Objection Android Pentesting Tutorial

In this article we will attach Objection to InsecureShop on Genymotion Android 10, map the app's on-disk layout, list activities and broadcast receivers, watch LoginActivity.onLogin fire at runtime, and try built-in jobs for SSL pinning and root detection.

Objection is a Frida front end that ships ready-made Android exploration jobs as REPL commands. You still need a working Frida stack on Kali and frida-server on a rooted test device, but Objection turns common pentest tasks into short commands instead of hand-written JavaScript. You will still tap through the app UI when you need to trigger the code those hooks observe. When a built-in command does not cover what you need, you can use the class and method information you discovered in Objection to write a more targeted Frida script.

What is Objection in Android pentesting?

Objection is a runtime mobile exploration tool built on Frida. SensePost ships it with commands for listing Android components, reading app storage, watching method calls, and toggling common anti-analysis checks.

Objection does not replace Frida. It uses Frida underneath to attach to the target app and inject its runtime agent. For the rooted workflow in this tutorial, you therefore need:

• Frida and Objection installed on Kali
• A compatible frida-server running on Android
• The Android device connected and visible to your analysis host

A simple way to think about it is that Frida provides the instrumentation engine, while Objection gives you ready-made commands for common mobile testing tasks. When you need a hook that Objection does not ship, write or adapt a .js script and run it with frida directly, as covered in the Frida Android tutorial.

  Your Kali shell                    Android device (rooted)
  ┌────────────────────┐             ┌─────────────────────────────┐
  │ objection CLI      │   Frida     │ frida-server                │
  │  (REPL + jobs)     │ ◄────────► │  injects into app process   │
  └─────────┬──────────┘   protocol  └──────────────┬──────────────┘
            │                                        │
            │  same engine underneath                ▼
            └──────────────────────────────►  InsecureShop (com.insecureshop)

Objection vs Frida

Frida is the instrumentation platform. Objection is a convenience layer on top of it.

Use Objection when a built-in command answers your question in one line. Switch to Frida when you need precise hooks, native instrumentation, or behavior Objection's generic jobs cannot reach. The Android SSL pinning bypass with Frida article shows that split: Objection is useful for a quick initial test (triage), while a targeted script handles stubborn OkHttp pins.

Install Objection and prepare Android

Objection and frida-tools are Python packages. On Kali's externally managed Python, pipx keeps them isolated from system packages. A virtual environment works too, but pipx is the path I recommend for readers on current Debian-based Kali.

Install the clients on Kali:

pipx install objection

Also install Frida's CLI tools so you can list processes with frida-ps before attaching Objection:

pipx install frida-tools

Confirm Objection matches the lab baseline:

objection version

objection: 1.12.5

Confirm the Frida client version next. For the most reproducible setup, use the frida-server build that corresponds to your Frida client version. This lab uses 17.17.0 on both sides.

frida --version

17.17.0

Pin the Genymotion TCP serial so later adb and Objection commands stay on the right device:

export ANDROID_SERIAL=192.168.56.103:5555

Connect and confirm the device is online:

adb connect "${ANDROID_SERIAL}"

already connected to 192.168.56.103:5555

List attached devices and confirm the serial shows as device:

adb devices -l

List of devices attached
192.168.56.103:5555    device product:vbox86p model:Phone device:vbox86p transport_id:4

frida-server must already be on the Android device at /data/local/tmp/frida-server and running as root. Follow the Frida Android tutorial for download, push, chmod, and start steps. This article assumes that server is in place and matches the Frida client version shown above.

Verify the server process:

adb shell 'ps -A | grep frida-server'

root          2178     1 1074904 142784 poll_schedule_timeout f2487bb9 S frida-server

Install InsecureShop if it is not present. Package identifier: com.insecureshop. Point -r at the APK path on your Kali host:

adb install -r ~/lab/insecureshop.apk

Open InsecureShop on the emulator so Frida can attach to a running process. The Android UI is only there to start the target; the rest of this tutorial stays in the Objection REPL. Then confirm Frida sees the app:

frida-ps -Uai | grep -i insecureshop

5517  InsecureShop          com.insecureshop

A PID in the first column means the process is running. If you only see the package with a dash, open the app on the device first.

