Previously I have been able to bypass SSL Pinning by using the program
JustTrustMe with the
Xposed framework for nearly every app.
However it has started to fail on more and more apps recently. The more I read it seems like I have to disassemble every app and patch them one by one.
Is there some application that I have missed that can disable SSL Pinning by hooking onto system commands?
Programs that I have tried:
If there is no such program, what is the best way to go?
What I have identified so far:
Try to disassemble the APK and search for keywords such as "X509TrustManager", "cert", "pinning" etc and modify it accordingly. Like this article: http://blog.dewhurstsecurity.com/2015/11/10/mobile-security-certificate-pining.html
However it seems that at least one of the apps that I have trouble proxying (Facebook Messenger) is using SSL Pinning in the native layer as well as the Java layer. This is probably the case in many other applications as well since they have worked before with JustTrustMe but has now stopped working. https://serializethoughts.com/2016/08/18/bypassing-ssl-pinning-in-android-applications/