> For the complete documentation index, see [llms.txt](https://calvin-lai.gitbook.io/calvin-lai-security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://calvin-lai.gitbook.io/calvin-lai-security/penetration-testing/mobile-penetration-test/certificate-pinning/certificate-pinning-bypass-android.md).

# Certificate Pinning Bypass (Android)

Bypassing certificate pinning using three different methods: Frida, Xposed Framework with JustTrustMe, and Modifying APK.

## Method 1: Using Frida

**Frida** is a powerful tool for dynamic instrumentation, allowing you to hook into an app's runtime and modify its behavior.

**Steps to Implement Certificate Pinning Bypass with Frida:**

1. **Set Up Your Environment:**

* Install Frida on your testing device and your computer.

  * On your computer:

    bash

    ```
    pip install frida-tools
    ```
  * On your Android device:

    bash

    ```
    adb push frida-server /data/local/tmp/
    adb shell "chmod 755 /data/local/tmp/frida-server"
    adb shell "/data/local/tmp/frida-server &"
    ```

  [Reference to  the Frida installation guide for details.](https://frida.re/docs/installation/)

2. **Create a Bypass Script:**

* Write a Frida script to bypass SSL pinning. Save the script as `bypass_script.js`.

  ```javascript
  // Frida script to bypass SSL pinning
  Java.perform(function () {
      var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
      var SSLContext = Java.use('javax.net.ssl.SSLContext');

      // Custom TrustManager that does not validate certificates
      var TrustManager = Java.registerClass({
          name: 'com.example.TrustManager',
          implements: [X509TrustManager],
          methods: {
              checkClientTrusted: function (chain, authType) {},
              checkServerTrusted: function (chain, authType) {},
              getAcceptedIssuers: function () { return []; }
          }
      });

      // Hook SSLContext to use our custom TrustManager
      SSLContext.init.overload(
          '[Ljavax.net.ssl.KeyManager;',
          '[Ljavax.net.ssl.TrustManager;',
          'java.security.SecureRandom'
      ).implementation = function (keyManager, trustManager, secureRandom) {
          var customTrustManager = [TrustManager.$new()];
          this.init(keyManager, customTrustManager, secureRandom);
      };
  });
  ```

3. **Run the Script:**

* Use Frida to run the script on your Android device. Ensure your device is connected and Frida server is running:

  ```bash
  frida -U -f com.yourapp.package -l bypass_script.js --no-pause
  ```

4. **Test the App:**

* [Set Up Proxy Tool - Burp Suite ](/calvin-lai-security/penetration-testing/mobile-penetration-test/certificate-pinning/certificate-pinning-bypass-android/setup-proxy-tool-burp-suite.md)
* Interact with the app and monitor network traffic using tools like Burp Suite to ensure the certificate pinning is bypassed.

## Method 2: Using Xposed Framework and JustTrustMe

**Prerequisites**

* **Rooted Android Device:** Ensure your device is rooted to install the Xposed Framework.
* **Xposed Framework Installed:** The Xposed Framework should be installed on your rooted device.

**Steps:**

1. **Root Your Android Device:**
   * Ensure your Android device is rooted. You can find specific guides for rooting your device based on its model and Android version. Popular tools for rooting include [Magisk ](https://www.kingoapp.com/root-tutorials/best-top-root-apps-tool-for-android.htm)and [Azerokit](https://github.com/ejrv/Azerokit).
   * Follow the [Root a Android Device](/calvin-lai-security/penetration-testing/mobile-penetration-test/certificate-pinning/certificate-pinning-bypass-android/root-a-android-device.md) for details
2. **Install Xposed Framework:**
   * Download the Xposed Installer APK from the [official Xposed website](https://repo.xposed.info/).
   * Install the Xposed Installer APK on your device.
   * Open the Xposed Installer and install the framework by selecting "Framework" and then "Install/Update."
   * Reboot your device to apply the changes.
3. **Install JustTrustMe Module:**
   * Open the Xposed Installer app.
   * Go to the "Downloads" section and search for the "JustTrustMe" module.
   * Download and install the JustTrustMe module.
   * After installation, go to the "Modules" section in the Xposed Installer and check the box next to JustTrustMe to activate it.
4. **Reboot Your Device:**
   * Reboot your device to apply the changes and ensure the module is active.
5. [**Set Up Proxy Tool - Burp Suite** ](/calvin-lai-security/penetration-testing/mobile-penetration-test/certificate-pinning/certificate-pinning-bypass-android/setup-proxy-tool-burp-suite.md)
6. **Test the App:**
   * Open your app and perform actions that require network communication.
   * With JustTrustMe activated, the app should bypass certificate pinning, allowing Burp Suite to intercept and analyze the traffic.
7. **Monitor Network Traffic:**
   * Use Burp Suite to monitor and analyze the intercepted traffic. You should now be able to see and manipulate the encrypted data that the app sends and receives.

## Method 3: Modifying APK

**Prerequisites**

* **APKTool** installed on your computer.
* **Java Development Kit (JDK)** installed.
* **Android Debug Bridge (ADB)** installed and set up.
* **Rooted Android Device** (optional for some steps).

#### Steps:

1. **Set Up Your Environment:**
   * Ensure you have APKTool, JDK, and ADB installed.
   * Set up the environment variables for JDK and ADB for easy access.
2. **Decompile the APK:**
   * Use APKTool to decompile the APK. This will convert the APK into a set of readable files and folders.

     ```bash
     apktool d yourapp.apk -o yourapp
     ```
   * The `yourapp` directory will contain the decompiled files.
3. **Locate Certificate Pinning Logic:**
   * Navigate through the decompiled files to find the network-related code. This is usually located in classes related to SSL/TLS connections.
   * Use a text editor or IDE to search for keywords like `TrustManager`, `HostnameVerifier`, `checkServerTrusted`, or `SSLContext`.
4. **Modify the Code:**
   * Modify the pinning logic to bypass the certificate checks. You can either comment out the pinning logic or modify it to accept all certificates. Example:

     ```java
     // Original pinning logic
     public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
         // Validate the server certificate
     }

     // Modified pinning logic
     public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
         // Accept all certificates
     }
     ```
   * Ensure all necessary changes are made to bypass the pinning.
5. **Recompile the APK:**
   * Use APKTool to recompile the modified APK.

     ```bash
     apktool b yourapp -o yourapp-modified.apk
     ```
   * The recompiled APK (`yourapp-modified.apk`) will be generated in the specified output directory.
6. **Sign the APK:**
   * The recompiled APK needs to be signed before it can be installed on your device. Use the JDK's `jarsigner` tool to sign the APK with a debug certificate.

     ```bash
     jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore ~/.android/debug.keystore yourapp-modified.apk androiddebugkey
     ```
   * When prompted, use the default keystore password (`android`).
7. **Install the Modified APK:**
   * Use ADB to install the modified APK on your Android device.

     bash

     ```
     adb install yourapp-modified.apk
     ```
   * If the app is already installed, you may need to uninstall the existing version first:

     bash

     ```
     adb uninstall com.yourapp.package
     adb install yourapp-modified.apk
     ```
8. **Test the App:**
   * Open the modified app on your Android device and perform actions that require network communication.
   * Use tools like Burp Suite to intercept and analyze the traffic. The certificate pinning should be bypassed, allowing you to intercept the SSL/TLS traffic.