{"id":3820,"date":"2025-11-26T20:34:01","date_gmt":"2025-11-26T19:34:01","guid":{"rendered":"https:\/\/hardsoftsecurity.es\/?p=3820"},"modified":"2025-11-26T20:34:08","modified_gmt":"2025-11-26T19:34:08","slug":"ssl-pinning-bypass-android","status":"publish","type":"post","link":"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/","title":{"rendered":"SSL Pinning Bypass &#8211; Android"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Here we go again! Today we will be talking about SSL Pinning Bypass in Android. Due the recent cybersecurity congress that I have assisted, specifically, the last weekend (BSides Vienna) where one of the talks was related to SSL Pinning Bypass, I found my self inspired to make my own post explaining this technique. The main reason\/motivation to do it is, that I got documented the process of the technique on my notes.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img data-recalc-dims=\"1\" fetchpriority=\"high\" decoding=\"async\" width=\"800\" height=\"800\" data-attachment-id=\"3877\" data-permalink=\"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/image-119\/\" data-orig-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image.png?fit=1024%2C1024&amp;ssl=1\" data-orig-size=\"1024,1024\" data-comments-opened=\"1\" data-image-title=\"image\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image.png?fit=800%2C800&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image.png?resize=800%2C800&#038;ssl=1\" alt=\"\" class=\"wp-image-3877\" srcset=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image.png?w=1024&amp;ssl=1 1024w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image.png?resize=300%2C300&amp;ssl=1 300w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image.png?resize=150%2C150&amp;ssl=1 150w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image.png?resize=768%2C768&amp;ssl=1 768w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">However, first things first. We will need to know some basics about SSL Pinning and why we need to perform a Bypass. Also, I would like to inform you that the screenshots that I will show during the process will be blured because were taken during a CTF.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">1. What is SSL Pinning? \ud83d\udccc<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>SSL\/TLS Pinning<\/strong> (or <strong>Certificate Pinning<\/strong>) is an additional security measure implemented by mobile applications (and some desktop clients) to mitigate <strong>Man-in-the-Middle (MITM)<\/strong> attacks.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The Problem it Solves<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Normally, when a device connects to a server via HTTPS, it checks the server&#8217;s certificate against a large list of trusted <strong>Root Certificate Authorities (CAs)<\/strong> installed in the operating system&#8217;s trust store. A penetration tester typically uses a proxy tool (like Burp Suite or OWASP ZAP) which installs its own CA certificate on the device. Since this CA is now trusted by the OS, the tester can intercept the application&#8217;s traffic.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The Pinning Solution<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">SSL Pinning bypasses the reliance on the device&#8217;s trust store. Instead, the application itself contains a list of expected <strong>public keys<\/strong> or <strong>X.509 certificates<\/strong> (the &#8220;pins&#8221;) for its backend server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When the application attempts a secure connection:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>It performs the standard TLS handshake.<\/li>\n\n\n\n<li>It then performs a <strong>second, internal validation<\/strong> against its hardcoded pins.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">If the presented server certificate does not match one of the stored pins, the application immediately <strong>terminates the connection<\/strong>, regardless of whether the operating system officially trusts the certificate. This makes standard traffic interception techniques ineffective.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">2. The Purpose of the Bypass<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The primary purpose of performing an SSL Pinning Bypass is simple: <strong>to restore visibility into the application&#8217;s network communications.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In an ethical penetration test, this step is crucial because:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>API Analysis:<\/strong> Pinning prevents security researchers from examining the contents and structure of the underlying <strong>API calls<\/strong> that the mobile application makes to the server.<\/li>\n\n\n\n<li><strong>Security Vulnerability Identification:<\/strong> Without intercepted traffic, it\u2019s impossible to check for common API vulnerabilities such as:\n<ul class=\"wp-block-list\">\n<li><strong>Insecure data exposure<\/strong> in requests\/responses.<\/li>\n\n\n\n<li><strong>Broken Object Level Authorization (BOLA)<\/strong> flaws by modifying user IDs or parameters.<\/li>\n\n\n\n<li>Hardcoded secrets or sensitive information passed in HTTP headers or body.<\/li>\n\n\n\n<li>Improper session management or token handling.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In essence, bypassing the pin converts the secure tunnel back into a transparent channel for detailed security analysis.