Defeat SSL Pinning | Android Security Crash Course

In this video, I will be looking at SSL Pinning and how to bypass it on an Android device using a tool called Frida.
Check out my blog here:
corsecure.blog

[@wolfrevokcats7890]

Great! Your audio quality is getting better compared to previous videos

[@Origameasy]

Thank you ! Your channel is so underrated !

[@RohitKumar-ci3jc]

Thank you for this wonderful tutorial. Worked Perfectly.

[@rauf236]

Thank you very much! Everything worked perfectly

[@decodethedev]

This is the most underrated channel I've ever came on KZbin, I was surprised by how little subscribes you have comparing to the quality of your content, please keep up the good work and never give up man.

[@wardellcastles]

Thanks!

[@walidsabir5411]

Thanks a lot for this video. This worked with one app but didn't work with 2 other apps. Frida server is running, but I get "the client failed to negotiate a TLS..." on Burpsuite. Any idea why? I got it working for one app but not the others, and I followed the same steps.

[@saqlainmushrif6453]

Hi, What should be the package extensions of frida if I'm using mac book pro M1 chip and how to install it

[@masterfan0]

For some reason frida-ps -U was not showing anything for me, even though the server was running. Then what I did was just started the frida server using magisk-frida module. That worked

[@sweetdeal8951]

Also works on some Windows apps?

[@khalidsaeed2309]

Hi @CorSecure, your video help to understand the ssl bypass but how can we prevent ssl pining from bypassing? Is there any way. If so can you make another video related this !

[@CorSecure]

That's a difficult question. Ultimately, I don't think it is possible to implement SSL pinning in a way that is impossible to bypass. By the nature of mobile applications, the attacker has full access to the binary and can reverse engineer it to bypass any protections that are in place on the client side. However, there are some types of more robust pinning methods and other protections out there that can be much more difficult to bypass than the common types of pinning that I bypassed in this video. It's really a question of whether those more robust protections are worth the additional effort (or cost) associated with them.

[@sjude]

Can you make an explanation through Android?

[@anonymous3472]

Hello, Will this work with facebook?

[@wardellcastles]

On my x86 host and virtual device, when running frida with a codeshare, it's asking for an arm64 so Gadget. Why does frida think I am on an arm architecture? Of course supplying that arm64 Gadget just leads to another error. Is there a Frida Slack or similar channel where I can get support?

[@CorSecure]

If this is the error message that I think it is, then it most likely means that the version numbers don't match between the frida server on the device and frida on your host machine. You can check the version numbers by running frida --version on your host and ./frida-server --version from the directory where it was installed on the mobile device. I'm not sure about a slack, but I usually check the frida github issues page whenever I am having problems. Most of the time there is already a thread that covers whatever problems I am having. github.com/frida/frida/issues/2326

[@VikingMythologyUnveiled]

I get this error "generic_x86_arm:/ # /system/bin/sh: /data/local/tmp/frida-server/: can't execute: Is a directory" I did all the steps correctly can anyone help?

[@wardellcastles]

When I run frida-ps on my host machine it shows processes running on my host machine, not the virtual device. Looks like when you run it, it's a list of processes on the device.

[@CorSecure]

Yep. The -U flag tells it use the device that is connected with ADB. There is also an option to use the -R flag to connect to remote device. I never use that option though since I always have my device connected.

[@gwnbw]

If an app returns no data via proxy does it mean I should use this? Or what else can it be? Nice vid btw

[@CorSecure]

If the proxy is configured correctly, then SSL pinning is a very likely reason why you wouldn't be seeing traffic. You should see some TLS errors in the error log on your Burp Suite dashboard if that is the case. I have some additional instructions on my website if that helps. corsecure.blog/2023/08/24/bypassing-ssl-pinning-with-frida/

[@wardellcastles]

why do you specify -U on frida-ps since you are using an emulator and not a real device over USB?

[@CorSecure]

The -U flag just tells Frida to connect to the device that is connected with ADB. it's technically not connected over USB, but from the perspective of Frida, being connected to ADB is the same thing as if it was connected with a USB cable.

