14

I've spent the past 4 months trying to bypass certificate pinning in the Facebook android application so I can understand how it works, but I'm having trouble doing so.

I have tried using android SSL trust Killer and cydia substrate, but there seems to be some other verification mecanism. I have tried altering the smali code as explained here:

http://blog.dewhurstsecurity.com/2015/11/10/mobile-security-certificate-pining.html

I was able to view two requests (one of which is shown in the last screenshot of the provided link), however the app seems to apply some other protection mecanism because when trying to login to an account, it gives an error message saying: "ssl3_get_server_certificate certificate verify failed"

I have tried every public tutorial I could find online to no avail, I would appreciate any input on how to do this.

I'd also be happy to provide the decompiled source code, apk, and the modified apk if needed.

  • Patch the java code to ignore pinning. The tutorial you linked explains how. – Vitaly Osipov Mar 15 '16 at 7:06
  • I followed that tutorial but as I said there is still some other verification mecanism that I can't find. – John Avery Mar 15 '16 at 9:35
  • 1
    Read the decompiled code, search for the error message. Patch the logic out. Recompile and re-sign. – Vitaly Osipov Mar 16 '16 at 0:29
  • The error message doesn't appear in the decompiled code. I've been trying to modify parts of the code and recompile & resign to test it out for the past 4 months and I still am, but I still haven't made any breakthrough yet, hence my post here. – John Avery Mar 17 '16 at 19:27
  • 1
    Sorry, this is an error coming from SSL, not the app itself. You might end up having to recompile SSL libraries for your Android, or do something along the lines of nccgroup.trust/us/about-us/newsroom-and-events/blog/2015/…. I am not too familiar with how pinning is set up in client code, but I bet there are ways to disable it even without replacing SSL libs. Nop it all out, not just the parts described in the blog post :) – Vitaly Osipov Mar 18 '16 at 21:42
9

Use Xposed. Learn the API, is the way you should hook & manipulate Android apps.

  • Xposed + JustTrustMe

Xposed module (thx Fuzion24). The method calls you're looking for are in the below source file:

https://github.com/Fuzion24/JustTrustMe/blob/master/app/src/main/java/just/trust/me/Main.java

After you learn Xposed, move to Frida, use it and study it. Then you will be ready to play with the run-time modification big kids :-)

  • 1
    I installed Xposed and JustTrustMe and tried it but the pinning is still there. According to JustTrustMe explanation on github, it should have worked, so I'm assuming there is a custom pinning functionality implemented. Thanks for your suggestion, I will try and make time to study this. If you have any book/tutorial recommendations to get me started please let me know. – John Avery Mar 17 '16 at 19:37
  • JustTrustMe worked for me, but I needed to reboot after installing and activating the module. – jcady May 8 '17 at 21:14

protected by Community Feb 3 '17 at 19:00

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.