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">3. What We Are Going to Achieve<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">By successfully implementing the SSL Pinning bypass, we achieve <strong>full, unhindered interception of all TLS\/HTTPS traffic<\/strong> for the target application through our preferred proxy tool.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This means we will be able to:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>View all requests and responses<\/strong> in plaintext, including POST data, JSON\/XML payloads, and response bodies.<\/li>\n\n\n\n<li><strong>Modify outgoing requests<\/strong> on the fly (e.g., tamper with authentication tokens, input parameters, and business logic data) to test the server&#8217;s resilience against malicious input.<\/li>\n\n\n\n<li><strong>Analyze the application&#8217;s true behavior<\/strong> and data handling protocols, providing a complete picture of its security posture from the client&#8217;s perspective.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">The result is a fully transparent environment necessary to complete a thorough security assessment of the mobile application&#8217;s backend API.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">4. Tools Involved: Setting the Stage<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The actual bypass technique (often involving runtime instrumentation) requires a specific set of tools to set up the testing environment and interact with the target device.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Android Studio &amp; AVD (Android Virtual Device)<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><td><strong>Tool<\/strong><\/td><td><strong>Purpose in Bypass<\/strong><\/td><\/tr><\/thead><tbody><tr><td><strong>Android Studio<\/strong><\/td><td>Used to install and manage the <strong>Android SDK<\/strong>, which contains crucial components.<\/td><\/tr><tr><td><strong>AVD Manager<\/strong><\/td><td>Used to create a suitable <strong>emulator<\/strong> (Virtual Device) for testing. For bypass techniques, we often require a <strong>rooted<\/strong> device image (like a Google API image) to gain the necessary privileges for code injection or modifying system files.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">ADB (Android Debug Bridge)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>ADB<\/strong> is the versatile command-line tool that acts as a bridge for communication between your testing machine and the Android device\/emulator.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><td><strong>ADB Usage<\/strong><\/td><td><strong>Function in Bypass<\/strong><\/td><\/tr><\/thead><tbody><tr><td><code>adb connect<\/code> \/ <code>adb devices<\/code><\/td><td>Establishes and verifies the connection to the target device (emulator).<\/td><\/tr><tr><td><code>adb push<\/code><\/td><td>Used to transfer required files, such as custom certificates (for traditional MITM) or dynamic instrumentation tools\/scripts (like <strong>Frida Gadgets<\/strong> or <strong>Magisk Modules<\/strong>), onto the device&#8217;s filesystem.<\/td><\/tr><tr><td><code>adb shell<\/code><\/td><td>Allows you to execute remote shell commands on the Android device, necessary for: * Starting the target application. * Running privilege escalation commands (<code>su<\/code>). * Launching and attaching the actual pinning bypass script to the running application process.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Frida: The Dynamic Instrumentation Toolkit \ud83e\uddb8<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Frida<\/strong> is a powerful, open-source dynamic instrumentation toolkit that allows you to inject snippets of JavaScript or your own library into native apps on Windows, macOS, Linux, iOS, Android, and QNX. It&#8217;s the <strong>go-to tool<\/strong> for SSL Pinning bypass because it can hook into the running application&#8217;s process and modify its behavior in real-time.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><td><strong>Frida Component<\/strong><\/td><td><strong>Purpose in Bypass<\/strong><\/td><\/tr><\/thead><tbody><tr><td><strong><code>frida-server<\/code><\/strong><\/td><td>This lightweight daemon runs on the target Android device (pushed via ADB). It listens for commands from the Frida client on your host machine and injects the specified JavaScript hooks into the target application&#8217;s process.<\/td><\/tr><tr><td><strong>Frida Client (<code>frida<\/code> CLI \/ Python API)<\/strong><\/td><td>Runs on your host machine. You use this to interact with <code>frida-server<\/code>, select the target application process, and load your custom JavaScript scripts designed to disable or bypass SSL Pinning checks within the application&#8217;s code.<\/td><\/tr><tr><td><strong>JavaScript Hooks<\/strong><\/td><td>These are the actual scripts that contain the logic to intercept and modify function calls related to certificate validation within the target application. They can specifically target common SSL\/TLS libraries (like OkHttp, TrustManager, etc.) and instruct them to trust all certificates, effectively bypassing the pin.