Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
Assessing the strength and bypass difficulty of pinning implementations
Evaluating defense-in-depth of mobile app network security
Do not use to bypass pinning on apps without explicit testing authorization.
Most Often Missed & How to Confirm
Multi-layer pinning — Objection's bypass clears OkHttp but a custom TrustManager still blocks. Confirm by checking traffic actually reaches Burp; if not, hook the remaining layer.
Native/binary-level pinning — Java/ObjC hooks miss C/C++ validation. Confirm with frida-trace on *Trust*/*SSL* exports and Interceptor.attach at the native address.
Certificate Transparency checks — confirm CT is the blocker (not pinning) by observing CT-specific rejections and bypassing it separately.
Dynamic pin updates (TrustKit) — the app fetches fresh pins from a server. Confirm by monitoring for pin-rotation requests during a long session.
NetworkSecurityConfig pin-set — confirm by decompiling and reading res/xml/network_security_config.xml for <pin-set>.
Bypass success itself — always confirm by completing an authenticated flow and seeing every request in Burp, including background/API calls.
Prerequisites
Burp Suite configured as proxy with listener on all interfaces
Rooted Android device or jailbroken iOS device
Frida server running on target device
Objection installed (pip install objection)
Target app installed and reproducing the pinning behavior
Objection hooks common pinning implementations including OkHttp CertificatePinner, TrustManagerImpl, NSURLSession delegate methods, and SecTrust evaluation.
For apps using advanced pinning (TrustKit, custom binary checks):
# Identify the specific pinning library
frida-trace -U -n TargetApp -m "*[*Trust*]" -m "*[*Pin*]" -m "*[*SSL*]" -m "*[*Certificate*]"# Hook the identified validation function# Custom Frida script targeting the specific implementation
Step 5: Verify Bypass Success
After applying the bypass:
Configure device proxy to Burp Suite
Open target app and navigate through authenticated flows
Verify HTTPS traffic appears in Burp Suite HTTP History
Check for any remaining pinned connections that are not captured
Key Concepts
Term
Definition
Certificate Pinning
Restricting accepted server certificates to a known set, preventing MITM via rogue CA certificates
Public Key Pinning
Pinning the server's public key hash rather than the full certificate, surviving certificate rotation
Network Security Config
Android XML configuration for declaring trust anchors, pins, and cleartext policy per-domain
TrustKit
Open-source library implementing certificate pinning with reporting for both Android and iOS
HPKP Deprecation
HTTP Public Key Pinning header was deprecated in browsers but concept persists in mobile apps
Tools & Systems
Objection: Pre-built pinning bypass for common libraries (OkHttp, NSURLSession, TrustKit)
Frida: Custom JavaScript hooks targeting specific pinning implementations
apktool: APK decompilation for identifying pinning in Network Security Config
SSLUnpinning (Xposed): Xposed framework module for system-wide pinning bypass on Android
ssl-kill-switch2: iOS tweak for disabling SSL pinning system-wide on jailbroken devices
Common Pitfalls
Certificate transparency: Some apps check CT logs in addition to pinning. May need to bypass CT verification separately.
Multi-layer pinning: Apps may implement pinning at multiple levels (OkHttp + custom TrustManager). Bypass all layers.
Binary-level pinning: Some apps validate certificates in native C/C++ code, which requires Interceptor.attach at native function addresses rather than Java/ObjC hooks.
Dynamic pinning updates: Apps using TrustKit or similar may fetch updated pins from a server. Monitor for pin rotation during testing.