Start an Objection session

On Objection 1.12.5, start replaced the older explore subcommand. -n identifies the target app. Because this lab has a Genymotion device with the ADB serial 192.168.56.103:5555, -S explicitly tells Objection which attached Android device to use.

Start an interactive session against the running app:

objection -n com.insecureshop -S 192.168.56.103:5555 start

     _   _         _   _
 ___| |_|_|___ ___| |_|_|___ ___
| . | . | | -_|  _|  _| | . |   |
|___|___| |___|___|_| |_|___|_|_|
      |___|(object)inject(ion) v1.12.5

     Runtime Mobile Exploration
        by: @leonjza from @sensepost

[tab] for command suggestions
com.insecureshop on (Android: 10) [usb] #

The prompt shows the package name, Android version, and transport. Press Tab in the REPL for command suggestions.

For one-shot commands without staying in the REPL, use run:

objection -n com.insecureshop -S 192.168.56.103:5555 run 'env'

That prints environment paths and exits. It is useful in scripts and CI-style checks. Interactive exploration still belongs in start.

This tutorial attaches to an already running InsecureShop process. If the attachment fails, first confirm that the app is running and that frida-server is reachable.

Inspect app environment and files

The env command maps Android storage locations for the current package. Run it inside an Objection session:

env

Name                    Path
----------------------  ------------------------------------------------------------
cacheDirectory          /data/user/0/com.insecureshop/cache
codeCacheDirectory      /data/user/0/com.insecureshop/code_cache
externalCacheDirectory  /storage/emulated/0/Android/data/com.insecureshop/cache
filesDirectory          /data/user/0/com.insecureshop/files
obbDir                  /storage/emulated/0/Android/obb/com.insecureshop
packageCodePath         /data/app/com.insecureshop-yYoGJ-XHXa7bAB4OVB_gog==/base.apk

filesDirectory and cacheDirectory are where many apps store SQLite databases, tokens, and downloaded content. packageCodePath points at the installed APK on disk, which is useful when you want to pull the same build MobSF already scanned.

Objection can browse the filesystem from the REPL. List the shared preferences directory for this package (paths use /data/user/0/… on this Android 10 image):

ls /data/user/0/com.insecureshop/shared_prefs

Type  Last Modified            Read  Write  Hidden  Size     Name
----  -----------------------  ----  -----  ------  -------  ---------
File  2026-09-09 17:09:54 GMT  True  True   False   2.4 KiB  Prefs.xml

Prefs.xml is a common place for cleartext flags, session identifiers, or debug settings in vulnerable training apps. Read it from the same Objection session:

filesystem cat /data/user/0/com.insecureshop/shared_prefs/Prefs.xml

====
<?xml version='1.0' encoding='utf-8' standalone='yes' ?>
<map>
    <string name="password">!ns3csh0p</string>
    <string name="productList">[{&quot;id&quot;:1,&quot;name&quot;:&quot;Laptop&quot;, ...}]</string>
    <string name="username">shopuser</string>
</map>
====

InsecureShop stores the demo username and password in cleartext preferences. In a real assessment, credentials, access tokens, or other sensitive values stored this way would be a finding because anyone who gains suitable access to the app's private storage could recover them without first decrypting the values. The productList value is a long JSON blob; the lines above keep the credential fields and truncate the catalog for readability.

Download the same file to Kali when you want a local copy for notes or further parsing:

filesystem download /data/user/0/com.insecureshop/shared_prefs/Prefs.xml ./Prefs.xml

Downloading /data/user/0/com.insecureshop/shared_prefs/Prefs.xml to ./Prefs.xml
Streaming file from device...
Writing bytes to destination...
Successfully downloaded /data/user/0/com.insecureshop/shared_prefs/Prefs.xml to ./Prefs.xml

Objection has now taken you from discovering the app's storage path to reading and downloading a real file without switching to a separate adb pull workflow.

Enumerate Android components

Static tools can enumerate components from the manifest. Objection lets you quickly enumerate activity, service, and receiver classes associated with the running app, which you can then correlate with manifest findings such as android:exported.

