<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-mobile-certificate-pinning-testing
description: >-
  Test and bypass certificate pinning implementations on Android and iOS
  including OkHttp, TrustManager, AFNetworking, URLSession, and Alamofire
  pinning using Frida, objection, and custom bypass scripts to assess
  pinning strength and network interception resistance.
domain: cybersecurity
subdomain: mobile-security
tags:
  - certificate-pinning
  - ssl-pinning
  - bypass
  - frida
  - objection
  - okhttp
  - trustmanager
  - network-security
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1557", "T1553"]
  owasp-mobile: ["M3"]
  tools: ["frida", "objection", "mitmproxy", "apktool", "jadx"]
---

# Performing Mobile Certificate Pinning Testing

## Overview

Certificate pinning binds an app to specific server certificates or public
keys, preventing MITM attacks even when a CA is compromised. Testing evaluates
pinning implementation strength, bypass resistance, and failure behavior.
Successful bypass during assessment indicates the app can be intercepted by an
attacker with device access.

## Prerequisites

```bash
pip install frida-tools objection mitmproxy
apt install apktool openssl
# jadx: https://github.com/skylot/jadx/releases
# Burp Suite for proxy interception
```

## Workflow

### Step 1: Identify Pinning Implementation

```bash
# Decompile and identify pinning type
jadx -d jadx_out/ target.apk --deobf

# OkHttp CertificatePinner
grep -rn 'CertificatePinner\|certificatePinner\|\.pin(' jadx_out/

# Custom TrustManager
grep -rn 'X509TrustManager\|checkServerTrusted\|TrustManagerFactory' jadx_out/

# Network Security Config pinning
cat apktool_out/res/xml/network_security_config.xml | grep -A5 'pin-set'

# Retrofit / OkHttp interceptors
grep -rn 'OkHttpClient\|Interceptor\|sslSocketFactory' jadx_out/

# iOS — URLSession pinning
# grep for: SecTrustEvaluate, URLAuthenticationChallenge, serverTrust
# ATS custom trust evaluation
```

### Step 2: Objection Automated Bypass

```bash
# Android — disable SSL pinning via objection
objection -g com.target.app explore -c "android sslpinning disable"

# iOS — disable SSL pinning via objection
objection -g com.target.app explore -c "ios sslpinning disable"

# Verify bypass — traffic should now flow through proxy
# Configure mitmproxy on port 8080, set device proxy
mitmproxy --mode regular --listen-port 8080 --showhost
```

### Step 3: Frida Custom Bypass Scripts

```bash
# Universal Android SSL pinning bypass
frida -U -f com.target.app -l universal_ssl_bypass.js --no-pause

# Target-specific OkHttp bypass
frida -U -f com.target.app -l okhttp_bypass.js --no-pause

# TrustManager bypass
frida -U -f com.target.app -l trustmanager_bypass.js --no-pause

# iOS — bypass NSURLSession pinning
frida -U -f com.target.app -l ios_ssl_bypass.js --no-pause

# Multiple library bypass (covers OkHttp, Conscrypt, TrustKit, etc.)
frida -U -f com.target.app -l multi_bypass.js --no-pause
```

### Step 4: Network Security Config Bypass (Android)

```bash
# Modify network_security_config.xml to trust user CAs
apktool d target.apk -o apktool_out/

# Edit res/xml/network_security_config.xml:
# Add <certificates src="user" /> to trust-anchors

# Rebuild and sign
apktool b apktool_out/ -o modified.apk
zipalign -v 4 modified.apk aligned.apk
apksigner sign --ks debug.keystore aligned.apk
adb install aligned.apk
```

### Step 5: Pin Extraction and Verification

```bash
# Extract pinned certificates/keys from the app
grep -rn 'sha256/' jadx_out/  # OkHttp pin format

# Extract pins from network security config
grep -oP 'digest="[^"]+">([^<]+)' apktool_out/res/xml/network_security_config.xml

# Verify against actual server certificate
openssl s_client -connect api.target.com:443 < /dev/null 2>/dev/null | \
  openssl x509 -pubkey -noout | \
  openssl pkey -pubin -outform DER | \
  openssl dgst -sha256 -binary | base64

# Compare extracted pin with server cert — should match
```

### Step 6: Pinning Failure Behavior Testing

```bash
# Test app behavior when pinning fails
# 1. Without bypass — verify connection is blocked
# 2. Check error handling — should not leak server info
# 3. Verify no fallback to unpinned connection

# Frida — monitor pinning failure callbacks
frida -U -f com.target.app -l monitor_pin_failure.js --no-pause

# Check for debug/release build differences
grep -rn 'BuildConfig.DEBUG\|isDebuggable' jadx_out/ | grep -i ssl
# Some apps disable pinning in debug builds
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| No pinning | Code review | No CertificatePinner or TrustManager |
| Weak pinning | NSC analysis | Pin set with long expiration only |
| Bypass success | Runtime test | Objection/Frida bypass succeeds |
| Debug disable | Code review | Pinning disabled in debug builds |
| No failure handling | Behavior test | App crashes instead of graceful fail |

```yaml
title: Mobile Certificate Pinning Testing Detection
id: 4682a0f8-3d24-4d3b-a20b-0eb9a6778369
status: experimental
description: Detects suspicious activity related to performing mobile certificate pinning testing techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1557
  - attack.t1553
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] Pinning implementation type identified
- [ ] Automated bypass attempted (objection)
- [ ] Custom Frida bypass scripts tested
- [ ] Pinned values extracted and compared to server
- [ ] Pinning failure behavior validated
- [ ] Debug vs release pinning consistency checked

## References

- [OWASP MASTG — Network Communication Testing](https://mas.owasp.org/MASTG/techniques/android/MASTG-TECH-0012/)
- [OkHttp Certificate Pinning](https://square.github.io/okhttp/features/https/#certificate-pinning)
- [Android Network Security Config](https://developer.android.com/privacy-and-security/security-config)
- [MITRE T1553 — Subvert Trust Controls](https://attack.mitre.org/techniques/T1553/)
