Previously I have been able to bypass SSL Pinning by using the program JustTrustMe with the Xposed framework for nearly every app.
https://github.com/Fuzion24/JustTrustMe
However it has started to fail on more and more apps recently. The more I read it seems like I have to disassemble every app and patch them one by one.
Is there some application that I have missed that can disable SSL Pinning by hooking onto system commands?
Programs that I have tried:
https://github.com/Fuzion24/JustTrustMe
https://github.com/iSECPartners/Android-SSL-TrustKiller
https://github.com/ac-pm/SSLUnpinning_Xposed
If there is no such program, what is the best way to go?
What I have identified so far:
Try to disassemble the APK and search for keywords such as "X509TrustManager", "cert", "pinning" etc and modify it accordingly. Like this article: http://blog.dewhurstsecurity.com/2015/11/10/mobile-security-certificate-pining.html
However it seems that at least one of the apps that I have trouble proxying (Facebook Messenger) is using SSL Pinning in the native layer as well as the Java layer. This is probably the case in many other applications as well since they have worked before with JustTrustMe but has now stopped working. https://serializethoughts.com/2016/08/18/bypassing-ssl-pinning-in-android-applications/