List activity classes:

android hooking list activities

com.insecureshop.AboutUsActivity
com.insecureshop.CartListActivity
com.insecureshop.ChooserActivity
com.insecureshop.LoginActivity
com.insecureshop.PrivateActivity
com.insecureshop.ProductListActivity
com.insecureshop.ResultActivity
com.insecureshop.SendingDataViaActionActivity
com.insecureshop.WebView2Activity
com.insecureshop.WebViewActivity

Ten activities appear for InsecureShop. Names like PrivateActivity, WebViewActivity, and SendingDataViaActionActivity are worth comparing against the manifest, then testing for broken access control, WebView issues, and unsafe intent handling.

Start a harmless activity through Objection to confirm you can interact with a discovered class at runtime. This lab uses AboutUsActivity:

android intent launch_activity com.insecureshop.AboutUsActivity

(agent) Starting activity com.insecureshop.AboutUsActivity...
(agent) Activity successfully asked to start.

The emulator should switch to the About screen. This shows why enumeration is useful: after finding an activity class, you can immediately try launching it and observe how the app behaves. Successfully launching an activity through Objection does not by itself prove that the activity is exported to other apps. Check android:exported in the manifest before treating external accessibility as a finding. Components confirmed as exported during manifest review can then be tested further with adb or other runtime tooling.

List services:

android hooking list services

net.gotev.uploadservice.UploadService

List broadcast receivers:

android hooking list receivers

com.insecureshop.broadcast.ProductDetailBroadCast

Class names from these lists should line up with your static review. Objection gives you the names quickly while the app is live.

Runtime class and method inspection

Once you know a class name from static analysis or the activity list, Objection can enumerate methods without opening Jadx. A common runtime-analysis loop looks like this:

• Find an interesting class
• List its methods
• Watch a method you care about
• Trigger the behavior in the app UI
• Observe the invocation in the REPL
• Dump arguments or return values when you need more detail

List methods on LoginActivity:

android hooking list class_methods com.insecureshop.LoginActivity

protected void com.insecureshop.LoginActivity.onCreate(android.os.Bundle)
public final void com.insecureshop.LoginActivity.onLogin(android.view.View)
... Found 6 method(s)

onLogin is the obvious hook point for credential handling. Watch onLogin() and confirm when the method is called. On Objection 1.12.5, the pattern uses Class!method:

android hooking watch com.insecureshop.LoginActivity!onLogin

Keep the Objection session open and tap Log in in InsecureShop. The REPL should register the watch job, then print the invocation when the method runs:

(agent) Registering job 811800. Name: watch-pattern for: com.insecureshop.LoginActivity!onLogin
(agent) Watching com.insecureshop.LoginActivity.onLogin(android.view.View)
(agent) [811800] Called com.insecureshop.LoginActivity.onLogin(android.view.View)

That Called line is the evidence the runtime hook fired. Watching invocation and dumping arguments are related but separate steps. Add --dump-args when you want the parameter values on the next call:

android hooking watch com.insecureshop.LoginActivity!onLogin --dump-args

After another tap on Log in, this lab printed the View argument (the login button):

(agent) Registering job 771300. Name: watch-pattern for: com.insecureshop.LoginActivity!onLogin
(agent) Watching com.insecureshop.LoginActivity.onLogin(android.view.View)
(agent) [771300] Called com.insecureshop.LoginActivity.onLogin(android.view.View)
(agent) [771300] Arguments com.insecureshop.LoginActivity.onLogin(androidx.appcompat.widget.AppCompatButton{8312ec8 VFED..C.. ...P.... 148,803-423,869 #7f09004b app:id/btnLogin})

Notice that onLogin() receives an Android View, so --dump-args shows the login button rather than the username and password. To capture credentials, you would need to identify the code that reads the username and password fields or inspect those views explicitly. Complex Java objects are also not always rendered as clean application data, so treat argument dumps as a starting point rather than a complete payload capture.

--dump-return is available the same way when you care about the method's return value. watch is useful when you only want to observe calls, arguments, return values, or backtraces. It does not by itself replace the method's implementation or alter its return value.

For deeper hooks (changing return values, chaining multiple classes), copy the class and method names into a Frida script as shown in the Frida Android tutorial.

Built-in Android security commands

Objection ships jobs that toggle common defensive checks. Treat them as a first-pass lab check, not guaranteed bypasses for every app.

