SSL Pinning Bypass
Part 6 of the Android Pentest series.
Installing your CA gets the OS to trust your proxy. Certificate pinning defeats that anyway — the app only trusts a specific cert it ships with, so even a trusted MITM cert is rejected. You have to disable the pinning logic itself.
Pick the right approach
| App type | Tool | Notes |
|---|---|---|
Standard Android (OkHttp, TrustManagerImpl) | Objection | Fastest; one command |
| Flutter / custom native TLS | Frida (frida_ssl.js) | BoringSSL pattern matching |
| Flutter, Frida fragile vs. engine | ReFlutter | Static repackaging fallback |
Objection — the quick method
Objection is the fastest path for apps using standard Android SSL pinning. It does not cover Flutter or custom native pinning.
# Attach to the running app (USB)
objection -g <package.name> explore -q
# Inside the Objection REPL
android sslpinning disable
📌 Objection over Wi-Fi. Objection talks through Frida on port 27042. With ADB over Wi-Fi, forward the port first:
adb forward tcp:27042 tcp:27042Then Objection behaves exactly as over USB.
Frida — Flutter and native apps
For Flutter apps or custom native TLS verification, use
frida_ssl.js. It patches BoringSSL’s
ssl_verify_peer_cert at the native level using architecture-specific byte
patterns (arm64, arm, x64), so it works even on stripped/custom binaries
where symbol-based hooking fails.
frida -U -f <package.name> -l script/frida_ssl.js
⚠️ If the Flutter bypass doesn’t work. The BoringSSL byte pattern changes between Flutter engine versions. Check the warning at the top of
frida_ssl.jsand consult NVISO’s troubleshooting guide for updated patterns. The script retries the memory scan after ~20s before giving up.
ReFlutter — static fallback
When the runtime patch is fragile against a particular Flutter engine, ReFlutter re-packages the app with a modified engine — no Frida at runtime. The full repackaging steps are in Certificate Injection — Android 14+.
Order of operations
A common mistake is bypassing pinning before the OS trusts your CA at all. The correct sequence:
1. Install proxy CA → /pentest/cert-injection-pre14/ (or android14)
2. Bypass root detection → /pentest/root-detection-bypass/
3. Bypass SSL pinning → this page
4. Route traffic to the proxy → /pentest/traffic-interception/
See also
- Previous: Root Detection Bypass
- Next: Traffic Interception
- Tools & Scripts — the BoringSSL patcher internals