Certificate pinning bypass

When it applies

The app pins its server cert, so a normal MITM proxy (Burp/mitmproxy) can't decrypt its traffic — you get handshake errors and empty history. You need to test the backend, so the pin has to go.

Why it works

Pinning is enforced in the client you control. At runtime you can replace/neutralize the verification routine; statically you can patch it out. Either way the app then trusts your proxy's CA.

Method

1. Install your CA first: add Burp/mitmproxy CA to the device (Android 7+ needs it as a system cert, or use a network_security_config on a repackaged app).
2. Runtime (fastest): objection -g <pkg> explore then android sslpinning disable (iOS: ios sslpinning disable), or a Frida script (frida-multiple-unpinning).
3. Static patch (when Frida is blocked): apktool d, remove/patch the CertificatePinner / TrustManager checks or swap network_security_config to trust user CAs, rebuild + resign (apktool b, uber-apk-signer).
4. Confirm: traffic now appears decrypted in the proxy; proceed to backend testing.

Gotchas

• No traffic at all (not just pinning) can mean the app uses a non-HTTP protocol or a VPN — check.
• Some apps double-pin or detect Frida/root — combine root-detection bypass, or use static patching.
• iOS on a non-jailbroken device needs a repackaged/sideloaded app or a jailbroken test device.

Verify success

The proxy shows plaintext requests/responses from the app; you can now replay/modify them.

References

OWASP MASTG (network); objection & frida-multiple-unpinning; TrustKit/OkHttp docs.