Bypass Certificate Pinning On Android Apps With Frida

Certificate pinning is a security concept that helps protect a mobile app from man-in-the-middle (MITM) attack attempts by limiting the devices it will trust to only those with specific certificates. As an attacker, this can be incredibly frustrating since you are unable to intercept or manipulate the traffic between the mobile app and its backend server. Fortunately, there is a way around this limitation by using a tool called Frida. In this blog post, we’ll look at how to bypass certificate pinning on Android apps using Frida step-by-step.

What is Certificate Pinning?

Certificate pinning is a security measure that allows an app to bind to a specific certificate or public key. This ensures that the app only communicates with servers that possess the corresponding private key. Certificate pinning can help prevent man-in-the-middle attacks, in which an attacker intercepts and tampers with communications between an app and a server.

When an app is configured to use certificate pinning, it will reject any server certificates that don't match the expected value. This can be problematic for security testing, because it's often necessary to intercept and modify traffic in order to assess an app's security.

Fortunately, there's a tool called Frida that can bypass certificate pinning on Android apps. In this article, we'll show you how to use Frida to bypass certificate pinning on two popular Android apps: WhatsApp and Snapchat.

Why Would You Want to Bypass Certificate Pinning?

There are a few reasons why you might want to bypass certificate pinning on an Android app. Maybe you're trying to debug the app and need to intercept its traffic. Or maybe you're trying topentest the app and need to bypass security measures like certificate pinning.

In any case, bypassing certificate pinning can be a useful technique. And with Frida, it's relatively easy to do. In this article, we'll show you how to bypass certificate pinning on an Android app using Frida.

What is Frida?

Frida is a dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. 

In this article, we’ll show you how to use Frida to bypass certificate pinning on Android applications. 

If an attacker is able to intercept and modify the traffic between the app and the server, they could present a forged certificate and potentially gain access to sensitive data. By bypassing certificate pinning, we can observe the traffic passing through the app and look for any potential vulnerabilities.

To use Frida, we first need to install it on our computer. We can do this using pip:

pip install frida

Once Frida is installed, we need to download the latest version of the Frida Server from their website. The server needs to be extracted into its own directory and then started using the following command:

frida-server

How to Use Frida to Bypass Certificate Pinning

Bypassing certificate pinning with approov.io can be a difficult task, but with the help of Frida, it can be easily accomplished. Here is a step-by-step guide on how to use Frida to bypass certificate pinning on Android apps:

First, ensure that you have the latest version of Frida installed. Then, open up a terminal and navigate to the location where your Android app is stored. To check if an app has certificate pinning enabled, run the following command:

frida –U –l sslpinningbypass.js

If the output shows “SSL pinning bypass detected”, then the app has SSL pinning enabled and we can proceed to bypass it.

Next, we need to start a trace session on our app. We can do this by running the following command:

frida –U –l tracessl.js &> ssltrace.log &
disown
This will start a trace session and redirect all output to a file called “ssltrace.log”. We can now leave this terminal window open and open up another one.

In the new terminal window, we need to setup a port forwarding so that we can access the trace data from our computer. To do this, run the following command:

Conclusion

Certificate pinning is a great security measure for Android apps, but sometimes it can be necessary to bypass this process. With the help of Frida, you can easily accomplish this task with just a few steps. This guide has provided you with an overview of certificate pinning and how to use Frida to bypass it on Android apps. We hope that having gone through the detailed step-by-step instructions in this article, you now have enough knowledge and confidence to start bypassing certificate pinning on any Android app. Happy hacking!