<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Mobile Certificate Pinning Testing

## objection SSL Pinning Bypass
```bash
objection -g com.target.app explore -c "android sslpinning disable"
objection -g com.target.app explore -c "ios sslpinning disable"
```

## Frida Bypass Scripts
```javascript
// Universal Android SSL Bypass — hooks TrustManager
Java.perform(function() {
    var TM = Java.use("javax.net.ssl.X509TrustManager");
    var TrustAll = Java.registerClass({
        name: "com.bypass.TrustAll",
        implements: [TM],
        methods: {
            checkClientTrusted: function(chain, authType) {},
            checkServerTrusted: function(chain, authType) {},
            getAcceptedIssuers: function() { return []; }
        }
    });

    var SSLContext = Java.use("javax.net.ssl.SSLContext");
    var ctx = SSLContext.getInstance("TLS");
    ctx.init(null, [TrustAll.$new()], null);
    SSLContext.getInstance.overload('java.lang.String').implementation = function(type) {
        return ctx;
    };
});

// OkHttp CertificatePinner bypass
Java.perform(function() {
    var CP = Java.use("okhttp3.CertificatePinner");
    CP.check.overload('java.lang.String', 'java.util.List').implementation =
        function(hostname, peerCerts) {
            console.log("[*] Bypassing pin check for: " + hostname);
        };
});
```

## Pin Extraction
```bash
# From server certificate
openssl s_client -connect host:443 < /dev/null 2>/dev/null | \
  openssl x509 -pubkey -noout | \
  openssl pkey -pubin -outform DER | \
  openssl dgst -sha256 -binary | base64

# From OkHttp code (look for sha256/ prefix)
grep -rn 'sha256/' jadx_out/

# From network_security_config.xml
grep '<pin' apktool_out/res/xml/network_security_config.xml
```

## Network Security Config Pinning
```xml
<network-security-config>
    <domain-config>
        <domain includeSubdomains="true">api.target.com</domain>
        <pin-set expiration="2025-01-01">
            <pin digest="sha-256">BASE64_HASH=</pin>
            <pin digest="sha-256">BACKUP_PIN=</pin>
        </pin-set>
    </domain-config>
</network-security-config>
```

## mitmproxy Setup
```bash
mitmproxy --mode regular --listen-port 8080 --showhost
# Device proxy: settings → Wi-Fi → proxy → manual → HOST:8080
# Install CA: visit mitm.it on device browser
```
