BERRY9 IT Services, home +91 86868 92922

Android App Pen-Testing with Frida and Objection

Android application pen-testing without Frida and Objection is possible but much slower. Together they let a tester sit inside the running process and observe, modify, and rewrite the app's behavior live. Here is how they are used in a typical test.

Request a scoping call Call +91 86868 92922

Mobile apps · By Thimmagurudu Bathini · Published · 6 min read · Last reviewed

The setup

A rooted device, or Android Studio's emulator with a writable system image, is the usual test setup. Frida server is pushed to the device; Objection installs on the laptop. Once the app is running, the tester can attach to it and start instrumenting.

What Frida is used for

  • Bypassing root and jailbreak detection — many banking and enterprise apps check for root. Frida can patch the detection methods to return false.
  • Bypassing certificate pinning — replace the trust manager with one that accepts the tester's Burp CA. See intercepting mobile API traffic for the full flow.
  • Dumping secrets from memory — encryption keys, OAuth tokens, anything the app holds in plaintext during normal operation.
  • Tracing methods — log every call to a class to understand what the app does at each user action. Faster than reading the decompiled source.

What Objection is used for

Objection is a higher-level wrapper over Frida with commands that do the common things in one line. android sslpinning disable, android hooking watch class, android keystore list, android intent launch_activity. Objection is often enough; Frida covers the cases it cannot.

What the report includes

Every finding is reproducible. We include the Frida script we used, the exact tap-path through the app, and the captured request/response or memory dump. The report is written for the Android developer, not the auditor — code-level fixes for every finding.

See mobile application penetration testing.

Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.

Plan your next security test

Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.

Request a scoping call WhatsApp