15

I've spent the past 4 months trying to bypass certificate pinning in the Facebook android application so I can understand how it works, but I'm having trouble doing so.

I have tried using android SSL trust Killer and cydia substrate, but there seems to be some other verification mecanism. I have tried altering the smali code as explained here:

http://blog.dewhurstsecurity.com/2015/11/10/mobile-security-certificate-pining.html

I was able to view two requests (one of which is shown in the last screenshot of the provided link), however the app seems to apply some other protection mecanism because when trying to login to an account, it gives an error message saying: "ssl3_get_server_certificate certificate verify failed"

I have tried every public tutorial I could find online to no avail, I would appreciate any input on how to do this.

I'd also be happy to provide the decompiled source code, apk, and the modified apk if needed.

Improve this question
11
  • Patch the java code to ignore pinning. The tutorial you linked explains how.
    – Vitaly Osipov
    Mar 15, 2016 at 7:06
  • I followed that tutorial but as I said there is still some other verification mecanism that I can't find.
    – John Avery
    Mar 15, 2016 at 9:35
  • 1
    Read the decompiled code, search for the error message. Patch the logic out. Recompile and re-sign.
    – Vitaly Osipov
    Mar 16, 2016 at 0:29
  • The error message doesn't appear in the decompiled code. I've been trying to modify parts of the code and recompile & resign to test it out for the past 4 months and I still am, but I still haven't made any breakthrough yet, hence my post here.
    – John Avery
    Mar 17, 2016 at 19:27
  • 1
    Sorry, this is an error coming from SSL, not the app itself. You might end up having to recompile SSL libraries for your Android, or do something along the lines of nccgroup.trust/us/about-us/newsroom-and-events/blog/2015/…. I am not too familiar with how pinning is set up in client code, but I bet there are ways to disable it even without replacing SSL libs. Nop it all out, not just the parts described in the blog post :)
    – Vitaly Osipov
    Mar 18, 2016 at 21:42

1 Answer 1

Reset to default
9

Use Xposed. Learn the API, is the way you should hook & manipulate Android apps.

  • Xposed + JustTrustMe

Xposed module (thx Fuzion24). The method calls you're looking for are in the below source file:

https://github.com/Fuzion24/JustTrustMe/blob/master/app/src/main/java/just/trust/me/Main.java

After you learn Xposed, move to Frida, use it and study it. Then you will be ready to play with the run-time modification big kids :-)

Improve this answer
2
  • 1
    I installed Xposed and JustTrustMe and tried it but the pinning is still there. According to JustTrustMe explanation on github, it should have worked, so I'm assuming there is a custom pinning functionality implemented. Thanks for your suggestion, I will try and make time to study this. If you have any book/tutorial recommendations to get me started please let me know.
    – John Avery
    Mar 17, 2016 at 19:37
  • JustTrustMe worked for me, but I needed to reboot after installing and activating the module.
    – jcady
    May 8, 2017 at 21:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.