Try the built-in SSL pinning job

If you are intercepting HTTPS with Burp, prove proxy and CA trust first using Android HTTPS interception with Burp. Only then use this job to see whether a common pin check is still blocking you.

android sslpinning disable

(agent) Custom TrustManager ready, overriding SSLContext.init()
(agent) Found com.android.org.conscrypt.TrustManagerImpl, overriding TrustManagerImpl.verifyChain()
(agent) Found com.android.org.conscrypt.TrustManagerImpl, overriding TrustManagerImpl.checkTrustedRecursive()
(agent) Registering job ... Name: android-sslpinning-disable

A registered job means Objection installed its generic TLS hooks. It does not prove SSL pinning was bypassed for this app. Some apps still fail because they use an OkHttp version or code path the generic hooks do not cover, a custom certificate check, native TLS code, or another framework-specific implementation. For a full bypass workflow and targeted scripts, use Android SSL pinning bypass with Frida. This page stops at proving the Objection job registered.

Try the built-in root-detection bypass

Objection includes hooks for several common Android root-detection checks:

android root disable

(agent) Registering job ... Name: root-detection-disable

A registered job means those hooks are active. It does not guarantee that every root check in the target app has been bypassed. Re-run any app flows that previously showed a root warning if you want visible confirmation. Custom native checks still need a dedicated Frida script.

Memory modules

So far, the examples have inspected Java and Kotlin code running through Android's Java runtime. Some apps also perform important work in native .so libraries. memory list modules lets you see which native libraries are currently loaded:

memory list modules

Name                                          Base        Size                 Path
--------------------------------------------  ----------  -------------------  ------------------------------------------------------------------
app_process32                                 0x5a4b7000  36864 (36.0 KiB)     /system/bin/app_process32
libandroid_runtime.so                         0xf5458000  1998848 (1.9 MiB)    /system/lib/libandroid_runtime.so
libart.so                                     0xf1cc9000  6987776 (6.7 MiB)    /apex/com.android.runtime/lib/libart.so
libssl.so                                     0xdec48000  385024 (376.0 KiB)   /apex/com.android.conscrypt/lib/libssl.so

Loaded libraries give you candidates for later native analysis. For example, seeing libssl.so confirms that a TLS-related native library is mapped into the process, but it does not by itself prove that the app's own certificate checks run there. The full listing is long on a real device, so capture only the lines you need for notes. Base addresses change across runs and reboots, so treat them as session-specific.

Does Objection work without root?

This tutorial uses rooted frida-server. That is the simplest lab path on Genymotion.

Without root, a common alternative is Frida Gadget. For a lab APK, that often means embedding Gadget into an authorized repackaged build; if you control the app itself, Gadget can instead be included in the test build. Connect with Objection or Frida once the Gadget listener is up. Objection exposes an objection patchapk helper for the rebuild flow, but Gadget wiring, ABI choice, and signing belong in the Frida Android tutorial and Frida's Gadget documentation.

Use Gadget only when your rules of engagement allow a modified or purpose-built training build and root on the guest is out of scope.

When Objection is not enough

Use Objection for fast runtime exploration and built-in hooks. Switch to custom Frida when you need application-specific Java or native hooks. Use Burp Suite Android HTTPS interception for network traffic and MobSF app pentesting or other static tools for manifest and code findings.

That split keeps the first-pass work quick without turning every mobile assessment into a custom scripting project on day one.

Troubleshoot Objection and Frida errors

Summary

Objection gives Android pentesters a Frida-backed REPL with ready-made exploration commands. After you install objection and frida-tools on Kali and run a matching frida-server on a rooted Genymotion device, objection -n com.insecureshop -S 192.168.56.103:5555 start opens a session against InsecureShop. From there, env and filesystem commands expose storage paths, component lists reveal activities and receivers, and android hooking watch confirms method invocations when you trigger them in the app.

Built-in jobs such as android sslpinning disable and android root disable register Frida hooks quickly, but a registered job is only a starting point. When pins, root checks, or business logic survive those jobs, extend the same class names into custom Frida scripts and use Burp alongside Frida when you need to inspect the resulting HTTPS traffic. Objection is the fast layer; Frida remains the engine underneath.

References

• Objection (sensepost/objection)
• Using Objection (sensepost wiki)
• Frida documentation
• Frida JavaScript API
• MASTG-TOOL-0038: Objection (OWASP MAS)