mcpField
F
frida-tls-pinning

frida-tls-pinning

github.com/rudra-raviSecurity7117 installsUpdated 25w ago
Repository

About frida-tls-pinning

A skill for investigating TLS certificate-pinning and custom trust-validation behavior in mobile apps using Frida. It helps identify the relevant networking stack, probe hooks, and verify a targeted change rather than relying on a universal bypass.

Key features

  1. 01Identifies Android, iOS, and cross-platform networking stacks
  2. 02Probes Java, Objective-C, and native components
  3. 03Uses public scripts to locate active hooks
  4. 04Lists checks for verifying a modified request
  5. 05Requires documenting app version, platform, library, and rollback

Use cases

  1. 01Investigating HTTPS traffic blocked by certificate pinning
  2. 02Locating trust-validation hooks in a mobile app
  3. 03Verifying whether a targeted hook changes a blocked request
  4. 04Recording test context and rollback steps

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/rudra-ravi/frida-skills --skill frida-tls-pinning

After installing, type/frida-tls-pinningin Claude Code to confirm it loaded.

Bundled filesagents/openai.yamlreferences/tls-patterns.md

Details

From the project README

Frida TLS Pinning

Use this skill when HTTPS traffic is blocked by certificate pinning or custom trust validation.

Identify The Stack First

  • Android Java: OkHttp, TrustManager, Conscrypt, WebView, network security config.
  • Android native: BoringSSL, OpenSSL, Cronet, proxygen, Flutter engine.
  • iOS: NSURLSession, delegate trust challenges, SecTrustEvaluate*, native BoringSSL.
  • Cross-platform: React Native, Flutter, Unity, custom native networking.

Do not start with a universal bypass as the final answer. Use public scripts to discover which hook fires, then keep only the needed hooks.

Android Probe

Java.perform(() => {
  for (const name of [
    "okhttp3.CertificatePinner",
    "com.android.org.conscrypt.TrustManagerImpl",
    "javax.net.ssl.SSLContext"
  ]) {
    try { console.log("found", name, Java.use(name)); } catch (_) {}
  }
});

iOS Probe

if (ObjC.available) {
  for (const name of Object.keys(ObjC.classes).filter(n => n.includes("Trust") || n.includes("Session"))) {
    console.log(name);
  }
}

Native Probe

for (const m of Process.enumerateModules()) {
  if (/ssl|crypto|boring|cronet|liger/i.test(m.name)) console.log(m.name, m.base, m.path);
}

Verification

  • Proxy is trusted by the device or app profile.
  • The hook logs during the exact request that was blocked.
  • The same request succeeds after mutation.
  • Traffic is visible or the app behavior proves trust validation was bypassed.
  • The final script documents app version, platform, library, and rollback command.

References

Read references/tls-patterns.md for framework-specific hook options.

Comments

Markdown supported