1.Objective
Demonstrate how to intercept and manipulate sensitive app functionality using Frida to bypass login checks on the InsecureBankv2 app.
1.1. Prerequisites
✅ Frida installed on your PC (pip install frida-tools)
✅ Rooted Android emulator/device (Genymotion or similar)
✅ InsecureBankv2 APK installed and running on the device
✅ USB debugging enabled (or virtual ADB over Genymotion)
1.2. Understanding Prerequisites
Frida is a powerful tool used by developers and ethical hackers to inspect, modify, and control apps while they are running. Think of it like a "microscope" that lets you look inside an app and change what it does — without changing the actual app code.
✅ Common Uses:
Genymotion ADB (Android Debug Bridge) connects your computer to a Genymotion virtual Android device. It works the same way as it does with a real phone.
✅ Why Use It?
Easy to test apps on different Android versions
Run scripts, install apps, and debug smoothly
Great for automation and security testing
💻 ADB Shell – Command Line Access to Android
ADB Shell lets you open a terminal directly inside the Android device (real or virtual). You can run commands to control the device or inspect files.
✅ What You Can Do:
Access system directories
Modify app files or settings
Run commands like pm list packages, am start, etc.
2.Environment Installation
Now you understand the basic term required for the dynamic code injection. we will then proceed to installing those requirements
✅ Here are the Prerequisites Setup for Frida on Kali Linux/Ubuntu (No virtual box is needed if you are linux)
If you are a window user then you must need to install virtual box with creating a virtual environment for installation of kali linux on virtual box and perform the operation on linux machine.
1. Install Frida
Make sure Python and pip are available:
sudo apt update
sudo apt install python3 python3-pip -y
Then install Frida:
pip3 install frida-tools
Check version to confirm:
frida --version
2. Install ADB (Android Debug Bridge)
ADB is needed to connect your PC to the Android emulator:
sudo apt install android-tools-adb -y
3. Set Up Genymotion Emulator (Rooted)
Connect to the emulator:
adb connect <your_emulator_ip>:5555
Check connection:
adb devices
Download the APK, then install it on the emulator:
You will get problem to download the apk. so don’t worry here i’ll provide you a direct link.
App Link: https://github.com/dineshshetty/Android-InsecureBankv2/raw/master/InsecureBankv2.apk
adb install InsecureBankv2.apk
Make sure the app runs on the emulator.
5. Enable USB Debugging / ADB Over Network
On Genymotion, USB debugging is pre-enabled. Just connect using the IP shown in the emulator.
3. Setting up frida server on android(rooted)
Look your phone is not rooted at this point so i prefer you to use genymotion we talk about earlier. Once you've installed Frida on your Kali Linux or Ubuntu system and set up a rooted Android device/emulator (like Genymotion), it’s time to set up the Frida Server to start hooking into Android apps.
✅ Step 1: Download the Correct Frida Server
Frida server must match the Frida version installed on your PC and the CPU architecture of your Android device (e.g., arm, arm64, x86, x86_64).
Check your Frida version:
frida --version
Go to: https://github.com/frida/frida/releases
Download the server binary like:
frida-server-<version>-android-x86_64.xz (for Genymotion)
OR
frida-server-<version>-android-arm64.xz (for real phones)
Extract the binary:
tar -xf frida-server-*.xz
✅ Step 2: Push Frida Server to Android
Make sure ADB is connected:
adb devices
Push and set permissions:
adb push frida-server /data/local/tmp/
adb shell "chmod 755 /data/local/tmp/frida-server"
✅ Step 3: Start Frida Server on Android
Now open an ADB shell and run the server as root step by step one after another:
adb shell
su
cd /data/local/tmp/
./frida-server &
✅ You should now have Frida server running in the background on your device.
🕵️♂️ Step 4: Using Frida and frida-ps
List running processes (check if your target app is visible):
frida-ps -U
-U stands for USB device (or connected emulator).
List only apps:
frida-ps -Uai
-a = applications only
-i = include app identifiers (package names)
🎯 Step 5: Attach to a Running App
To attach to an app (e.g., InsecureBankv2), find the package name (like com.android.insecurebankv2) using frida-ps, then:
frida -U -n com.android.insecurebankv2
Sometimes com.android.insecurebankv2 might not work so in that situation
🧪 Step 6: Attach to the App Process when above snippet didn’t work
frida -U -p 3990
This attaches Frida to the app’s running process. Here 3990 is pid obtained from “frida-ps -Uai” command line. Then you will enter into frida REPL.
🧪 Step 7: Write a Frida Hook Script – hook-login.js
Now that Frida is running, let's create a custom script to hook into the app's login function.
Create a file called hook-login.js with the following content:
jsCopyEditJava.perform(function () {
var loginClass = Java.use("com.android.insecurebankv2.LoginActivity");
loginClass.performlogin.implementation = function () {
console.log("🔒 performlogin() hooked!");
// Skip original logic
console.log("✅ Login bypassed (fake success)");
};
});
🧠 Why Are We Doing This?
We're telling Frida:
“Hey, whenever the performlogin() function is called in the app, don’t do the real logic. Just show a fake success.”
This lets us bypass the actual login check — useful for testing how the app handles sessions, authentication logic, or insecure code.
🧪 Step 6: Inject the Script into the App
Now use Frida to inject the hook into the running app.
First, find the app’s PID (process ID):
frida-ps -U
Then inject the script:
frida -U -p <PID> -l hook-login.js
Example:
frida -U -p 3990 -l hook-login.js
✅ If successful, Frida will inject your script, and you’ll return to a prompt where you can see logs printed from your hook.
🧪 Step 7: Trigger the Hook
Go back to the app and enter any credentials, even invalid ones.
If the hook works, you’ll see in the Frida console:
scssCopyEdit🔒 performlogin() hooked!
✅ Login bypassed (fake success)
