Looking for a specialist in Android security or reverse engineering to set up a testing environment and analyze the behavior of the Android application (Instacart) in order to study the operation of protection, network requests, and the user verification mechanism.
Project goal:
• Gain access to the protected API of the Instacart application.
• Extract the identity verification link that is generated within the application through the service veriff.me.
• It is known that one of the bot systems already automatically receives this link — it is necessary to reproduce this process manually using traffic analysis and application behavior.
Tasks:
1. Setting up the emulator:
• Launch an Android emulator with root access (preferably through Android Studio + custom AOSP image).
• Install and configure Magisk (including Zygisk, SELinux permissive).
• Install and run the Instacart application (via Google Play or APK).
2. Instrumentation with Frida:
• Connect frida-server and develop a script for bypassing:
• Root checks
• Emulator checks
• Debugging / Frida
• Signature and installation source checks
• (Optional) Play Integrity API
3. Traffic interception (Charles Proxy):
• Install the Charles certificate in the system store using Magisk.
• Set up HTTPS MITM proxy.
• Intercept traffic, including requests to grapevine.instacart.com and magic.us.veriff.me.
4. Analysis and logging:
• Find the moment when the application generates the identity verification link.
• Extract and log the point (GET/POST request or WebView) of link generation.
Expected result:
• Working emulator environment with root and Magisk.
• Working Frida script for bypassing protections.
• Successful interception of HTTPS traffic through Charles.
• Verification link obtained (veriff.me).
• Brief instruction on reproducing the environment (if desired).
Important:
The project is of a research and educational nature. It is not used for the purpose of violating rules or abusing the application.