Android Pen-testing - Bypass SSL pinning

Developers can pin the public key into the App.
That way, the app will compare the key and if it doesn’t match the connection is dropped.
In this video we look at the way to bypass the SSL pinning process using Dynamic Binary Instrumentation.
Note: This is a just an example to explain SSL pinning for educational purposes without any ill intentions. Please use the demos showcased ethically.
Tools:
frida- www.codemetrix.io/hacking-and...

[@DeeptimanPattnaik1991]

Very nicely done, very well explained , Thank you :)

[@tulsirao2764]

awesome video..thanks a lot for the detailed video and android pt series.

[@kalisettyhashika5327]

Thank you for this video! This video has given me confidence to test android applications. Hope you continue making such amazing videos! Cheers!

[@prarthanarao8406]

Thanks , this really helped with the issues I was Facing !

[@BitsPlease]

Thanks Prarthana. Glad it helped.

[@habeebkhaa5057]

Thanks a lot, this really helped a lot.

[@psychorockz123]

@BitsPlease Great tutorial. You explained each step very well. However the automated script injection may not work for most applications. Could you make a video explaining how to manually tamper with the smali code and bypass pinning?

[@TekTok]

i face this issue "Failed to spawn: the 'argv' option is not supported when spawning Android apps" can you help me pls

[@viralshah2855]

Hi Can you do this with xposed framework with SSL unpinning or any other simillar module?. Please show detail process how to install and use xposed framework and modules

[@sangameshr.t.2476]

Is there any way to stop this bypass ? I have tried adding public key and adding certificate to the code but it still being bypassed.

[@ngeeannboiii8554]

16:04 . Command line at the right is cut off. what is the full command to run the .js file??

[@righamjain9457]

Can you please tell me the version of Twitter app you are using as the version i tried to install on Android v7.1 is giving me error

[@wikali6128]

Look like you missed an important step, once you pushed the cert generated by Burp suite to android emulator but you haven't installed it .....so placed it in /data/local/temp

[@BitsPlease]

Thanks for pointing it out Wika Li. Yes, you gotta go to your device and install the certificate. i believe my earlier certificate is still doing the job.

[@wazzygray]

Your voice is so sweet

[@yasyasmarangoz3577]

^^

[@Thunder-dp7du]

Great video what If the communication has been encrypt any other way to bypass it.

[@mrprince4791]

10000000000______ Love for you.

[@wazzygray]

Which os you're using

[@manojkansal02]

#BitsPlease @BitsPlease Could you please help me as i am not able to make a connection with genymotion/virtualbox and burpsuite. What type of connection setting in need to setup in virtual box and which ip i need to config to set up over wifi not using LAN.

[@smartcontract647]

I'm getting an error: Failed to spawn: the 'argv' option is not supported when spawning Android apps, Can anyone help me?

[@Exrienz]

where is the link for frida ssl repinning script?

[@Hacking_vibe]

I need that

[@mersalmakers1577]

Sir how can I get hook.js file?

[@bibekdhakal5353]

bro I am trying at this moment. i am sure its gonna work

[@bibekdhakal5353]

having a problem at ADB wtf. ADB version is fucking me. lol

[@yasyasmarangoz3577]

@@bibekdhakal5353 So? Did it work?

[@gcpa7539]

what android emulator you are using on the video?

[@BitsPlease]

I’m using Genymotion.

[@gcpa7539]

@@BitsPlease thanks

[@arcanghelfernandez3856]

This could have been a very good step by step installing Frida, however did not provide detailed information especially for beginners

[@FortniteBRLeaks]

Yeah this tutorial is horrible. I'm moving onto someone else who can explain it better

[@markopurunto9858]

which Twitter version

[@dimassahidabdullah1183]

why did my script doesn't work for bypass ssl pinning? I got the script from Frida's Website

[@m7zr]

Same… did you fix it?

[@nopenope5949]

Nope​@@m7zr

[@kentslaves]

What android version did you used ?

[@BitsPlease]

I'm using Android 8.0 (API level 26).

[@joyoe]

@@BitsPlease then sir, do plz tell me, during executing "rida -U -f com.twitter.android -l frida-android-repinning.js --no-paus", I ran into error "[o] Error: java.io.FileNotFoundException: /data/local/tmp/cert-der.crt (Permission denied) ", I believe it is because I'm using Magisk for rooting, it doesn't change the adbd into root, so I won't be about to access to "cert-der.crt" in system directory, plz correct me if I'm wrong, and besides, if yes, how did you fix this? I'm using Android 9.0, thanks for answering

[@omarandomar1829]

وحش

[@mnageh-bo1mm]

That poor user that you keep brute forcing his email with wrong logins.

[@trueToastedCode]

its woking... can be also done from windows

[@VishalKumar-nv9gu]

Hi bro can you help me with this i am also trying to capture the request of an Android apk but i am not able to do it

[@bibekdhakal5353]

;)

[@TvUp24h]

hello ? you telegram ?

[@charanjitsingh1815]

Annoying presentation