Security Glossary

Certificate Pinning Bypass

Techniques that neutralize an app's certificate pinning (hooking OkHttp CertificatePinner, X509TrustManager, or iOS NSURLSession trust checks with Frida or Objection) so HTTPS traffic can be...

Certificate Pinning Bypass is the set of techniques used to defeat certificate pinning in a mobile app or client so that its HTTPS traffic can be intercepted with a proxy such as Burp or mitmproxy. Testers do this to inspect an app's API (a legitimate assessment need); the same methods let malware or an on-path attacker read traffic the developer meant to protect.

What Pinning Does

Normally a client trusts any certificate that chains to a CA in its trust store. Pinning narrows that: the app accepts only a specific certificate or public key (or its hash), so adding your own CA to the device is not enough. Bypassing pinning means neutralizing the code that performs that extra check. Where that code lives depends on the platform, and each pinning surface has its own bypass point.

Android Pinning Surfaces

  • OkHttp CertificatePinner: pins are configured in code and enforced in check(hostname, peerCertificates). Hooking that method to return instead of throwing removes the pin.
  • Network Security Config: declarative pins in res/xml/network_security_config.xml under <pin-set>. Since the config is a resource, testers repackage the APK with a permissive config, or hook the framework that reads it.
  • Custom X509TrustManager: apps that pin by implementing checkServerTrusted are bypassed by overriding that method to do nothing.
// Frida: neutralize an OkHttp CertificatePinner
Java.perform(function () {
  var CP = Java.use('okhttp3.CertificatePinner');
  CP.check.overload('java.lang.String', 'java.util.List')
    .implementation = function (host, certs) {
      return;   // pin check becomes a no-op
    };
});

iOS Pinning Surfaces

  • NSURLSession delegate: apps validate the server in urlSession(_:didReceive:completionHandler:). Hooking it to call the completion handler with .useCredential and the server trust accepts any certificate.
  • SecTrustEvaluateWithError / SecTrustEvaluate: the underlying trust-evaluation call. Forcing it to report success bypasses pins implemented on top of it, including third-party libraries like TrustKit.

Standard Tooling

  • Frida: dynamic instrumentation to hook the methods above at runtime; community "universal" unpinning scripts cover the common OkHttp, TrustManager, and NSURLSession paths.
  • Objection: wraps Frida with android sslpinning disable and ios sslpinning disable for one-command bypass without writing scripts.
  • SSL Kill Switch 2: a jailbreak/tweak that patches iOS trust evaluation system-wide.
  • Repackaging (apk-mitm): rewrites the Network Security Config and re-signs the APK when runtime hooking is not available.

Legitimate use is confined to authorized testing and debugging of apps you own or are engaged to assess.

See Also