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">5. Steps: SSL Pinning Bypass<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Once, we have set up our android phone on our Android studio. The first thing we will need to do is upload the CA certificates of Burp Suite. We will use the ADB tools to do that:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Upload CA:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>adb push 9a5ba575.0 \/tmp\/9a5ba575.0<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Access the emulator via terminal:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>adb -s emulator-name shell<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Move to the correct directory and change rights of the CA certificate:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>mv \/tmp\/9a5ba575.0 \/system\/etc\/security\/cacerts\/<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>chmod 644 \/system\/etc\/security\/cacerts\/9a5ba575.0<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img data-recalc-dims=\"1\" decoding=\"async\" width=\"728\" height=\"216\" data-attachment-id=\"3878\" data-permalink=\"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/image-120\/\" data-orig-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-1.png?fit=728%2C216&amp;ssl=1\" data-orig-size=\"728,216\" data-comments-opened=\"1\" data-image-title=\"image\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-1.png?fit=728%2C216&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-1.png?resize=728%2C216&#038;ssl=1\" alt=\"\" class=\"wp-image-3878\" srcset=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-1.png?w=728&amp;ssl=1 728w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-1.png?resize=300%2C89&amp;ssl=1 300w\" sizes=\"(max-width: 728px) 100vw, 728px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Reboot the system to add the new certificate:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>reboot<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The next step will be to download the correct <a href=\"https:\/\/github.com\/frida\/frida\/releases\">frida<\/a> version compatible with out Android version:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Get frida core as agent from our linux:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>wget https:\/\/github.com\/frida\/frida\/releases\/download\/17.0.5\/frida-core-devkit-17.0.5-linux-x86_64.tar.xz<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Decompress the file:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>tar -xf frida-core-devkit-17.0.5-linux-x86_64.tar.xz<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img data-recalc-dims=\"1\" decoding=\"async\" width=\"800\" height=\"215\" data-attachment-id=\"3879\" data-permalink=\"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/image-121\/\" data-orig-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-2.png?fit=965%2C259&amp;ssl=1\" data-orig-size=\"965,259\" data-comments-opened=\"1\" data-image-title=\"image\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-2.png?fit=800%2C215&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-2.png?resize=800%2C215&#038;ssl=1\" alt=\"\" class=\"wp-image-3879\" srcset=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-2.png?w=965&amp;ssl=1 965w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-2.png?resize=300%2C81&amp;ssl=1 300w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-2.png?resize=768%2C206&amp;ssl=1 768w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Install frida tools to be able to interact from our attack machine:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>pip3 install frida-tools --break-system-packages<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"800\" height=\"352\" data-attachment-id=\"3880\" data-permalink=\"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/image-122\/\" data-orig-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-3.png?fit=960%2C422&amp;ssl=1\" data-orig-size=\"960,422\" data-comments-opened=\"1\" data-image-title=\"image\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-3.png?fit=800%2C352&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-3.png?resize=800%2C352&#038;ssl=1\" alt=\"\" class=\"wp-image-3880\" srcset=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-3.png?w=960&amp;ssl=1 960w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-3.png?resize=300%2C132&amp;ssl=1 300w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-3.png?resize=768%2C338&amp;ssl=1 768w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Upload frida server in to our emulated Android:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>adb -s emulator-name push frida-server \/data\/local\/tmp<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"800\" height=\"112\" data-attachment-id=\"3881\" data-permalink=\"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/image-123\/\" data-orig-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-4.png?fit=843%2C118&amp;ssl=1\" data-orig-size=\"843,118\" data-comments-opened=\"1\" data-image-title=\"image\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-4.png?fit=800%2C112&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-4.png?resize=800%2C112&#038;ssl=1\" alt=\"\" class=\"wp-image-3881\" srcset=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-4.png?w=843&amp;ssl=1 843w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-4.png?resize=300%2C42&amp;ssl=1 300w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-4.png?resize=768%2C108&amp;ssl=1 768w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Change the privileges of it:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>adb -s emulator-5554 shell \"chmod 755 \/data\/local\/tmp\/frida-server\"<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"800\" height=\"105\" data-attachment-id=\"3882\" data-permalink=\"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/image-124\/\" data-orig-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-5.png?fit=801%2C105&amp;ssl=1\" data-orig-size=\"801,105\" data-comments-opened=\"1\" data-image-title=\"image\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-5.png?fit=800%2C105&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-5.png?resize=800%2C105&#038;ssl=1\" alt=\"\" class=\"wp-image-3882\" srcset=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-5.png?w=801&amp;ssl=1 801w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-5.png?resize=300%2C39&amp;ssl=1 300w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-5.png?resize=768%2C101&amp;ssl=1 768w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Through a root shell execute the server:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.\/frida-server &amp;<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"548\" height=\"113\" data-attachment-id=\"3883\" data-permalink=\"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/image-125\/\" data-orig-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-6.png?fit=548%2C113&amp;ssl=1\" data-orig-size=\"548,113\" data-comments-opened=\"1\" data-image-title=\"image\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-6.png?fit=548%2C113&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-6.png?resize=548%2C113&#038;ssl=1\" alt=\"\" class=\"wp-image-3883\" srcset=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-6.png?w=548&amp;ssl=1 548w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-6.png?resize=300%2C62&amp;ssl=1 300w\" sizes=\"(max-width: 548px) 100vw, 548px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Get the application ID name:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>pm list packages -f<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"800\" height=\"44\" data-attachment-id=\"3884\" data-permalink=\"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/image-126\/\" data-orig-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-7.png?fit=1295%2C72&amp;ssl=1\" data-orig-size=\"1295,72\" data-comments-opened=\"1\" data-image-title=\"image\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-7.png?fit=800%2C44&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-7.png?resize=800%2C44&#038;ssl=1\" alt=\"\" class=\"wp-image-3884\" srcset=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-7.png?w=1295&amp;ssl=1 1295w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-7.png?resize=300%2C17&amp;ssl=1 300w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-7.png?resize=768%2C43&amp;ssl=1 768w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">As I mentioned before, frida accepts to use JavaScripts Hooks to bypass SSL Pinning, in this case this application was wroten with Flutter. So, we will use a specifc JS Hook to be able to bypass it:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>frida -U -f application_ID_Name --codeshare TheDauntless\/disable-flutter-tls-v1<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"800\" height=\"303\" data-attachment-id=\"3885\" data-permalink=\"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/image-127\/\" data-orig-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-8.png?fit=949%2C360&amp;ssl=1\" data-orig-size=\"949,360\" data-comments-opened=\"1\" data-image-title=\"image\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-8.png?fit=800%2C303&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-8.png?resize=800%2C303&#038;ssl=1\" alt=\"\" class=\"wp-image-3885\" srcset=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-8.png?w=949&amp;ssl=1 949w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-8.png?resize=300%2C114&amp;ssl=1 300w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-8.png?resize=768%2C291&amp;ssl=1 768w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">It is necessary to enbale the proxy on our Android pointing to our Burp Suite:<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"800\" height=\"632\" data-attachment-id=\"3886\" data-permalink=\"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/image-128\/\" data-orig-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-9.png?fit=820%2C648&amp;ssl=1\" data-orig-size=\"820,648\" data-comments-opened=\"1\" data-image-title=\"image\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-9.png?fit=800%2C632&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-9.png?resize=800%2C632&#038;ssl=1\" alt=\"\" class=\"wp-image-3886\" srcset=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-9.png?w=820&amp;ssl=1 820w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-9.png?resize=300%2C237&amp;ssl=1 300w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-9.png?resize=768%2C607&amp;ssl=1 768w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Then, once we interact with the application we will start to receive all the requests:<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"800\" height=\"554\" data-attachment-id=\"3887\" data-permalink=\"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/image-129\/\" data-orig-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-10.png?fit=1377%2C954&amp;ssl=1\" data-orig-size=\"1377,954\" data-comments-opened=\"1\" data-image-title=\"image\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-10.png?fit=800%2C554&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-10.png?resize=800%2C554&#038;ssl=1\" alt=\"\" class=\"wp-image-3887\" srcset=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-10.png?w=1377&amp;ssl=1 1377w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-10.png?resize=300%2C208&amp;ssl=1 300w, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image-10.png?resize=768%2C532&amp;ssl=1 768w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">I hope you liked this post! &amp; Remember that you can find more intersting posts on the<a href=\"https:\/\/hardsoftsecurity.es\/index.php\/blog\/\">&nbsp;blog section<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Happy Hacking!