Certificate Pinning Bypass

Detects network configurations and code patterns that disable or bypass certificate pinning, weakening TLS security.

zakirkun Updated

File contents

Certificate Pinning Bypass

Overview

Certificate pinning enhances TLS by restricting which certificates are trusted for specific connections. Bypassing or disabling pinning allows MITM attacks even on apps that previously validated certificates.

Common bypass methods:

  • Setting checkValidity = false in pinning configuration
  • Using a catch-all TrustManager
  • OkHttp pinning disabled
  • Node.js NODE_TLS_REJECT_UNAUTHORIZED=0

Remediation

  • Implement pinning using the native OS keystore or a dedicated library
  • Monitor for pinning bypass attempts
  • Test pinning resistance against tools like Frida, Objection

zakirkun/ice-tea/tree/main/skills/crypto/certificate-pinning-bypass commit f818ed56b1

Frequently asked questions

npx skillmds@latest add zakirkun/certificate-pinning-bypass