Mobile Ssl Pinning Bypass

This is a comprehensive playbook for bypassing SSL certificate pinning when pentesting mobile apps on Android and iOS. It covers the full stack: Frida hooks for TrustManager, OkHttp, and Conscrypt, one-liner Objection commands, network security config patching, Xposed modules, and framework-specific bypasses for React Native, Flutter, and Xamarin. The Frida script alone handles about eight different pinning implementations including modern OkHttp 4.x variants. Useful when you need to intercept HTTPS traffic from a mobile app and Burp shows nothing because the app won't trust your proxy certificate. The skill includes the actual JavaScript and smali-level details that base models usually hallucinate incorrectly.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill mobile-ssl-pinning-bypass --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Mobile SSL Pinning Bypass — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert SSL pinning bypass techniques for mobile platforms. Covers Android and iOS bypass methods (Frida, Objection, Xposed, SSL Kill Switch), framework-specific bypasses (Flutter, React Native, Xamarin), and troubleshooting non-standard pinning implementations. Base models miss framework-specific hook points and multi-layer pinning configurations.