SSL Pinning is the additional layer of security implemented at the client side to let the mobile application only trust a particular SSL certificate during HTTPs connection establishment and not the certificates installed in the device trust store. Since the implementation is the client side implementation, it can be easily bypassed using the following techniques:
Automated Approach
- Xposed modules such as SSLUnpinning 2.0.
- FRIDA(Dynamic Instrumentation Tool)-Universal SSL Pinning Bypass Script.
- Inspeckage-Android Package Inspector
Manual Approach
I feel this is the last, bit complex and the most reliable solution for bypassing SSL Pinning. The following are the steps to perform the same.
- Understand the implementation of SSL Pinning. You can refer to this Medium blog which explains the implementation of SSL Pinning using different network libraries such as OkHttp, Volley, Retrofit etc.
- Analyze the responsible method and map the same with the SMALI code.
Once the responsible method is analyzed and identified, we can use the following approach for bypassing SSL Pinning:
Tampering Application
Tamper the SMALI code to bypass SSL Pinning.
Re-Build the application using APKTool.
Resign and install the application and capture the traffic.
Reference: https://samsclass.info/android/codemod.html
Runtime Hooking
Once the responsible method is identified use runtime hookers such as FRIDA, JDB to hook the method and change the implementation.