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Here we go again! Today we will be talking about SSL Pinning Bypass in Android. Due the recent cybersecurity congress that I have assisted, specifically, the last weekend (BSides Vienna) &#8230;<\/p>\n","protected":false},"author":1,"featured_media":3877,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[563],"tags":[566,569,568,567,564,565],"class_list":["post-3820","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-pentest","tag-android","tag-android-studio","tag-flutter","tag-frida","tag-ssl-pinning","tag-ssl-pinning-bypass"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>SSL Pinning Bypass - Android - Hardsoft Security<\/title>\n<meta name=\"description\" content=\"Here we go again! Today we will be talking about SSL Pinning Bypass in Android. Due the recent cybersecurity congress that I have assisted...\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/\" \/>\n<meta property=\"og:locale\" content=\"es_ES\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SSL Pinning Bypass - Android - Hardsoft Security\" \/>\n<meta property=\"og:description\" content=\"Here we go again! Today we will be talking about SSL Pinning Bypass in Android. Due the recent cybersecurity congress that I have assisted...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/\" \/>\n<meta property=\"og:site_name\" content=\"Hardsoft Security\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/HardSoftDavid\" \/>\n<meta property=\"article:published_time\" content=\"2025-11-26T19:34:01+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-11-26T19:34:08+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"1024\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"david\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@DavidDeMaya\" \/>\n<meta name=\"twitter:site\" content=\"@DavidDeMaya\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"david\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tiempo de lectura\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2025\\\/11\\\/26\\\/ssl-pinning-bypass-android\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2025\\\/11\\\/26\\\/ssl-pinning-bypass-android\\\/\"},\"author\":{\"name\":\"david\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\"},\"headline\":\"SSL Pinning Bypass &#8211; Android\",\"datePublished\":\"2025-11-26T19:34:01+00:00\",\"dateModified\":\"2025-11-26T19:34:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2025\\\/11\\\/26\\\/ssl-pinning-bypass-android\\\/\"},\"wordCount\":1192,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2025\\\/11\\\/26\\\/ssl-pinning-bypass-android\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2025\\\/11\\\/image.png?fit=1024%2C1024&ssl=1\",\"keywords\":[\"Android\",\"Android Studio\",\"Flutter\",\"Frida\",\"SSL Pinning\",\"SSL Pinning Bypass\"],\"articleSection\":[\"Pentest\"],\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2025\\\/11\\\/26\\\/ssl-pinning-bypass-android\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2025\\\/11\\\/26\\\/ssl-pinning-bypass-android\\\/\",\"url\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2025\\\/11\\\/26\\\/ssl-pinning-bypass-android\\\/\",\"name\":\"SSL Pinning Bypass - Android - Hardsoft Security\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2025\\\/11\\\/26\\\/ssl-pinning-bypass-android\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2025\\\/11\\\/26\\\/ssl-pinning-bypass-android\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2025\\\/11\\\/image.png?fit=1024%2C1024&ssl=1\",\"datePublished\":\"2025-11-26T19:34:01+00:00\",\"dateModified\":\"2025-11-26T19:34:08+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\"},\"description\":\"Here we go again! Today we will be talking about SSL Pinning Bypass in Android. Due the recent cybersecurity congress that I have assisted...\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2025\\\/11\\\/26\\\/ssl-pinning-bypass-android\\\/#breadcrumb\"},\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2025\\\/11\\\/26\\\/ssl-pinning-bypass-android\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2025\\\/11\\\/26\\\/ssl-pinning-bypass-android\\\/#primaryimage\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2025\\\/11\\\/image.png?fit=1024%2C1024&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2025\\\/11\\\/image.png?fit=1024%2C1024&ssl=1\",\"width\":1024,\"height\":1024},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2025\\\/11\\\/26\\\/ssl-pinning-bypass-android\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\\\/\\\/hardsoftsecurity.es\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SSL Pinning Bypass &#8211; Android\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#website\",\"url\":\"https:\\\/\\\/hardsoftsecurity.es\\\/\",\"name\":\"Hardsoft Security\",\"description\":\"Chasing (In)Security\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/hardsoftsecurity.es\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"es\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\",\"name\":\"david\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"caption\":\"david\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"SSL Pinning Bypass - Android - Hardsoft Security","description":"Here we go again! Today we will be talking about SSL Pinning Bypass in Android. Due the recent cybersecurity congress that I have assisted...","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/","og_locale":"es_ES","og_type":"article","og_title":"SSL Pinning Bypass - Android - Hardsoft Security","og_description":"Here we go again! Today we will be talking about SSL Pinning Bypass in Android. Due the recent cybersecurity congress that I have assisted...","og_url":"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/","og_site_name":"Hardsoft Security","article_publisher":"https:\/\/www.facebook.com\/HardSoftDavid","article_published_time":"2025-11-26T19:34:01+00:00","article_modified_time":"2025-11-26T19:34:08+00:00","og_image":[{"width":1024,"height":1024,"url":"https:\/\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image.png","type":"image\/png"}],"author":"david","twitter_card":"summary_large_image","twitter_creator":"@DavidDeMaya","twitter_site":"@DavidDeMaya","twitter_misc":{"Escrito por":"david","Tiempo de lectura":"8 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/#article","isPartOf":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/"},"author":{"name":"david","@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a"},"headline":"SSL Pinning Bypass &#8211; Android","datePublished":"2025-11-26T19:34:01+00:00","dateModified":"2025-11-26T19:34:08+00:00","mainEntityOfPage":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/"},"wordCount":1192,"commentCount":0,"image":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image.png?fit=1024%2C1024&ssl=1","keywords":["Android","Android Studio","Flutter","Frida","SSL Pinning","SSL Pinning Bypass"],"articleSection":["Pentest"],"inLanguage":"es","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/","url":"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/","name":"SSL Pinning Bypass - Android - Hardsoft Security","isPartOf":{"@id":"https:\/\/hardsoftsecurity.es\/#website"},"primaryImageOfPage":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/#primaryimage"},"image":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image.png?fit=1024%2C1024&ssl=1","datePublished":"2025-11-26T19:34:01+00:00","dateModified":"2025-11-26T19:34:08+00:00","author":{"@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a"},"description":"Here we go again! Today we will be talking about SSL Pinning Bypass in Android. Due the recent cybersecurity congress that I have assisted...","breadcrumb":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/#breadcrumb"},"inLanguage":"es","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/"]}]},{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/#primaryimage","url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image.png?fit=1024%2C1024&ssl=1","contentUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image.png?fit=1024%2C1024&ssl=1","width":1024,"height":1024},{"@type":"BreadcrumbList","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2025\/11\/26\/ssl-pinning-bypass-android\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/hardsoftsecurity.es\/"},{"@type":"ListItem","position":2,"name":"SSL Pinning Bypass &#8211; Android"}]},{"@type":"WebSite","@id":"https:\/\/hardsoftsecurity.es\/#website","url":"https:\/\/hardsoftsecurity.es\/","name":"Hardsoft Security","description":"Chasing (In)Security","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hardsoftsecurity.es\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"es"},{"@type":"Person","@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a","name":"david","image":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","caption":"david"}}]}},"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p7xGFx-ZC","jetpack-related-posts":[{"id":3759,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2024\/12\/25\/deploying-secure-red-team-infrastructure\/","url_meta":{"origin":3820,"position":0},"title":"Deploying Secure Red Team Infrastructure","author":"david","date":"diciembre 25, 2024","format":false,"excerpt":"Welcome to a new post, where we are going to see how to deploy a secure Red Team infrastructure. We will se how to deploy legit services to perform phishing and hide our C2 traffic through HTTPS protocol. Disclaimer The information provided in this post is intended for educational purposes\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/12\/redteam-1.png?fit=1200%2C617&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/12\/redteam-1.png?fit=1200%2C617&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/12\/redteam-1.png?fit=1200%2C617&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/12\/redteam-1.png?fit=1200%2C617&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2024\/12\/redteam-1.png?fit=1200%2C617&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":3287,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/09\/06\/seguridad-wordpress-2023-top-10-para-pymes-y-blogueros\/","url_meta":{"origin":3820,"position":1},"title":"Seguridad WordPress 2023: Top 10 para PYMES y Blogueros","author":"david","date":"septiembre 6, 2023","format":false,"excerpt":"En el entorno digital