SSL Pinning and Bypass

To audit a mobile app you need to see its traffic with the backend: that’s where the API, tokens, and real logic live. The usual approach is to put a proxy (Burp) between the app and the server. But many apps implement SSL/certificate pinning: they trust only a specific certificate, rejecting your proxy’s even if you install its CA. Bypassing pinning is an almost-mandatory step in mobile pentesting to intercept and manipulate traffic.

Intercept traffic (the basics, without pinning)

1. Set up Burp/ZAP as a proxy (computer IP:8080)
2. On the device: WiFi -> manual proxy pointing to Burp
3. Install Burp's CA as trusted
   # Android 7+: apps do NOT trust user CAs by default
   #   -> install as a system CA (root) or use the app's networkSecurityConfig
   # iOS: install the CA profile and trust it in Settings
4. HTTPS traffic goes through Burp -> you see and modify requests

On Android 7+, even if you install the CA, apps trust only system CAs by default → you need root (system CA) or to modify the app’s networkSecurityConfig (repackaging).

What pinning is and why it blocks

Pinning “pins” the legitimate server’s certificate (or its hash/public key) into the app. On connecting, the app compares the presented certificate to the pinned one; if it doesn’t match (like your proxy’s), it drops the connection. It protects against MITM, but it’s not unbeatable on a device you control.

SSL pinning bypass

Objection / Frida (fastest)

# Objection: disable pinning with one command
objection -g com.target.app explore
android sslpinning disable        # (or: ios sslpinning disable)
# Frida: universal bypass scripts
frida -U -f com.target.app -l frida-multiple-unpinning.js --no-pause

Scripts like frida-multiple-unpinning (httptoolkit) cover the most common pinning libraries (OkHttp, TrustKit, etc.) at once.

Repackaging (no root/runtime Frida)

# Android: decompile, modify networkSecurityConfig / remove pinning, rebuild, sign
apktool d app.apk
# edit res/xml/network_security_config.xml to trust user CAs
apktool b ; apksigner sign ...
# or inject the Frida gadget (objection patchapk)

Other approaches

# replace the validation logic with a custom Frida hook (hook the verifier)
# for native pinning (in .so): hook the SSL library's functions

After bypassing pinning

With traffic visible in Burp, the app becomes just another client of its API → the whole Web section applies (auth, IDOR/BOLA, injection, business logic, API Top 10). The backend is the real target.

For the defense

Pinning is defense in depth, not absolute: an attacker with the device bypasses it with Frida. Useful against network MITM, not against a determined analyst.
Real security is in the backend: server-side authentication, authorization, and validation; don’t trust the client.
Combine with RESILIENCE (Frida/instrumentation detection, integrity) to raise the bypass cost.
Use public-key pinning (not a specific certificate) so rotations don’t break; plan its updates.

Testing checklist

Set up proxy (Burp) + CA on the device
Android 7+: system CA (root) or networkSecurityConfig
Does the app pin? (the connection fails with the proxy)
Bypass with Objection (sslpinning disable)
Bypass with a universal Frida script (multiple-unpinning)
Repackaging if Frida isn’t viable
Traffic visible → audit the API (Web section)
Document captured tokens/endpoints/flows