970 chre
923 cnd
964 cnss-daemon
1410 com.android.bluetooth
6140 com.android.chrome
6433 com.android.chrome:webview_service
2462 com.android.ims.rcsservice
2431 com.android.nfc
1614 com.android.phone
2445 com.android.se
1646 com.android.settings
1439 com.android.systemui
3530 com.android.vending
1514 com.breel.wallpapers
2475 com.google.SSRestartDetector
5429 com.google.android.apps.gcs
5639 com.google.android.apps.messaging
2559 com.google.android.apps.nexuslauncher
3937 com.google.android.apps.turbo:aab
5723 com.google.android.apps.wellbeing
2524 com.google.android.as
4168 com.google.android.connectivitymonitor
6055 com.google.android.contacts
1807 com.google.android.ext.services
2738 com.google.android.gms
1959 com.google.android.gms.persistent
4665 com.google.android.gms.unstable
2401 com.google.android.googlequicksearchbox:interactor
2567 com.google.android.googlequicksearchbox:search
3841 com.google.android.ims
1427 com.google.android.inputmethod.latin
5767 com.google.android.music:main
5699 com.google.android.setupwizard
4611 com.google.android.youtube
2512 com.google.intelligence.sense
1458 com.google.modemservice
2386 com.google.process.gservices
6358 com.pentlandfirth.whizcart
1662 com.qualcomm.qcrilmsgtunnel
1608 com.qualcomm.qti.telephonyservice
5883 com.topjohnwu.magisk
935 drmserver
825 esed
912 folio_daemon
5945 frida-helper-32
5922 frida-server
971 gatekeeperd
778 healthd
586 hwservicemanager
984 imsdatadaemon
922 imsqmidaemon
936 incidentd
1 init
556 init
557 init
937 installd
750 ip6tables-restore
930 ipacm
749 iptables-restore
938 keystore
859 lmkd
966 loc_launcher
708 logcat
5924 logcat
595 logd
1584 lowi-server
703 magiskd
951 media.codec
940 media.extractor
941 media.metrics
939 mediadrmserver
942 mediaserver
833 msm_irqbalance
741 netd
924 netmgrd
802 oemlock-bridge
855 pd-mapper
864 performanced
916 pm-proxy
836 pm-service
927 port-bridge
582 qseecomd
588 qseecomd
931 qti
953 rild
849 rmt_storage
840 sensors.qcom
596 servicemanager
5860 sh
5869 sh
944 statsd
945 storaged
5865 su
613 surfaceflinger
1184 system_server
854 tftp_server
776 thermal-engine
865 thermalserviced
645 time_daemon
972 tombstoned
917 traced
918 traced_probes
558 ueventd
973 update_engine
866 virtual_touchpad
597 vndservicemanager
646 vold
779 vr_hwc
1488 webview_zygote
946 wificond
2351 wpa_supplicant
1585 xtra-daemon
748 zygote
747 zygote64
com.pentlandfirth.whizcart is what we were looking for!
Connect with objection
objection --gadget com.pentlandfirth.whizcart explore
Using USB device `Pixel 2`
Agent injected and responds ok!
_ _ _ _
___| |_|_|___ ___| |_|_|___ ___
| . | . | | -_| _| _| | . | |
|___|___| |___|___|_| |_|___|_|_|
|___|(object)inject(ion) v1.9.6
Runtime Mobile Exploration
by: @leonjza from @sensepost
[tab] for command suggestions
com.pentlandfirth.whizcart on (google: 9) [usb] #
Use the autocompletion to find what you want to do
com.pentlandfirth.whizcart on (google: 9) [usb] # android sslpinning disable
(agent) Custom TrustManager ready, overriding SSLContext.init()
(agent) Found okhttp3.CertificatePinner, overriding CertificatePinner.check()
(agent) Found com.android.org.conscrypt.TrustManagerImpl, overriding TrustManagerImpl.verifyChain()
(agent) Found com.android.org.conscrypt.TrustManagerImpl, overriding TrustManagerImpl.checkTrustedRecursive()
(agent) Registering job 8528042094279. Type: android-sslpinning-disable
com.pentlandfirth.whizcart on (google: 9) [usb] #
Rest
Intercepting Proxy and done :)
objection will produce a log line, each time it let’s you bypass the certificate check
(agent) [8528042094279] Called OkHTTP 3.x CertificatePinner.check(), not throwing an exception.
(agent) [8528042094279] Called OkHTTP 3.x CertificatePinner.check(), not throwing an exception.
(agent) [8528042094279] Called OkHTTP 3.x CertificatePinner.check(), not throwing an exception.
(agent) [8528042094279] Called OkHTTP 3.x CertificatePinner.check(), not throwing an exception.
(agent) [8528042094279] Called (Android 7+) TrustManagerImpl.checkTrustedRecursive(), not throwing an exception.
(agent) [8528042094279] Called OkHTTP 3.x CertificatePinner.check(), not throwing an exception.
(agent) [8528042094279] Called OkHTTP 3.x CertificatePinner.check(), not throwing an exception.
(agent) [8528042094279] Called OkHTTP 3.x CertificatePinner.check(), not throwing an exception.