ssl-pinning-bypass

name	SSL Pinning Bypass
description	SSL certificate pinning detection and bypass for mobile apps
tags	["ssl","pinning","mobile","android","ios","frida","https"]
allowed_tools	["detect_ssl_pinning_impl","get_ssl_bypass","search_strings","list_imports"]

Task: SSL Pinning Bypass. Detect and bypass SSL certificate pinning in mobile/desktop applications.

Detection Goals

1. Identify SSL Pinning Implementation

   • Framework used (OkHttp, AFNetworking, etc.)
   • Pinning method (certificate, public key, hash)
   • Pinning scope (domain, certificate chain)
   • Enforcement level

2. Assess Bypass Difficulty

   • Easy: Network Security Config modification
   • Medium: Frida/objection scripts
   • Hard: Runtime patching, reverse engineering

Android SSL Pinning

Framework Detection

OkHttp CertificatePinner

Indicators:
- CertificatePinner class usage
- .certificatePinner() in OkHttpClient builder
- "certificatepinner" strings

Detection:
- Search for CertificatePinner imports
- Look for hash strings (SHA-256, SHA-1)
- Check for pinned domains

Bypass:
1. Frida: frida-ssl-pin-bypass
2. Patch: Remove certificatePinner from builder
3. Hook: CertificatePinner.check() method

TrustManager Implementation

Indicators:
- X509TrustManager interface
- checkServerTrusted() method
- getAcceptedIssuers() method

Detection:
- Find custom TrustManager implementations
- Look for certificate validation logic

Bypass:
1. Frida: android-ssl-pinning-bypass
2. Hook: X509TrustManager.checkServerTrusted()
3. Implement: TrustManager that accepts all certificates

Network Security Config

Indicators:
- network_security_config.xml
- android:networkSecurityConfig attribute
- Certificate overlays

Detection:
- Check APK resources
- Look for config files

Bypass:
1. Modify XML: Add <base-config cleartextTrafficPermitted="true">
2. Add debug-overrides: <domain-config cleartextTrafficPermitted="true">
3. Repackage APK

iOS SSL Pinning

NSURLSession/NSURLSessionDelegate

Indicators:
- didReceiveChallenge delegate method
- URLAuthenticationChallenge handling
- Server trust evaluation

Detection:
- Find didReceiveChallenge implementations
- Look for SecTrustEvaluate calls

Bypass:
1. objection: ios sslpinning disable
2. Frida: ios-ssl-kill-switch
3. Hook: NSURLSessionDelegate methods

AFNetworking/AFSecurityPolicy

Indicators:
- AFSecurityPolicy class
- pinningMode property
- validateCertificateChain method

Detection:
- Search for AFSecurityPolicy usage
- Look for pinned certificate hashes

Bypass:
1. Patch: Set pinningMode to AFSSLPinningModeNone
2. Hook: AFSecurityPolicy.validateCertificateChain()
3. Frida: frida-afnetworking-bypass

Alamofire

Indicators:
- ServerTrustPolicy class
- pinPublicKeys methods
- evaluateServerTrust closures

Detection:
- Find Alamofire integration
- Look for trust evaluators

Bypass:
1. objection: ios sslpinning disable
2. Hook: ServerTrustPolicy evaluators
3. Modify: Evaluators to return true

Desktop Applications

OpenSSL

Indicators:
- SSL_CTX_set_verify calls
- X509_verify_cert
- SSL_CTX_load_verify_locations

Bypass:
1. Hook: SSL_CTX_set_verify with SSL_VERIFY_NONE
2. Hook: X509_verify_cert to return 1
3. LD_PRELOAD: Custom libssl

curl

Indicators:
- CURLOPT_SSL_VERIFYPEER
- CURLOPT_SSL_VERIFYHOST
- CURLOPT_CAINFO

Bypass:
1. Patch: Set CURLOPT_SSL_VERIFYPEER to 0
2. Hook: curl_easy_setopt for SSL options

Bypass Tools

Frida Scripts

// Universal Android SSL pinning bypass
frida -U -l frida-ssl-unpinning.js -f com.app.package

// Specific framework bypass
// OkHttp
Java.perform(function() {
    var OkHttpClient = Java.use("okhttp3.OkHttpClient");
    // Modify certificatePinner
});

// TrustManager
Java.perform(function() {
    var TrustManager = Java.use("javax.net.ssl.X509TrustManager");
    // Implement accept-all TrustManager
});

Objection Commands

# iOS SSL pinning disable
objection --gadget com.app.package explore
ios sslpinning disable

# Android with root
objection --gadget com.app.package explore
android sslpinning disable

Runtime Patching

# Python Frida example
import frida

session = frida.get_usb_device().attach("com.app.package")
script = session.create_script("""
    // SSL pinning bypass script
""")
script.on('message', on_message)
script.load()

Analysis Workflow

1. Detection Phase

   • Run detect_ssl_pinning_impl() for full analysis
   • Identify all SSL pinning implementations
   • Map pinned domains and certificates

2. Assessment Phase

   • Determine enforcement level
   • Check for anti-tampering
   • Assess bypass difficulty

3. Bypass Phase

   • Use get_ssl_bypass() for specific techniques
   • Test bypass methods in order of ease:
     1. Config modification
     2. Frida/objection
     3. Runtime hooking
     4. Binary patching

4. Verification Phase

   • Intercept TLS traffic with Burp/Charles
   • Confirm certificate validation is bypassed
   • Test all pinned domains

Common Issues

Root/Jailbreak Detection

• SSL bypass may fail if root is detected
• Bypass root detection first
• Use root-hide tools

Certificate Pinning + Certificate Transparency

• CT may validate even after pin bypass
• Disable CT verification

Multiple Pinning Implementations

• App may use multiple frameworks
• Bypass each implementation
• Use comprehensive Frida script

Report Format

[SSL Pinning] Framework Detection
Framework: OkHttp CertificatePinner
Pinning Type: Certificate hash (SHA-256)
Enforcement: High (validates on every connection)

[Detection Details]
- Class: okhttp3.CertificatePinner
- Method: check(address, List)
- Pinned Domains: api.example.com, *.example.com
- Certificate Hashes: 3 found

[Bypass Method]
Tool: Frida
Script: frida-ssl-unpinning.js
Success Rate: 95%

[POC]
frida -U -f com.app.package -l ssl_bypass.js
# Intercept traffic with proxy
Confirmed: TLS interception successful

Severity: HIGH (Bypass requires runtime instrumentation)