0

I found an x509 certificate hardcoded in an application and after looking into the code I found that is used to validate certificates(SSL pinning). Can I bypass SSL pinning with the certificate that I found?

1 Answer 1

2

Can I bypass SSL pinning with the certificate that I found?

The certificate is not the secret thing, the private key matching the certificate is. This key is only known to the server and it proves ownership of the key during TLS handshake. Thus knowledge of the certificate does not provide a way to impersonate as the server in order to bypass certificate pinning.

What you might be able to do is to patch the application to use a different certificate for pinning, i.e. your own where you know the private key.

3
  • Thanks for the response, so what are you saying is that if i can replace the certificate that i found with my certificate I can bypass certificate pinning? May 30 at 16:42
  • 1
    @JoaoMarono: If you can replace the certificate what the application is expecting, then you are not bypassing certificate but use it for your own purpose. It's still certificate pinning, only not pinning to the originally intended certificate. May 30 at 16:47
  • Ok ok, now I understand! Thank you Steffen :) May 30 at 19:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.