Android apps SSL Unpinning

Every now and then a client comes to us with an interesting challenge: they need to see what an Android app is actually sending over the wire. Maybe it’s a security audit, maybe they’re debugging an API integration, or maybe they just want to understand what data is leaving their devices. SSL pinning makes this tricky — the app refuses to trust anything other than its own bundled certificate. Here’s how we get around that.

What you’ll need

An Android device — this can be a physical phone, but it doesn’t have to be. Projects like Bliss OS let you run full Android on an x86 virtual machine, which is honestly more convenient for this kind of work — no cables, easy snapshots, and you can throw the VM away when you’re done. We’ve had good results running Bliss OS on Proxmox. Setting up an Android x86 VM is a topic for another day, but it’s worth knowing the option exists.

Software:

  • ADB (Android Debug Bridge)
  • Frida and Objection
  • patch-apk script for repackaging
  • Your proxy’s root certificate installed on the device

Patching the APK

The patch-apk script does the heavy lifting — it decompiles the APK, injects the Frida gadget, and repackages it. Sometimes things won’t build cleanly though. We’ve hit cases where special characters in resource files trip up apktool during reassembly. If that happens, hunt down the offending characters and sanitise them before rebuilding.

Intercepting traffic

Once you’ve got the patched APK installed on the device:

  1. Set up a proxy server with MITM support on your machine — we’ve used Fiddler but mitmproxy works too
  2. Configure the device to use your machine as its proxy
  3. Launch the patched app — it’ll appear stuck on a black screen initially, that’s normal

Now connect to it:

objection explore

Once Objection confirms it’s connected and linked to the instrumented app, the app will unfreeze. Then disable SSL pinning:

android sslpinning disable

Use the app as normal and watch the decrypted traffic flow through your proxy. All the API calls, payloads, headers — everything that was previously hidden behind the pinned certificate is now visible in plain text.

Leave a Reply