How can I intercept Android application's SSL traffic where SSL pinning is used?

Question

I want to capture the SSL traffic of an Android Application which I think uses SSL pinning.

I've tried running an app which says it uses VPN Tunneling and a Root Certificate to capture the SSL traffic, and it is able to capture the traffic from Chrome and some other basic apps, but when I run the app that I want to capture traffic from, the app works fine but the capture app shows Can Not Capture.

Is there some step-by-step guide or an easy solution?

Answer 1

SSL Pinning is the additional layer of security implemented at the client side to let the mobile application only trust a particular SSL certificate during HTTPs connection establishment and not the certificates installed in the device trust store. Since the implementation is the client side implementation, it can be easily bypassed using the following techniques:

Automated Approach

1. Xposed modules such as SSLUnpinning 2.0.
2. FRIDA(Dynamic Instrumentation Tool)-Universal SSL Pinning Bypass Script.
3. Inspeckage-Android Package Inspector

Manual Approach

I feel this is the last, bit complex and the most reliable solution for bypassing SSL Pinning. The following are the steps to perform the same.

1. Understand the implementation of SSL Pinning. You can refer to this Medium blog which explains the implementation of SSL Pinning using different network libraries such as OkHttp, Volley, Retrofit etc.
2. Analyze the responsible method and map the same with the SMALI code.

Once the responsible method is analyzed and identified, we can use the following approach for bypassing SSL Pinning:

Tampering Application

1. Tamper the SMALI code to bypass SSL Pinning.

2. Re-Build the application using APKTool.

3. Resign and install the application and capture the traffic.

Reference: https://samsclass.info/android/codemod.html

Runtime Hooking Once the responsible method is identified use runtime hookers such as FRIDA, JDB to hook the method and change the implementation.