Introduction to SSL Pinning

SSL (Secure Sockets Layer) / TLS (Transport Layer Security) pinning is a security mechanism implemented in client applications to prevent Man-in-the-Middle (MitM) attacks. Normally, when an application connects to a server, it verifies the server’s identity by checking its SSL certificate against a list of trusted Certificate Authorities (CAs) installed on the device. If the certificate is issued by a trusted CA, the connection proceeds.

SSL pinning, however, adds an extra layer of security. The application ‘pins’ or hardcodes the expected server certificate (or its public key) within itself. During a connection, it not only checks against the device’s trusted CAs but also verifies if the server’s certificate matches the hardcoded pin. If there’s a mismatch, even if the certificate is issued by a trusted CA (like one installed by a proxy tool), the connection is aborted, protecting against attackers who might have compromised a CA or are using their own CA.

For penetration testers, security researchers, and reverse engineers, SSL pinning presents a significant challenge. It prevents intercepting and analyzing network traffic using tools like Burp Suite or OWASP ZAP, which rely on injecting their own CA certificates into the trust chain. Bypassing SSL pinning is often a prerequisite for effective mobile application security testing.

Understanding OkHttp3 SSL Pinning

OkHttp3 is a popular HTTP client for Android and Java applications, widely used due to its efficiency and robust feature set. It provides a built-in mechanism for SSL pinning through its CertificatePinner class. Developers can specify which certificates or public keys are expected for specific hostnames. When a connection is made to a pinned hostname, OkHttp3 compares the server’s certificate against the defined pins. If no match is found, a SSLPeerUnverifiedException is thrown, and the connection fails.

How OkHttp3 Implements Pinning

The core of OkHttp3’s pinning lies in the CertificatePinner class. Developers instantiate this class and use its add() method to register pins for specific hosts. Each pin is typically a SHA-256 hash of a certificate’s public key (SPKI – Subject Public Key Info) or the entire certificate. The check() method is then invoked internally by OkHttp3 during the TLS handshake to validate the peer certificates against the configured pins.

The Challenge

Traditional proxy methods involve installing your proxy’s CA certificate on the Android device. While this allows the device to trust your proxy, OkHttp3’s CertificatePinner will still identify the proxy’s certificate as not matching the hardcoded application pins, thus blocking the connection. Our goal is to ‘hook’ into the application’s runtime and modify the behavior of CertificatePinner to ignore these checks.

Prerequisites and Setup

To successfully bypass OkHttp3 SSL pinning, you’ll need the following tools and setup:

• Rooted Android Device or Emulator: Necessary for running Frida-server and having full control.
• ADB (Android Debug Bridge): For interacting with the Android device.
• Frida: A dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers.
• Frida-server: The Frida component that runs on the Android device.
• Frida-tools: Python tools for interacting with Frida-server from your host machine.
• Burp Suite (or OWASP ZAP): To act as a proxy for intercepting traffic.

Setting up Frida

1. Download Frida-server: Go to Frida releases and download the appropriate frida-server for your Android device’s architecture (e.g., frida-server-*-android-arm64).
2. Push to Device: Use ADB to push the frida-server binary to your device.

adb push /path/to/frida-server /data/local/tmp/frida-server

3. Make Executable:

adb shell

        
        
        

            

                
            
            

                
Android Mobile Specs & Compare Directory
                
Are you researching mobile hardware properties, processor SoCs, GPU chipsets, or RAM configurations? Access our complete specs catalog to compare up to 5 devices side-by-side!
                Compare Devices Specs →