View source for MobSF: Root Detection & Certificate Pinning Bypass

[[File:MobSF Logo.png|300px|thumb|right|MobSF Logo]]
== Summary == 

This documentation provides step-by-step instructions for setting up and using MobSF (Mobile Security Framework) for dynamic analysis on Kali Linux. It covers the setup process, bypassing root detection using default and custom scripts, and bypassing SSL pinning. Detailed commands and screenshots are included to ensure successful implementation.

== Requirements ==

* Operating System: Kali Linux
* Installed Android Studio ([https://wiki.elvis.science/index.php?title=Android_Studio:_Emulator Guide])
* Android Studio emulator with a Non-production android image ([https://wiki.elvis.science/index.php?title=Android_Studio:_Emulator Guide])
* Installed Apps on the emulator device

== Setup ==

Use the following commands in the terminal: 

Install Git
 sudo apt-get install git

Install Python 3.8
 sudo apt-get install python3.8

Install the latest version of '''JDK'''

[https://www.oracle.com/java/technologies/downloads/ Oracle Downloads]

Install the required dependencies
 sudo apt install python3-dev python3-venv python3-pip build-essential libffi-dev libssl-dev libxml2-dev libxslt1-dev libjpeg62-turbo-dev zlib1g-dev wkhtmltopdf

Clone the MobSF repository
 git clone https://github.com/MobSF/Mobile-Security-Framework-MobSF.git

Change working directory to MobSF
 cd Mobile-Security-Framework-MobSF/

Setup MobSF
 ./setup.sh

Run MobSF
 ./run.sh 127.0.0.1:8000

Access the MobSF web interface with the following URL http://127.0.0.1:8000

== Root Detection Bypass using MobSF ==

=== Root Detection Bypass using Default Scripts ===
'''Follow the steps exactly in the shown order!''' 

1. Start your emulator
 emulator -avd Pixel_6_Pro_API_28 -writable-system -no-snapshot
2. Wait for the successful boot of the device
<blockquote>The Error "Unable to connect to adb daemon on port:5037" has no impact on successful boot.</blockquote>
3. Start MobSF
 ./run.sh 127.0.0.1:8000
4. Wait for successful boot of MobSF, the CLI should look like this

[[File:Mobsf_sucessfulboot.png]]

5. Open MobSF in the Browser (http://127.0.0.1:8000/)

6. Click on Dynamic Analyzer -> Android Dynamic Analyzer -> Select the App you want to test -> Click on "Start Dynamic Analysis"

7. The CLI output of MobSF should look like this

[[File:Mobsf_dynamicanalysis_start.png]]

8. Now Select "Root Detection Bypass" under the Default headline

9. Press Spawn&Inject, wait for the Application to Startup & leave it open like it is
<blockquote>Here the Root Detection still works, so you should see a notification, as MobSF First Spawns & then injects the script, therefore you need to restart the application as shown in Step 10.</blockquote>

10. As the Application is still opened, press "StartActivity" to startup the Application with Root Detection Bypass

'''If you followed the Steps in this order, your MobSF CLI should look like this, as you successfully bypassed Root Detection.'''

[[File:Mobsf_successful_rootbypass.png]]

=== Root Detection Bypass using Custom Scripts ===
'''Follow the steps exactly in the shown order!'''

1. Start your emulator
 emulator -avd Pixel_6_Pro_API_28 -writable-system -no-snapshot

2. Wait for the successful boot of the device
<blockquote>The ERROR "Unable to connect to adb daemon on port:5037" has no impact on successful boot.</blockquote>

3. Start MobSF
 ./run.sh 127.0.0.1:8000

4. Open MobSF in Browser (http://127.0.0.1:8000/)

5. Click on Dynamic Analyzer -> Android Dynamic Analyzer -> Select the App you want to Test -> Click on "Start Dynamic Analysis"

6. Now copy & paste the [https://codeshare.frida.re/@dzonerzy/fridantiroot/ fridaantiroot script] into the window on the right in MobSF (Script Window)

7. Press Spawn&Inject, wait for the Application to startup & leave it open like it is
<blockquote>Here the Root Detection still works so you should see a notification, as MobSF First Spawns & then injects the script, therefore you need to restart the application as shown in Step 8.</blockquote>

8. As the Application is still opened, press "StartActivity" to startup the Application with Root Detection Bypass

== SSL Pinning Bypass using MobSF ==
1. Start emulator
 emulator -avd Pixel_6_Pro_API_28 -writable-system -no-snapshot

2. Start MobSF
 ./run.sh 127.0.0.1:8000

3. Start Dynamic Analysis of your App
Select your App & press Start Dynamic Analysis

4. Choose Configurations
* Select '''SSL Pinning Bypass'''
* Check if '''Root CA is installed'''
* Check if '''HTTP(S) Proxy is set '''
[[File:Mobsf_dynamicanalysis_config1.png]]

5. Spawn & Inject

6. Test the App, do your Activities

7. Press Generate Report, the creation can take a while.
    
[[File:Mobsf_dynamicanalysis_generatereport.png]]

8. Then you are able to see the Logs
    
[[File:Mobsf_dynamicanalysis_logs.png]]
    
* '''Start HTTPTools:''' Launches tool to analyze HTTP(S) traffic between the mobile application and the server.
* '''Frida Logs:''' Displays logs generated by Frida, a dynamic instrumentation toolkit used for runtime manipulation of applications.
* '''HTTP(S) Traffic:''' Shows the captured HTTP and HTTPS traffic logs.
* '''Logcat Logs:''' Provides logs from Logcat, a system-wide logging utility for Android.
* '''Dumpsys Logs:''' Displays logs generated by the dumpsys tool, which provides detailed information about the system and application state.
* '''Application Data:''' Downloads the application's data stored on the device.

=== HTTPTools ===

In HTTPTools you can analyze HTTP(S) traffic. 
You also have the Option to replay your captured traffic to a Fuzzer(Burpsuite).

[[File:Mobsf_dynamicanalysis_httptools.png]]

== References ==

* [https://mobsf.github.io/docs/#/ MobSF Documentation]
* [https://github.com/MobSF/Mobile-Security-Framework-MobSF MobSF Github]
* [https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0045/ OWASP Testing Root Detection]
* [http://web.archive.org/web/20230402054208/https://mas.owasp.org/MASTG/Android/0x05j-Testing-Resiliency-Against-Reverse-Engineering/ OWASP Testing Resiliency Against Reverse Engineering]
* [https://www.indusface.com/learning/how-to-implement-root-detection-in-android-applications/ Root Detection Explaination]
* [https://sec-consult.com/de/blog/detail/android-mobile-root-detection-allheilmittel-gegen-angriffe/ Root Detection Explaination]
* [https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0012/ OWASP Bypassing Certificate Pinning]
* [https://owasp.org/www-community/controls/Certificate_and_Public_Key_Pinning Certificate Pinning Explaination]

[[Category:Documentation]][[Category:Pentesting]]