8ksec FactsDroid

A walkthrough of bypassing root detection and TLS pinning in a Flutter-based Android app, then intercepting network traffic to complete the challenge.

AndroidFlutterFridaBurp SuiteiptablesTLS Bypass

Step 1

Install & Launch the App

First, download the APK and install it on your Android device using ADB:

adb install FactsDroid.apk

Open the app. You’ll see two buttons — Random Facts and High-Rated. When you press Random Facts, the app returns an error:

Failed to fetch fact. API might be down

This isn’t a server issue. The app has two protections blocking us: root detection and TLS pinning. We need to bypass both.

Step 2

Bypass #1 — Root Detection

Running the app on a rooted device triggers the root check. We can confirm this by inspecting the APK in jadx-gui and searching for isDeviceRooted — the method is called at startup.

To bypass it, we use this Frida script from Codeshare:

fridantiroot — Frida Codeshare

codeshare.frida.re/@dzonerzy/fridantiroot

frida -U "FactsDroid" -l fridantiroot.js

Root detection is now bypassed. The app no longer blocks rooted devices.

Step 3

Identify the Framework

Before tackling TLS pinning, we need to confirm the app is built with Flutter. Open it in jadx-gui and search for flutter — you'll find Flutter-specific classes and packages throughout, which confirms it.

This matters because Flutter apps use their own networking stack (BoringSSL), which completely ignores the Android system proxy and system certificate store. Standard Burp Suite setup won’t work here.

Step 4

Bypass #2 — TLS/SSL Pinning

For Flutter TLS bypass, we use this Frida script which patches the internal ssl_verify_peer_cert function in libflutter.so at runtime:

disable-flutter-tls-v1 — Frida Codeshare

codeshare.frida.re/@TheDauntless/disable-flutter-tls-v1

Now run both scripts together and to start codeshare in one commend there are small trick copy code from codeshare and save as js and use it do not use two — codeshare in one command because one of them will work only . The app can make network requests and we can intercept them.

Step 5

Redirect Traffic with iptables

Since Flutter ignores the Android system proxy, we use iptables DNAT to force all HTTP and HTTPS traffic from the device to our Burp Suite instance. Run these as root in an ADB shell:

# Replace 192.168.1.7 with your machine's IP

iptables -t nat -A OUTPUT -p tcp --dport 80  -j DNAT --to-destination 192.168.1.7:8081
iptables -t nat -A OUTPUT -p tcp --dport 443 -j DNAT --to-destination 192.168.1.7:8081

This redirects all outgoing TCP traffic on ports 80 and 443 to Burp Suite listening on port 8080 on your machine.

Step 6

Full POC — Intercept the Request

Now run the full proof of concept with both Frida scripts active and Burp Suite listening:

frida -U "FactsDroid" -l fridantiroot.js -l disable-flutter-tls.js

Press Random Facts in the app. Burp Suite will now capture the request:

!! click on checkbox of invisible traffic in burp!!

GET /api/v2/facts/random HTTP/2
Host: uselessfacts.jsph.pl
User-Agent: Dart/3.7 (dart:io)

And the response:

{
  "id": "e5255a3e28b8b10516c8188aafc3bdd2",
  "text": "A dragonfly has a lifespan of 24 hours.",
  "source": "djtech.net",
  "language": "en"
}

We have full visibility into the app’s traffic. Both protections — root detection and TLS pinning — are successfully bypassed. Challenge complete ✓

Cleanup: To restore the device’s network rules after you’re done, flush the NAT table: iptables -t nat -F