Frida TLS Pinning
Use this skill when HTTPS traffic is blocked by certificate pinning or custom trust validation.
Identify The Stack First
- Android Java: OkHttp, TrustManager, Conscrypt, WebView, network security config.
- Android native: BoringSSL, OpenSSL, Cronet, proxygen, Flutter engine.
- iOS:
NSURLSession, delegate trust challenges, SecTrustEvaluate*, native BoringSSL.
- Cross-platform: React Native, Flutter, Unity, custom native networking.
Do not start with a universal bypass as the final answer. Use public scripts to discover which hook fires, then keep only the needed hooks.
Android Probe
Java.perform(() => {
for (const name of [
"okhttp3.CertificatePinner",
"com.android.org.conscrypt.TrustManagerImpl",
"javax.net.ssl.SSLContext"
]) {
try { console.log("found", name, Java.use(name)); } catch (_) {}
}
});
iOS Probe
if (ObjC.available) {
for (const name of Object.keys(ObjC.classes).filter(n => n.includes("Trust") || n.includes("Session"))) {
console.log(name);
}
}
Native Probe
for (const m of Process.enumerateModules()) {
if (/ssl|crypto|boring|cronet|liger/i.test(m.name)) console.log(m.name, m.base, m.path);
}
Verification
- Proxy is trusted by the device or app profile.
- The hook logs during the exact request that was blocked.
- The same request succeeds after mutation.
- Traffic is visible or the app behavior proves trust validation was bypassed.
- The final script documents app version, platform, library, and rollback command.
References
Read references/tls-patterns.md for framework-specific hook options.
1---2name: frida-tls-pinning3description: Analyze and bypass TLS or SSL pinning with Frida on Android, iOS, Flutter, React Native, native BoringSSL/OpenSSL, Conscrypt, OkHttp, NSURLSession, SecTrust, and app-specific trust code.4---56# Frida TLS Pinning78Use this skill when HTTPS traffic is blocked by certificate pinning or custom trust validation.910## Identify The Stack First1112- Android Java: OkHttp, TrustManager, Conscrypt, WebView, network security config.13- Android native: BoringSSL, OpenSSL, Cronet, proxygen, Flutter engine.14- iOS: `NSURLSession`, delegate trust challenges, `SecTrustEvaluate*`, native BoringSSL.15- Cross-platform: React Native, Flutter, Unity, custom native networking.1617Do not start with a universal bypass as the final answer. Use public scripts to discover which hook fires, then keep only the needed hooks.1819## Android Probe2021```js22Java.perform(() => {23 for (const name of [24 "okhttp3.CertificatePinner",25 "com.android.org.conscrypt.TrustManagerImpl",26 "javax.net.ssl.SSLContext"27 ]) {28 try { console.log("found", name, Java.use(name)); } catch (_) {}29 }30});31```3233## iOS Probe3435```js36if (ObjC.available) {37 for (const name of Object.keys(ObjC.classes).filter(n => n.includes("Trust") || n.includes("Session"))) {38 console.log(name);39 }40}41```4243## Native Probe4445```js46for (const m of Process.enumerateModules()) {47 if (/ssl|crypto|boring|cronet|liger/i.test(m.name)) console.log(m.name, m.base, m.path);48}49```5051## Verification5253- Proxy is trusted by the device or app profile.54- The hook logs during the exact request that was blocked.55- The same request succeeds after mutation.56- Traffic is visible or the app behavior proves trust validation was bypassed.57- The final script documents app version, platform, library, and rollback command.5859## References6061Read `references/tls-patterns.md` for framework-specific hook options.
rudra-ravi