One-click SSL-Pinning Bypass Setup

UpdatedFebruary 3, 2022

I'm leading the Research at Credshields, and Pentest teams at Cobalt Labs and HackerOne. I occasionally blog about my findings and adventures in pentesting.

Comments

Join the discussion

No comments yet. Be the first to comment.

More from this blog

Hijacking iOS Deep Links in a Health App Using Custom URL Schemes

Overview During a recent pentest of an iOS health application (let's call it MedVault), I came across something interesting. The app was using custom URL schemes for deep linking but had no Universal

Apr 9, 20269 min read415

Hijacking iOS Deep Links in a Health App Using Custom URL Schemes

Selfie - Damn Vulnerable DeFi #06

Analysis and PoC of Damn Vulnerable DeFi Level 06 - Selfie

Jan 29, 20234 min read409

The Rewarder - Damn Vulnerable DeFi #05

Analysis and PoC of Damn Vulnerable DeFi Level 05 - The Rewarder

Jan 29, 20234 min read396

Side Entrance - Damn Vulnerable DeFi #04

Analysis and PoC of Damn Vulnerable DeFi Level 04 - Side Entrance

Jan 26, 20233 min read534

Side Entrance - Damn Vulnerable DeFi #04

Truster - Damn Vulnerable DeFi #03

Analysis and PoC of Damn Vulnerable DeFi Level 03 - Truster

Jan 22, 20233 min read429

All Things Security

47 posts

Pre-requisites

This only works with Genymotion. You need to have a device ready, installed and running so that the script can interact with the ADB.
I mostly use a Custom device with Android 8. Here's my configuration if you're interested. geny

Start your Burp before running the installer as this script downloads your certificate from Burp's proxy.

Run the frida_setup.sh to start the installer.

Workflow

Here's what the script does in the background.

Installs frida and frida-tools using pip. Don't forget to export the installed path otherwise, sometimes it does not work by default.

export PATH=$PATH:/home/<your_user>/.local/bin

Fetches the latest released version of Frida server from GitHub.

Downloads certificate from Burp's proxy.

Pushes and install the required files inside the ADB.

Cleans up the files and does a reboot of the android system.

Post-Installation

Here's what you need to do after the Android reboots.

Go to Burp > Proxy > Options and add a Proxy listener for your android. burp

Make sure the IP is your VirtualBox's IP. Set the same inside your Android's WiFi settings with the same port.

Execute adb shell and run the frida-server from /data/local/tmp.

Use the frida2.js OR frida.js script provided in the Github repository to bypass SSL Pinning -

frida -U -f <package_name> -l frida2.js --no-pause

The package name can be found using the below command. Make sure the app is running for it to show in the result.

frida-ps -U | grep "your_app"

Note: Recommend using frida2.js instead of frida.js

Command Palette

Comments

More from this blog

Pre-requisites

Workflow

Post-Installation