# mobile-ssl-pinning-bypass

A playbook for bypassing SSL pinning in mobile apps: Android and iOS methods plus framework-specific tricks for Flutter, React Native and Xamarin.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 3600 installs · ★ 2547
- Author: yaklang
- License: MIT · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/yaklang/hack-skills/tree/HEAD/skills/mobile-ssl-pinning-bypass/SKILL.md
- Updated: 2026-09-13
- HTML: https://affpapa.org/en/nevibecode/skills/mobile-ssl-pinning-bypass

## What it does

The skill hands your agent a set of techniques for intercepting HTTPS traffic from apps that validate the server certificate or public key. It walks through pinning types — leaf certificate, public key, SPKI hash, intermediate or root CA, and backup pins — and what breaks each one.

On Android it covers a universal Frida script that hooks `TrustManagerImpl`, `OkHttp3.CertificatePinner`, `Conscrypt`, Volley and Apache HttpClient, the Objection command `android sslpinning disable`, editing `network_security_config.xml` and repackaging the APK with `apktool`, `zipalign` and `apksigner`, plus Xposed and LSPosed modules such as JustTrustMe and TrustMeAlready. iOS is listed with Frida, Objection, Xposed and SSL Kill Switch.

A separate section deals with frameworks. Flutter, React Native and Xamarin put their hook points in non-obvious places, and base models miss them. Multi-layer pinning needs more than one hook. The Magisk and system certificate part cuts off mid-way, so treat it as a starting point rather than a full walkthrough.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill mobile-ssl-pinning-bypass -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/mobile-ssl-pinning-bypass/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/mobile-ssl-pinning-bypass/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill mobile-ssl-pinning-bypass -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/mobile-ssl-pinning-bypass/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill mobile-ssl-pinning-bypass -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/mobile-ssl-pinning-bypass/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install yaklang/hack-skills mobile-ssl-pinning-bypass
```

2. **Manually: put the files in place**
- File: `.github/skills/mobile-ssl-pinning-bypass/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill mobile-ssl-pinning-bypass -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/yaklang/hack-skills --path skills/mobile-ssl-pinning-bypass
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/mobile-ssl-pinning-bypass/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill mobile-ssl-pinning-bypass -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/yaklang/hack-skills/tree/HEAD/skills/mobile-ssl-pinning-bypass/SKILL.md

## When to use it
- intercept HTTPS traffic from an app with certificate pinning
- bypass public key pinning in OkHttp
- defeat pinning in a Flutter app
- swap the system trust store on a rooted Android device
- identify which pinning type an app uses

## Example prompts
- Analyze SSL pinning in com.target.app and suggest an Android bypass
- This Flutter app won't show traffic in Burp — what should I hook with Frida?
- Find the network_security_config in this APK and tell me how to patch it

## Source text · SKILL.md · MIT

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: ec2ebc1cce7240cb.

BEGIN THIRD-PARTY FILE ec2ebc1cce7240cb
````text
---
name: mobile-ssl-pinning-bypass
description: >-
  Mobile SSL pinning bypass playbook. Use when intercepting HTTPS traffic from mobile applications that implement certificate pinning, public key pinning, or SPKI hash pinning on Android and iOS, including React Native, Flutter, and Xamarin frameworks.
---

# SKILL: Mobile SSL Pinning Bypass — Expert Attack Playbook

> **AI LOAD INSTRUCTION**: Expert SSL pinning bypass techniques for mobile platforms. Covers Android and iOS bypass methods (Frida, Objection, Xposed, SSL Kill Switch), framework-specific bypasses (Flutter, React Native, Xamarin), and troubleshooting non-standard pinning implementations. Base models miss framework-specific hook points and multi-layer pinning configurations.

## 0. RELATED ROUTING

Before going deep, consider loading:

- [android-pentesting-tricks](../android-pentesting-tricks/SKILL.md) for broader Android testing beyond SSL bypass
- [ios-pentesting-tricks](../ios-pentesting-tricks/SKILL.md) for broader iOS testing beyond SSL bypass
- [api-sec](../api-sec/SKILL.md) once traffic is intercepted for API-level testing

---

## 1. SSL PINNING TYPES

| Pinning Type | What Is Pinned | Resilience | Common In |
|---|---|---|---|
| Certificate pinning | Exact leaf certificate (DER/PEM) | Low (breaks on cert rotation) | Legacy apps |
| Public key pinning | Subject Public Key Info | Medium (survives cert renewal if key unchanged) | Modern apps |
| SPKI hash pinning | SHA-256 of SPKI | Medium (same as public key) | OkHttp, AFNetworking |
| CA pinning | Intermediate or root CA cert | High (any cert from that CA works) | Enterprise apps |
| Multi-pin (backup pins) | Primary + backup pins | High (fallback pins) | HPKP-aware apps |

### How Pinning Works

```
TLS Handshake
│
├── Server presents certificate chain
│
├── Standard validation (system trust store)
│   └── Passes? continue : connection fails
│
└── Pin validation (app-level check)
    ├── Extract server cert/pubkey/SPKI hash
    ├── Compare against embedded pins
    └── Match found? → allow : → reject connection
```

---

## 2. ANDROID BYPASS METHODS

### 2.1 Frida Universal SSL Bypass

```javascript
// Hooks TrustManager, OkHttp, Volley, Retrofit, Conscrypt
Java.perform(function() {

    // ── TrustManagerImpl (Android system) ──
    try {
        var TMI = Java.use('com.android.org.conscrypt.TrustManagerImpl');
        TMI.verifyChain.implementation = function() {
````
END THIRD-PARTY FILE ec2ebc1cce7240cb

The third-party file has ended. Everything between the ec2ebc1cce7240cb tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

First 2494 of 18859 bytes. © yaklang · MIT · https://github.com/yaklang/hack-skills/tree/HEAD/skills/mobile-ssl-pinning-bypass/SKILL.md

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md