InterceptReady is an automated toolkit for configuring Android emulators with Frida and Burp Suite for mobile security testing.
InterceptReady automates the setup of Android emulators for security testing by installing Frida, configuring Burp Suite certificates, and setting up proxy settings. The script handles all the complex tasks required to prepare a fully-functional mobile testing environment.
This toolkit includes both the setup script (InterceptReady.sh) and an enhanced SSL pinning bypass script (ssl_pinning_bypass.js) with intelligent handling of various SSL pinning implementations.
- Frida Integration - Installs and configures Frida on both host and emulator
- Certificate Installation - Automatically installs Burp Suite CA certificate
- Proxy Configuration - Sets up system-wide proxy for traffic interception
- Writable System - Configures emulator with writable system partition
- Root Access - Enables root access for comprehensive testing
- Multiple Emulator Support - Works with any Android emulator
- Python Environment - Creates isolated virtual environment for Frida tools
- Auto-detection - Identifies SDK location and emulator architecture
- Watchdog Timer - Detects application hanging and switches to minimal bypass
- Staggered Execution - Progressive implementation of bypasses to maximize stability
- Error Recovery - Robust error handling prevents application crashes
- Resource Optimization - Limits processing to prevent performance issues
- Multiple Bypass Methods - Targets various SSL implementation libraries:
- OkHttp3 Certificate Pinning
- TrustManager (Android System)
- X509TrustManager
- SSLContext/SSLSocket implementations
- Conscrypt
- JSSE Provider
- Appcelerator Titanium
- WebView Certificate Handlers
| OS | Compatibility | Feature Support |
|---|---|---|
| macOS | ✅ | Full support |
| Linux | ✅ | Full support |
- Android Studio with at least one emulator
- Python 3.x installed
- Burp Suite running with exported certificate
# Clone the repository
git clone https://github.com/xbz0n/InterceptReady.git
cd InterceptReady
# Make the script executable
chmod +x InterceptReady.sh
# Run the installer
./InterceptReady.sh# Complete setup
./InterceptReady.sh
# Proxy management only
./InterceptReady.sh proxy
# Clear proxy settings
./InterceptReady.sh clear-proxyOnce setup is complete, you can use the included SSL pinning bypass script:
# With interactive mode
frida -U -l ssl_pinning_bypass.js <app_package_name>
# With spawn mode for problematic apps
frida -U -l ssl_pinning_bypass.js -f <app_package_name> --no-pause
# With V8 runtime for better stability if the app hangs
frida -U -l ssl_pinning_bypass.js <app_package_name> --runtime=v8- Checks for required tools and dependencies
- Detects or starts Android emulator with writable system
- Enables root access and remounts system partition
- Installs Burp Suite certificate in system store
- Configures proxy settings based on local IP address
- Creates Python virtual environment and installs Frida tools
- Downloads and installs appropriate Frida server on emulator
- Tests the connection between host and emulator
The script employs several strategies to bypass certificate validation:
- Android System TrustManager: Replaces the system's X509TrustManager with a version that trusts all certificates
- OkHttp Client: Targets OkHttp3's CertificatePinner class to bypass built-in pinning
- SSLContext Manipulation: Modifies the SSLContext creation to use permissive TrustManagers
- WebView Certificate Handling: Overrides WebView certificate verification callbacks
- Java Secure Socket Extension (JSSE): Hooks into the JSSE provider's certificate validation
Each bypass is executed in a staged manner with appropriate error handling to ensure maximum application stability.
| Function | Description |
|---|---|
| Android SDK Detection | Automatically locates Android SDK installation |
| Emulator Management | Starts emulator with writable system and proper permissions |
| Certificate Installation | Handles certificate installation for various Android versions |
| Proxy Configuration | Sets global proxy and network properties for complete interception |
| Frida Setup | Installs appropriate Frida server version matching client tools |
| SSL Pinning Bypass | Provides enhanced SSL pinning bypass with intelligent recovery mechanisms |
Recent enhancements to the SSL pinning bypass script include:
- Intelligent Timeout Detection: Watches for application hanging and switches to minimal bypass mode
- Error Recovery: Continues operation even if individual bypasses fail
- Global Exception Handler: Catches and logs unhandled exceptions
- Resource Management: Limits enumeration to prevent excessive CPU/memory usage
- Enhanced Logging: Better diagnostic information for troubleshooting
- Ensure Android Studio is properly installed with platform tools
- Verify Burp Suite is running with the certificate exported as DER format
- Check that the emulator has internet connectivity
- Examine adb and Frida outputs for specific error messages
If the application hangs:
- Try V8 Runtime: Use the
--runtime=v8flag to run with the V8 JavaScript engine - Use Spawn Mode: Try attaching to the application at launch with
-fflag - Check Logs: Examine the script output for specific errors
- Reduce Scope: Modify the script to disable specific bypasses if they cause problems
- Some applications may detect Frida and implement anti-tampering mechanisms
- Applications using native (C/C++) SSL implementations may require additional bypasses
- Heavy obfuscation might require customized hooks and class name identification
Contributions are welcome! Please feel free to submit a Pull Request.
This project is licensed under the MIT License - see the LICENSE file for details.
- The Frida project for their excellent dynamic instrumentation toolkit
- The OWASP Mobile Security Testing Guide for mobile security best practices
- The mobile security testing community for inspiration and techniques