{"id":2288,"date":"2019-04-09T15:57:24","date_gmt":"2019-04-09T10:27:24","guid":{"rendered":"https:\/\/ninadmathpati.com\/?p=2288"},"modified":"2020-09-13T05:40:43","modified_gmt":"2020-09-13T05:40:43","slug":"all-about-ssl-pinning-bypass","status":"publish","type":"post","link":"https:\/\/ninadmathpati.com\/hi\/2019\/04\/09\/all-about-ssl-pinning-bypass\/","title":{"rendered":"All about SSL pinning bypass!"},"content":{"rendered":"

Hello people, hope you are doing good and playing well with security!<\/p>\n\n\n\n

Today I am here again with a topic known as SSL pinning
What is it?
According to google its something like
“Pinning is an optional mechanism that can be used to improve the security of service or site that relies on SSL Certificates. Pinning allows you to specify a cryptographic identity that should be accepted by users visiting your site. SSL\/TLS uses digital certificates to provide authentication and encryption. To trust that a certificate is genuine and valid, it is digitally signed by a root certificate belonging to a trusted certificate authority (CA)”<\/p>\n\n\n\n

SSL pinning is a security measure taken to reduce Man in the middle attacks it’s done for both Android and <\/em>ios<\/em><\/g><\/g>
<\/em> applications<\/em><\/g>, In general, Certificate Pinning is where you ignore that whole thing, and say trust this certificate only or perhaps trust only certificates signed by this certificate. <\/em><\/p><\/blockquote><\/figure>\n\n\n\n

Android part<\/em><\/strong><\/p>\n\n\n\n

Now to break it or bypass anything we need to know how its build (i prefer learning slowly but conceptually)
Here is a blog that I found on how SSL pinning is implemented in Android<\/a>.<\/p>\n\n\n\n

It’s not that if you don’t know how it’s built you will not be able to crack it, but it will be easy to crack, if you know how to build it.<\/p>\n\n\n\n

In android<\/g> SSL pinning bypass can be done in 4 ways:<\/p>\n\n\n\n

  1. Frida<\/em><\/a><\/li>
  2. Objection<\/em><\/a><\/li>
  3. Xposed Framework<\/em><\/a><\/li>
  4. Manually changing the code.<\/em><\/li><\/ol>\n\n\n\n

    Let’s move on step by step
    <\/p>\n\n\n\n

    1. SSL pinning bypass using Frida<\/u><\/em>
    <\/p>\n\n\n\n

    Frida is a dynamic code instrumentation toolkit. It lets you inject snippets of JavaScript or your own library into native apps on Windows, macOS, GNU\/Linux, iOS, Android, and QNX. <\/p>\n\n\n\n

    In general terms,<\/p>\n\n\n\n

    It helps in Injecting JavaScript to explore native apps on Windows, Mac, Linux, iOS and Android.<\/em> <\/p><\/blockquote>\n\n\n\n

    How can we use Frida to bypass SSL pinning in android?
    Firstly you should install Frida from     here<\/a> for mobile & for a laptop, you can just use the command line.<\/p>\n\n\n\n

    $ pip install frida-tools<\/code><\/pre>\n\n\n\n
    <\/p>\n\n\n\n
    Requirements :<\/p>\n\n\n\n