After this lesson, you will be able to: Use Frida for runtime instrumentation and intercept mobile traffic with Burp Suite and a proxy certificate, then identify vulnerabilities in a deliberately vulnerable app.
Dynamic analysis runs the app and observes or modifies its behavior live. This lesson covers intercepting mobile traffic with Burp (and the certificate problem), runtime instrumentation with Frida, and common findings: certificate-pinning bypass, insecure communication, and improper session handling.
To see what an app sends, route its traffic through Burp Suite as a proxy. The catch is HTTPS: the device must trust Burp's CA certificate to decrypt TLS, so you install Burp's certificate on your test device/emulator. Once trusted, you see the app's API calls in cleartext and can find insecure endpoints, leaked data, and weak authentication. On modern Android, user-installed CAs are not trusted by apps by default, which is itself a defense you may need to work around on a device you control.
Well-built apps pin their server certificate, so even your trusted Burp CA is rejected and interception fails. This is a good defense. To test a pinned app you own, you bypass pinning at runtime with Frida, which hooks the app's certificate-validation function and forces it to accept your proxy. The point is to understand both sides: pinning protects users, and a determined tester with a controlled device can still bypass it, so pinning is a strong layer but not absolute.
Frida injects a JavaScript engine into a running app so you can hook and modify functions live: read arguments, change return values, bypass checks, and dump data. Security testers use it to bypass root detection, defeat certificate pinning, and observe internal behavior that static analysis cannot reveal. It is the workhorse of mobile dynamic analysis.
Emulator, Burp, Frida.
1. Run a deliberately vulnerable app (InjuredAndroid or an OWASP MAS app) on an emulator you control.
2. Configure the emulator to proxy through Burp and install Burp's CA certificate.
3. Observe the app's API traffic in Burp; look for cleartext sensitive data or weak auth tokens.
4. If traffic does not appear and the app pins certificates, use a Frida script to bypass pinning, then re-observe.
5. Document findings (insecure communication, a recoverable token, a bypassed check) and the corresponding fixes (proper TLS, server-side checks, secure storage).
Pick one.
Forgetting modern Android distrusts user CAs by default and concluding the app is 'unhackable.' Disabling pinning in production to make testing easier (never ship that). Running Frida against apps you do not own. Confusing 'I bypassed pinning on my own device' with 'pinning is useless' (it still protects ordinary users). Not pairing each finding with a concrete remediation.
Sign in and purchase access to unlock this lesson.