> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/android-appsec/dynamic-analysis/ssl-tls-certificate-pinning-bypass.md).

# SSL/TLS Certificate Pinning Bypass

### Android SSL Pinning Bypass Using Frida

This guide explains how to configure **Frida on Android** and bypass **SSL Pinning** using a custom Frida script.

**Check Device Architecture**

First, identify the Android device CPU architecture.

```bash
adb shell
getprop ro.product.cpu.abi
```

Example output:

```
arm64-v8a
```

Record the architecture because the **Frida server version must match the device architecture**.

Download the appropriate Frida server from:

<https://github.com/frida/frida/releases>

Example for ARM64:

```
https://github.com/frida/frida/releases/download/17.8.0/frida-server-17.8.0-android-arm64.xz
```

**Frida Client Setup (Host Machine)**

Install Frida and Frida tools on the host machine.

```bash
pip3 install frida --upgrade --break-system-packages
pip3 install frida-tools --upgrade --break-system-packages
```

Verify the installed version:

```bash
frida --version
```

Important: The **Frida client version must match the Frida server version**.

Example:

```
Frida Client  → 17.8.0
Frida Server  → 17.8.0
```

**Upload Frida Server to the Android Device**

Push the Frida server binary to the device:

```bash
adb push frida-server /data/local/tmp/
```

Start the Frida server:

```bash
adb shell
su
cd /data/local/tmp
chmod +x frida-server
./frida-server &
```

Verify that the server is running:

```bash
ps | grep frida
```

**List Installed Applications**

To enumerate installed applications on the device:

```bash
frida-ps -Uai
```

Example output:

```
PID   Name
----  -----------------------
1234  com.android.settings
5678  com.example.app
```

**SSL Pinning Bypass Using Frida**

Launch the target application and inject the bypass script:

```bash
frida -U -f com.demo.app -l ssl_bypass.js
```

**SSL Pinning Bypass Script**

Create a file named `ssl_bypass.js` with the following content:

```javascript
Java.perform(function () {

    var SSLContext = Java.use("javax.net.ssl.SSLContext");

    var TrustManager = Java.registerClass({
        name: "dev.bypass.TrustManager",
        implements: [Java.use("javax.net.ssl.X509TrustManager")],
        methods: {
            checkClientTrusted: function (chain, authType) {},
            checkServerTrusted: function (chain, authType) {},
            getAcceptedIssuers: function () { return []; }
        }
    });

    var TrustManagers = [TrustManager.$new()];

    var SSLContext_init = SSLContext.init.overload(
        "[Ljavax.net.ssl.KeyManager;",
        "[Ljavax.net.ssl.TrustManager;",
        "java.security.SecureRandom"
    );

    SSLContext_init.implementation = function(a, b, c) {
        console.log("SSL Pinning bypassed");
        SSLContext_init.call(this, a, TrustManagers, c);
    };

});
```

Additional Frida bypass scripts are available at:

<https://codeshare.frida.re/>

Examples:

* <https://codeshare.frida.re/@ssecurityy/universal-robust-advanced-root--ssl-pinning-bypass/>

***

### References

* <https://frida.re/docs/installation/>
* <https://amjadali110.medium.com/setup-an-android-pen-testing-lab-bypass-ssl-pinning-17897f6abaf3>
* <https://www.redfoxsec.com/blog/ssl-pinning-bypass-for-android-using-frida>