[@AryYuliantoo]

I'm currently facing the issue of executing bypass ssl pinning. Frida-server is running but it shows like this: "Failed to spawn: need Gadget to attach on jailed Android; its default location is: C:\Users\MyWindows\AppData\Local\..." Is it a bug or I missed something? The current Frida version is 15.1.21

[@CorSecure]

Is the device that you are using rooted? I have never seen this particular error before, but the phrase "jailed Android" make it seem like it is a non-rooted device. If so, I don't believe that this method of bypassing SSL Pinning will work. However, I do have another video that shows a different method of bypassing SSL Pinning that will work on a non-rooted device. kzbin.info/www/bejne/p5Ktc4qZqsp2f6M

[@AryYuliantoo]

​@@CorSecure yes, a rooted emulator. It's fixed now. Somehow my adb got disconnected and need to reconnect through tcpip to make it visible on adb devices. But I got the following error. Still in bypass ssl pinning. "" I've tried to turn off the check for server and publisher's certificate revocation, make codeshare as a trusted site, and sync my time windows with the internet. Nothing works with that.

[@CorSecure]

@@AryYuliantoo I wish I could help, but I've never come across that error when using Frida before. My best recommendation would be to try using Objection, which I go over in the video I linked in my last comment. You may have better luck using that method to bypass SSL Pinning.

[@AryYuliantoo]

@@CorSecure no worries, found the answer. It had something to do with the expiring certificate from Let’s Encrypt. Even though you can't help directly but this little discussion could lead to the other things for me. Thanks for the quick response anyways. About non-root android, I have no idea how to install apksigner and zipalign in the windows command prompt. And also it's already worked right now. Great video! :)

[@lvda_ki_sarkar]

@@CorSecure Failed to spawn: need Gadget to attach on jailed Android; its default location i s: C:\Users\Yogesh\AppData\Local\Microsoft\Windows\INetCache\frida\gadget-androi d-arm64.so same problem ... i am using rooted phone

[@viswasringan9848]

Can you provide the steps on how you rooted your emulator?

[@wolfrevokcats7890]

he already showed it in previous series. emulator already rooted, just run adb shell as root

[@user-iv3do3qy9f]

i need help i got this error Unable to load SELinux policy from the kernel: Failed to open file “/sys/fs/selinux/policy”: Permission denied

[@CorSecure]

I found this thread on GitHub about this issue. Hopefully some of the comments on that thread will help. github.com/frida/frida/issues/597

[@Sanjay54251]

how to avoid ssl pinning

[@pakvsenglive3755]

I got the following error at objecton explore Unable to connect to the frida server: unable to connect to remote frida-server: closed

[@CorSecure]

I don't think I've ever gotten that particular error, but I found this post on stackoverflow that had the same issue. I hope this helps. stackoverflow.com/questions/62171745/frida-server-unable-to-connect

[@pakvsenglive3755]

@@CorSecure Thank you so much bro for your effort but I am on a non-rooted phone and I also google the issue but every forum and comment is telling the solution over a rooted phone

[@CorSecure]

@@pakvsenglive3755 oh yea. this won't work without a rooted phone because you need to install and run the frida server on the device. however, I do have another video showing how to bypass SSL Pinning using objection that does not require a rooted device. if you want to try following that process, it might work better for you. kzbin.info/www/bejne/p5Ktc4qZqsp2f6M

[@pakvsenglive3755]

@@CorSecure Bruh , I am already using objection and facing this error on objection explore .

[@nasroblgm3585]

Emulator name pls

[@CorSecure]

I am using the Android Studio emulator. I have another video where I walk through how I set up my emulator. kzbin.info/www/bejne/ZqPdaX6YndyFbNU

[@crashingspoon]

I followed the process and it worked for the first app I tried. However I'm trying on a different app and getting the following message: "Failed to spawn: need Gadget to attach on jailed Android; its default location is: /Users/user/.cache/frida/gadget-android-arm64.so". Any idea how to fix this?

[@CorSecure]

That error most likely means that either the frida-server is not running on the Android device or the version numbers of the frida-server (on the Android device) and frida (on the PC) do not match.

[@mackeman1356]

how did you solve the error