How to bypass SSL pinning on Android using Frida and Objection.

Disabling SSL Pinning Android.md

Bypassing SSL Pinning using Frida and Objection

To use this method you will have to have a rooted Android phone. There are other methods to disable SSL Pinning like modifying the apk, for example apk-mitm, but that doesn't always work for me.

Downloads

1. Download and install frida and frida tools: pip3 install frida frida-tools
2. Download and install objection: pip3 install objection
3. Download frida server for architecture used by the phone you will use: https://github.com/frida/frida/releases
4. Download adb included in platform-tools: Windows: https://dl.google.com/android/repository/platform-tools-latest-windows.zip Linux: https://dl.google.com/android/repository/platform-tools-latest-linux.zip

Frida Server

Moving server file to your phone

1. Extract server file from the zx archive
2. Move server file to /data/local/tmp/frida-server: adb push <path-to-server-file> /data/local/tmp/frida-server

Starting the server

1. Open terminal
2. Open adb shell: adb shell
3. Get root access: su
4. Navigate to /data/local/tmp: cd /data/local/tmp
5. Start frida server: ./frida-server
   • If you're getting permission denied, try updating server permission for executing: chmod +x /frida-server or if that doesn't work, you can try chmod 0777 ./frida-server

Objection

1. Open a new terminal
2. Start a new objection process on the app: objection -g <com.app_name> explore
3. Disable SSL Pinning: android sslpinning disable

Congratulations, you successfully bypassed SSL pinning on your app and you can now intercept HTTP traffic with proxy tools like mitmproxy.