2

We all know how to bypass SSL pinning using Xposed Framework module - SSLUnpinning. But I've found apps which cannot be bypassed this way. How do these apps prevent bypass of the SSL pinning which is done using Xposed Framework's module?

8
  • Just don't. How should anyone trust your app if you are afraid of people seeing what it is doing? Feb 7 '19 at 11:19
  • 1
    This looks like an XY problem for me. It is not clear why you want to specifically prevent bypassing SSL pinning using Xposed Framework but not care about other ways (like using Frida). Please add the relevant context to your question. Feb 7 '19 at 11:28
  • Hi @SteffenUllrich, I'm a security researcher and I need to provide recommendations for our clients on how to implement SSL Pinning properly. For eg: For some applications, I was not able to bypass SSL Pinning using Xposed Framework or Frida, which means it is difficult for a hacker to intercept the requests. I want to know how those secure apps have implemented SSL pinning.
    – adithya a
    Feb 7 '19 at 12:09
  • @PeterHarmann Normal app users won't try to intercept the requests and try to modify it. Either Black hat hackers or Ethical hackers like me try to do all of this. I'm afraid of Black hat hackers not just anyone.
    – adithya a
    Feb 7 '19 at 12:14
  • @adithyaa: I've adapted your question to fit your comment. Please have a look if it expresses your intention better. Feb 7 '19 at 12:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.