/android-pentest

Example: Authentication Bypass

Goal: find logic flaws in login, biometric, and session handling.

Tool-call blueprint

frida_run_script(pid, "credential_hooks.js")
frida_run_script(pid, "biometric_bypass.js")
frida_hook_method(pid, "com.megabank.mobile.auth.SessionManager", "*")
frida_run_script(pid, """
Java.perform(function() {
    var JWT = Java.use('com.auth0.jwt.JWT');
    JWT.decode.implementation = function(t) { console.log('[JWT] ' + t); return this.decode(t); };
});
""")

Observations to flag

• credential_hooks.js: password written to SharedPreferences, token appears in Authorization: Bearer … header
• biometric_bypass.js: BiometricPrompt.authenticate() success callback invoked without server verification → bypass
• SessionManager.*: validateSession() only checks local JWT expiry; refreshSession() skips server round-trip
• JWT decode: alg=HS256 with low-entropy secret, claims include account_id, role, permissions

Findings table

UI-driven repro

Use Mobile MCP get_screen_state → tap_element to replay the biometric prompt while hooks are active; capture a screenshot at the unlocked-home state as evidence.