actual, garantizar la seguridad WordPress es esencial, especialmente de cara al 2023. Las amenazas cibern\u00e9ticas son constantes, evolucionan r\u00e1pidamente y tu sitio web puede ser un objetivo. Aqu\u00ed te presentamos medidas esenciales y plugins de seguridad WordPress que todo profesional, ya sea en PYMES o blogueros,\u2026","rel":"","context":"En \u00abInformaci\u00f3n\u00bb","block_context":{"text":"Informaci\u00f3n","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/informacion\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/09\/wordpress.jpg?fit=1200%2C400&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/09\/wordpress.jpg?fit=1200%2C400&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/09\/wordpress.jpg?fit=1200%2C400&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/09\/wordpress.jpg?fit=1200%2C400&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/09\/wordpress.jpg?fit=1200%2C400&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":3072,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/06\/07\/hack-the-box-pc-write-up\/","url_meta":{"origin":3820,"position":2},"title":"Hack The Box | PC | Write Up","author":"david","date":"junio 7, 2023","format":false,"excerpt":"Hey there, Cyber Warriors! \ud83d\ude80 Cracking the code, stepping into the mind of the creator, and uncovering secrets no one else has discovered yet \u2014 this is the thrill of Capture The Flag (CTF) challenges, and today I'll take you on a fascinating journey through one of the most compelling\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-13.png?fit=1200%2C1035&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-13.png?fit=1200%2C1035&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-13.png?fit=1200%2C1035&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-13.png?fit=1200%2C1035&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/06\/image-13.png?fit=1200%2C1035&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":121,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2014\/11\/06\/instalacion-servicio-http-en-windowslinux-server\/","url_meta":{"origin":3820,"position":3},"title":"Instalaci\u00f3n servicio HTTP en Windows\/Linux Server","author":"david","date":"noviembre 6, 2014","format":false,"excerpt":"La gu\u00eda tiene una configuraci\u00f3n esta predeterminada para solucionar lo que exijo: Ubuntu Server 12.04: Instalaci\u00f3n del servicio. Configuraci\u00f3n: Sustituir que la p\u00e1gina por defecto no sea \u00edndex.html, sino campico.php Debe proporcionar posibilidad de ejecutar php. Configuraci\u00f3n: Certificado SSL. Host Virtual. Autenticaci\u00f3n a una carpeta determinada (Apache) Windows 2008 Server:\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1503,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2018\/05\/17\/uac-bypass-fodhelper-windows-10\/","url_meta":{"origin":3820,"position":4},"title":"UAC-bypass Fodhelper Windows 10.","author":"david","date":"mayo 17, 2018","format":false,"excerpt":"Hola buenas a todos, despu\u00e9s de llevar un tiempo sin publicar nada, hoy os traigo una entrada con un v\u00eddeo bastante interesante donde se puede ver como mediante un script escrito en power shell. Para m\u00e1s informaci\u00f3n de como se realiza el bypass a UAC de windows, pod\u00e9is acceder a\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/05\/bypass-uac-using-dll-hijacking.1280x600.jpg?fit=1200%2C563&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/05\/bypass-uac-using-dll-hijacking.1280x600.jpg?fit=1200%2C563&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/05\/bypass-uac-using-dll-hijacking.1280x600.jpg?fit=1200%2C563&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/05\/bypass-uac-using-dll-hijacking.1280x600.jpg?fit=1200%2C563&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2018\/05\/bypass-uac-using-dll-hijacking.1280x600.jpg?fit=1200%2C563&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":1943,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2019\/12\/19\/uac-bypass-windows-10\/","url_meta":{"origin":3820,"position":5},"title":"UAC ByPass Windows 10.","author":"david","date":"diciembre 19, 2019","format":false,"excerpt":"Hola a tod@s en este art\u00edculo voy a explicar una de las t\u00e9cnicas para hacer \"UAC ByPass\" a un Windows 10 relativamente actualizado, se podr\u00e1 ver como mediante la utilizaci\u00f3n de herramientas se edita el registro de Windows 10 para poder tener una cmd con privilegios de administrador sin necesidad\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2019\/12\/Screenshot_14.png?fit=470%2C323&ssl=1&resize=350%2C200","width":350,"height":200},"classes":[]}],"jetpack_likes_enabled":true,"jetpack_featured_media_url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2025\/11\/image.png?fit=1024%2C1024&ssl=1","_links":{"self":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/3820","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/comments?post=3820"}],"version-history":[{"count":2,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/3820\/revisions"}],"predecessor-version":[{"id":3888,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/3820\/revisions\/3888"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/media\/3877"}],"wp:attachment":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/media?parent=3820"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/categories?post=3820"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/tags?post=3820"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}