skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-mobile-app-certificate-pinning-bypass

Bypasses SSL certificate pinning in Android and iOS apps using Frida and Objection.

954|172|Updated Mar 13, 2026
Search Tags:#ios#android#mobile pentesting#certificate pinning#Frida#Objection#ssl bypass
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-mobile-app-certificate-pinning-bypass
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-mobile-app-certificate-pinning-bypass
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/mobile-security/performing-mobile-app-certificate-pinning-bypass
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-mobile-app-certificate-pinning-bypass

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires frida, objection.

What problem does it solve?

During authorized mobile penetration tests, certificate pinning blocks HTTPS traffic interception through proxies like Burp Suite, preventing analysis of app API communication. This Skill provides a structured workflow to identify and bypass pinning implementations so intercepted traffic can be inspected.

Core Features & Use Cases

  • Pinning Identification: Detects OkHttp CertificatePinner, custom TrustManager, Network Security Config pin-sets, TrustKit, NSURLSession delegates, and SecTrust evaluation on Android and iOS.
  • Automated Bypass: Uses Objection's built-in sslpinning disable commands plus custom Frida scripts for universal Java/ObjC hooking and native-level interception.
  • Multi-Layer Handling: Addresses advanced cases like native C/C++ pinning, Certificate Transparency checks, and dynamic pin rotation.
  • Use Case: A pentester testing an Android banking app finds Burp shows no traffic. They run Objection's pinning bypass, confirm OkHttp is cleared, then hook a remaining custom TrustManager with Frida until all authenticated API calls appear in Burp.

Quick Start

Bypass the SSL certificate pinning on the target Android app so I can intercept its HTTPS traffic in Burp Suite during my authorized assessment.

Frequently Asked Questions about performing-mobile-app-certificate-pinning-bypass

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I bypass SSL certificate pinning on Android?▼

Use Objection with 'android sslpinning disable' for common libraries like OkHttp and TrustManagerImpl. For custom implementations, load a Frida script that hooks TrustManagerImpl.verifyChain, CertificatePinner.check, and SSLContext.init to replace trust managers.

How to bypass SSL pinning on iOS apps with Frida?▼

Run Objection's 'ios sslpinning disable' or use a Frida script that hooks NSURLSession didReceiveChallenge delegates and replaces SecTrustEvaluateWithError with a NativeCallback returning true. A jailbroken device with Frida server running is required.

Objection vs custom Frida scripts for pinning bypass?▼

Objection is fastest and covers common libraries like OkHttp, NSURLSession, and TrustKit out of the box. Custom Frida scripts are needed when apps use bespoke TrustManager logic, native C/C++ validation, or multi-layer pinning that Objection misses.

Why does SSL pinning bypass fail on some apps?▼

Failures usually come from multi-layer pinning where one bypassed layer hides another, native binary-level certificate checks that Java/ObjC hooks miss, Certificate Transparency validation, or dynamic pin updates from libraries like TrustKit.

Does certificate pinning bypass work without root or jailbreak?▼

No, this workflow requires a rooted Android device or jailbroken iOS device with Frida server running. Repackaging apps with Frida Gadget is an alternative on non-rooted devices but is outside this workflow's prerequisites.

How do I confirm the pinning bypass actually worked?▼

Configure the device proxy to Burp Suite, then complete an authenticated flow in the app and verify every request, including background API calls, appears in Burp's HTTP history. Missing requests indicate a remaining pinning layer.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

analyzing-ios-app-security-with-objection

Inspect iOS app keychain and filesystem data using Objection and Frida.

Official
Advanced
giosuetedeschi-specgiosuetedeschi-spec

Burp Suite Web Application Testing

Intercept and modify HTTP traffic to test web application security.

Community
Advanced
woohyun212woohyun212
21

mobile-pentest

Perform end-to-end penetration testing of Android and iOS mobile applications.

Community
Advanced
bingookbingook

mobile-ssl-pinning-bypass

Bypass SSL pinning in Android and iOS apps using Frida, Xposed, and LSPosed.

Community
Advanced