Mobile SSL pinning bypass playbook. Use when intercepting HTTPS traffic from mobile applications that implement certificate pinning, public key pinning, or SPKI hash pinning on Android and iOS, including React Native, Flutter, and Xamarin frameworks.

SKILL: Mobile SSL Pinning Bypass — Expert Attack Playbook AI LOAD INSTRUCTION : Expert SSL pinning bypass techniques for mobile platforms. Covers Android and iOS bypass methods (Frida, Objection, Xposed, SSL Kill Switch), framework specific bypasses (Flutter, React Native, Xamarin), and troubleshooting non standard pinning implementations. Base models miss framework specific hook points and multi layer pinning configurations. 0. RELATED ROUTING Before going deep, consider loading: [android pentesting tricks](../android pentesting tricks/SKILL.md) for broader Android testing beyond SSL bypass [ios pentesting tricks](../ios pentesting tricks/SKILL.md) for broader iOS testing beyond SSL bypass [api sec](../api sec/SKILL.md) once traffic is intercepted for API level testing 1. SSL PINNING TYPES Pinning Type What Is Pinned Resilience Common In Certificate pinning Exact leaf certificate (DER/PEM) Low (breaks on cert rotation) Legacy apps Public key pinning Subject Public Key Info Medium (survives cert renewal if key unchanged) Modern apps SPKI hash pinning SHA 256 of SPKI Medium (same as public key) OkHttp, AFNetworking CA pinning Intermediate or root CA cert High (any cert from that CA works) Enterprise apps Multi pin (backup pins) Primary + backup pins High (fallback pins) HPKP aware apps How Pinning Works 2. ANDROID BYPASS METHODS 2.1 Frida Universal SSL Bypass 2.2 Objection (One Command) 2.3 Network Security Config (Debug Override) Workflow: decompile APK → add/modify config → repackage → re sign → install. 2.4 Xposed / LSPosed Modules Module Method Scope Root Required JustTrustMe Hooks TrustManager + OkHttp Per app Yes (Xposed) SSLUnpinning Hooks certificate validation Per app Yes (LSPosed) TrustMeAlready Global TrustManager bypass System wide Yes (LSPosed) 2.5 Magisk + System CA Installation 2.6 Manual Decompile → Patch → Repackage 3. iOS BYPASS METHODS 3.1 Frida (SecTrust Hooks) 3.2 Objection (One Command) 3.3 SSL Kill Switch 2 (Jailbreak Tweak) 3.4 Library Specific Hooks Library iOS Hook Point Frida Approach AFNetworking AFSecurityPolicy.evaluateServerTrust:forDomain: Return YES Alamofire ServerTrustManager.evaluate( :forHost:) Skip evaluation TrustKit TSKPinningValidator verifyPublicKeyPin: Return success NSURLSession URLSession:didReceiveChallenge:completionHandler: Call completionHandler with .useCredential 3.5 Manual Binary Patch 4. FRAMEWORK SPECIFIC BYPASSES 4.1 Flutter Flutter uses Dart's dart:io library with BoringSSL underneath. Standard Frida hooks on Java/ObjC layers don't work. reflutter tool (recommended for Flutter apps): 4.2 React Native React Native uses platform networking: OkHttp on Android, NSURLSession on iOS. Platform Networking Stack Bypass Method Android OkHttp3 Standard OkHttp CertificatePinner hook iOS NSURLSession Standard SecTrust hooks Android (Hermes) Same OkHttp Same hooks, but Hermes JIT may need additional handling 4.3 Xamarin 5. CERTIFICATE TRANSPARENCY & HPKP Technology Status Impact on Testing Certificate Transparency (CT) Active, enforced by browsers Mobile apps rarely enforce CT; not a bypass obstacle HPKP (HTTP Public Key Pinning) Deprecated (2018) Legacy apps may still check; remove header from proxy response Expect CT header Deprecated (2024) Minimal impact on mobile testing CT in mobile apps Rare Only Google apps enforce via custom CT checks 6. TROUBLESHOOTING 6.1 Common Failures Symptom Cause Fix Bypass script loaded but traffic still fails Multiple pinning layers Hook ALL layers: TrustManager + OkHttp + custom checks "Client certificate required" Mutual TLS (mTLS) Extract client cert from app bundle/keychain, import into proxy Connection works but no HTTP traffic Non HTTP protocol (MQTT, gRPC, WebSocket) Use Wireshark or protocol specific proxy App crashes after bypass Anti tampering detects hooks Bypass integrity checks first, then SSL Proxy CA not trusted Android 7+ user CA restrictions Install CA as system cert (Magisk module) Flutter app ignores hooks BoringSSL not hooked at native layer Use reflutter or native BoringSSL hooks Certificate chain validation timeout OCSP stapling mismatch Disable OCSP checks or mock OCSP responder 6.2 Diagnostic Steps 7. SSL PINNING BYPASS DECISION TREE 8. PROXY SETUP QUICK REFERENCE Proxy Tool Best For SSL Bypass Integration Burp Suite Full HTTP analysis Import CA to device mitmproxy Scripted interception mitmproxy set confdir=~/.mitmproxy Charles Proxy macOS native, easy setup Built in CA installation Proxyman macOS/iOS native Direct iOS device support HTTP Toolkit Quick Android setup Automated CA + Frida bypass

mobile-ssl-pinning-bypass