Performing Mobile App Certificate Pinning Bypass

When to Use

Use this skill when:

• Mobile app refuses connections through a proxy due to certificate pinning
• Performing authorized security testing requiring HTTPS traffic interception
• Assessing the strength and bypass difficulty of pinning implementations
• Evaluating defense-in-depth of mobile app network security

Do not use to bypass pinning on apps without explicit testing authorization.

Prerequisites

• Burp Suite configured as proxy with listener on all interfaces
• Rooted Android device or jailbroken iOS device
• Frida server running on target device
• Objection installed (pip install objection)
• Target app installed and reproducing the pinning behavior

Workflow

Step 1: Identify Pinning Implementation

Android pinning methods to identify:

1. Network Security Config (res/xml/network_security_config.xml)
   <pin-set> with certificate hash pins

2. OkHttp CertificatePinner
   CertificatePinner.Builder().add("api.target.com", "sha256/...")

3. Custom TrustManager
   X509TrustManager overrides in code

4. Third-party libraries
   - TrustKit
   - Certificate Transparency checks

iOS pinning methods:

1. NSURLSession delegate (URLSession:didReceiveChallenge:)
2. ATS (App Transport Security) with custom trust evaluation
3. TrustKit framework
4. Alamofire ServerTrustPolicy
5. Custom SecTrust evaluation

Step 2: Bypass with Objection (Quickest Approach)

# Android
objection --gadget com.target.app explore
android sslpinning disable

# iOS
objection --gadget com.target.app explore
ios sslpinning disable

Objection hooks common pinning implementations including OkHttp CertificatePinner, TrustManagerImpl, NSURLSession delegate methods, and SecTrust evaluation.

Step 3: Bypass with Custom Frida Scripts

Android - Universal SSL Pinning Bypass:

// android_ssl_bypass.js
Java.perform(function() {
    // Bypass TrustManagerImpl
    var TrustManagerImpl = Java.use("com.android.org.conscrypt.TrustManagerImpl");
    TrustManagerImpl.verifyChain.implementation = function(untrustedChain, trustAnchorChain,
        host, clientAuth, ocspData, tlsSctData) {
        console.log("[+] Bypassing TrustManagerImpl for: " + host);
        return untrustedChain;
    };

    // Bypass OkHttp3 CertificatePinner
    try {
        var CertificatePinner = Java.use("okhttp3.CertificatePinner");
        CertificatePinner.check.overload("java.lang.String", "java.util.List").implementation =
            function(hostname, peerCertificates) {
                console.log("[+] Bypassing OkHttp3 pinning for: " + hostname);
                return;
            };
    } catch(e) {}

    // Bypass custom X509TrustManager
    var X509TrustManager = Java.use("javax.net.ssl.X509TrustManager");
    var TrustManager = Java.registerClass({
        name: "com.bypass.TrustManager",
        implements: [X509TrustManager],
        methods: {
            checkClientTrusted: function(chain, authType) {},
            checkServerTrusted: function(chain, authType) {},
            getAcceptedIssuers: function() { return []; }
        }
    });

    // Bypass SSLContext
    var SSLContext = Java.use("javax.net.ssl.SSLContext");
    SSLContext.init.overload("[Ljavax.net.ssl.KeyManager;",
        "[Ljavax.net.ssl.TrustManager;", "java.security.SecureRandom").implementation =
        function(km, tm, sr) {
            console.log("[+] Replacing TrustManagers in SSLContext.init");
            this.init(km, [TrustManager.$new()], sr);
        };

    // Bypass NetworkSecurityConfig (Android 7+)
    try {
        var NetworkSecurityConfig = Java.use(
            "android.security.net.config.NetworkSecurityConfig");
        NetworkSecurityConfig.isCleartextTrafficPermitted.implementation = function() {
            return true;
        };
    } catch(e) {}

    console.log("[*] SSL pinning bypass loaded");
});

frida -U -f com.target.app -l android_ssl_bypass.js --no-pause

iOS - Universal SSL Pinning Bypass:

// ios_ssl_bypass.js
if (ObjC.available) {
    // Bypass NSURLSession delegate
    var resolver = new ApiResolver("objc");
    resolver.enumerateMatches(
        "-[* URLSession:didReceiveChallenge:completionHandler:]", {
        onMatch: function(match) {
            Interceptor.attach(match.address, {
                onEnter: function(args) {

…