skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

mobile-ssl-pinning-bypass

Bypass SSL certificate pinning on Android and iOS apps using Frida, Objection, and repackaging techniques.

Updated Jun 5, 2026
Search Tags:#penetration testing#ios#android#mobile security#frida#traffic interception#ssl pinning
One-click install
npx skills add https://github.com/lNwNl/Praxis --skill mobile-ssl-pinning-bypass-lnwnl
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mobile-ssl-pinning-bypass
Source: https://github.com/lNwNl/Praxis/tree/main/skills/_disabled/mobile-ssl-pinning-bypass
Command: npx skills add https://github.com/lNwNl/Praxis --skill mobile-ssl-pinning-bypass-lnwnl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Mobile applications that implement SSL certificate pinning block HTTPS traffic interception, preventing security testers from inspecting API communication during authorized penetration tests. This Skill provides a structured playbook to bypass pinning across platforms and frameworks. ## Core Features & Use Cases - Android Bypass Methods: Frida universal hooks for TrustManager, OkHttp, Volley, and Conscrypt, plus Objection one-liners, Network Security Config overrides, LSPosed modules, and Magisk system CA installation. - iOS Bypass Methods: Frida SecTrust hooks, Objection commands, SSL Kill Switch 2, and library-specific hooks for AFNetworking, Alamofire, and TrustKit. - Framework-Specific Coverage: Dedicated techniques for Flutter (BoringSSL native hooks, reflutter), React Native, and Xamarin, which defeat standard Java/ObjC-layer hooks. - Use Case: During an authorized mobile app assessment, Burp Suite shows no traffic from a Flutter Android app. Follow the decision tree to identify Flutter, apply reflutter to patch BoringSSL, and successfully intercept the HTTPS API calls. ## Quick Start Ask the agent to bypass SSL pinning on the target Android app com.example.app using Frida so its HTTPS traffic can be intercepted through Burp Suite.

Frequently Asked Questions about mobile-ssl-pinning-bypass

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I bypass SSL pinning on Android with Frida?▼

Use a Frida script that hooks TrustManagerImpl.verifyChain, X509TrustManager, OkHttp3 CertificatePinner.check, and Conscrypt verification functions, forcing them to accept any certificate. Run it with frida -U -f com.target.app -l bypass.js on a rooted device.

How to bypass SSL pinning in Flutter apps?▼

Flutter uses BoringSSL inside libflutter.so, so standard Java or ObjC hooks do not work. Use the reflutter tool to patch the Flutter engine directly, or hook the BoringSSL certificate verification function at the native layer with Frida pattern scanning.

Does Objection disable SSL pinning on both Android and iOS?▼

Yes, Objection provides one-command bypasses: 'android sslpinning disable' and 'ios sslpinning disable' when attached to a running app. Android requires a rooted device and iOS requires a jailbroken device or an app repackaged with the Frida gadget.

Why does my SSL pinning bypass script load but traffic still fails?▼

The app likely uses multiple pinning layers, so you must hook all of them: TrustManager, OkHttp CertificatePinner, and any custom validation code. Other causes include mutual TLS requiring a client certificate, non-HTTP protocols like gRPC, or anti-tampering checks crashing the app.

Can I intercept Android app traffic without root access?▼

Yes, for debug builds you can modify the Network Security Config to trust user CAs, then repackage and re-sign the APK with apktool and apksigner. For release builds, decompile the APK, patch out the pinning checks in smali, and reinstall the modified package.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

intercepting-mobile-traffic-with-burpsuite

Intercepts and analyzes mobile app HTTP/HTTPS traffic using Burp Suite proxy.

Community
Intermediate
giosuetedeschi-specgiosuetedeschi-spec

Burp Suite Web Application Testing

Intercept and modify HTTP traffic to test web application security.

Community
Advanced
AshtonVaughanAshtonVaughan

mobile

Identify and validate mobile application security weaknesses across Android and iOS.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

mobile-ios-dynamic

Performs iOS app runtime instrumentation, traffic interception, sandbox inspection for security vulnerabilities using Frida and Objection.

Community
Advanced