Android Pen-testing - Bypass SSL pinning

Developers can pin the public key into the App.
That way, the app will compare the key and if it doesn’t match the connection is dropped.
In this video we look at the way to bypass the SSL pinning process using Dynamic Binary Instrumentation.
Note: This is a just an example to explain SSL pinning for educational purposes without any ill intentions. Please use the demos showcased ethically.
Tools:
frida- www.codemetrix...

[@kalisettyhashika5327]

Thank you for this video! This video has given me confidence to test android applications. Hope you continue making such amazing videos! Cheers!

[@psychorockz123]

@BitsPlease Great tutorial. You explained each step very well. However the automated script injection may not work for most applications. Could you make a video explaining how to manually tamper with the smali code and bypass pinning?

[@prarthanarao8406]

Thanks , this really helped with the issues I was Facing !

[@BitsPlease]

Thanks Prarthana. Glad it helped.

[@wikali6128]

Look like you missed an important step, once you pushed the cert generated by Burp suite to android emulator but you haven't installed it .....so placed it in /data/local/temp

[@BitsPlease]

Thanks for pointing it out Wika Li. Yes, you gotta go to your device and install the certificate. i believe my earlier certificate is still doing the job.

[@DeeptimanPattnaik1991]

Very nicely done, very well explained , Thank you :)

[@ngeeannboiii8554]

16:04 . Command line at the right is cut off. what is the full command to run the .js file??

[@tulsirao2764]

awesome video..thanks a lot for the detailed video and android pt series.

[@TekTok]

i face this issue "Failed to spawn: the 'argv' option is not supported when spawning Android apps" can you help me pls

[@Thunder-dp7du]

Great video what If the communication has been encrypt any other way to bypass it.

[@sangameshr.t.2476]

Is there any way to stop this bypass ? I have tried adding public key and adding certificate to the code but it still being bypassed.

[@Exrienz]

where is the link for frida ssl repinning script?

[@Hacking_vibe]

I need that

[@dimassahidabdullah1183]

why did my script doesn't work for bypass ssl pinning? I got the script from Frida's Website

[@m7zr]

Same… did you fix it?

[@nopenope5949]

Nope​@@m7zr

[@righamjain9457]

Can you please tell me the version of Twitter app you are using as the version i tried to install on Android v7.1 is giving me error

[@gcpa7539]

what android emulator you are using on the video?

[@BitsPlease]

I’m using Genymotion.

[@gcpa7539]

@@BitsPlease thanks

[@smartcontract647]

I'm getting an error: Failed to spawn: the 'argv' option is not supported when spawning Android apps, Can anyone help me?

[@arcanghelfernandez3856]

This could have been a very good step by step installing Frida, however did not provide detailed information especially for beginners

[@FortniteBRLeaks]

Yeah this tutorial is horrible. I'm moving onto someone else who can explain it better

[@mersalmakers1577]

Sir how can I get hook.js file?

[@wazzygray]

Which os you're using

[@habeebkhaa5057]

Thanks a lot, this really helped a lot.

[@viralshah2855]

Hi Can you do this with xposed framework with SSL unpinning or any other simillar module?. Please show detail process how to install and use xposed framework and modules

[@bayronkentoy]

What android version did you used ?

[@BitsPlease]

I'm using Android 8.0 (API level 26).

[@joyoe]

@@BitsPlease then sir, do plz tell me, during executing "rida -U -f com.twitter.android -l frida-android-repinning.js --no-paus", I ran into error "[o] Error: java.io.FileNotFoundException: /data/local/tmp/cert-der.crt (Permission denied) ", I believe it is because I'm using Magisk for rooting, it doesn't change the adbd into root, so I won't be about to access to "cert-der.crt" in system directory, plz correct me if I'm wrong, and besides, if yes, how did you fix this? I'm using Android 9.0, thanks for answering

[@manojkansal02]

#BitsPlease @BitsPlease Could you please help me as i am not able to make a connection with genymotion/virtualbox and burpsuite. What type of connection setting in need to setup in virtual box and which ip i need to config to set up over wifi not using LAN.

[@mnageh-bo1mm]

That poor user that you keep brute forcing his email with wrong logins.

[@markopurunto9858]

which Twitter version

[@trueToastedCode]

its woking... can be also done from windows

[@VishalKumar-nv9gu]

Hi bro can you help me with this i am also trying to capture the request of an Android apk but i am not able to do it

[@wazzygray]

Your voice is so sweet

[@yasyasmarangoz3577]

^^

[@bibekdhakal5353]

bro I am trying at this moment. i am sure its gonna work

[@bibekdhakal5353]

having a problem at ADB wtf. ADB version is fucking me. lol

[@yasyasmarangoz3577]

@@bibekdhakal5353 So? Did it work?

[@TvUp24h]

hello ? you telegram ?

[@mrprince4791]

10000000000______ Love for you.

[@omarandomar1829]

وحش

[@bibekdhakal5353]

;)

[@charanjitsingh1815]

Annoying presentation