# Defeating Android Certificate Pinning with Frida

DevFeed: [Defeating Android Certificate Pinning with Frida](<https://devfeed.tech/articles/defeating-android-certificate-pinning-with-frida-19060.md>)

Original publisher: [Read original article](<https://httptoolkit.com/blog/frida-certificate-pinning/>)

Author: HTTP Toolkit; Tim Perry

Published: 2021-07-06T13:30:00Z

Content type: tutorial

Language: en

Sources: [HTTP Toolkit](<https://devfeed.tech/sources/http-toolkit.md>)

Topics: [Android](<https://devfeed.tech/topics/android.md>), [interception](<https://devfeed.tech/topics/interception.md>), [SSL](<https://devfeed.tech/topics/ssl.md>), [debug](<https://devfeed.tech/topics/debug.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [android](<https://devfeed.tech/tags/android.md>), [certificates](<https://devfeed.tech/tags/certificates.md>), [debugging](<https://devfeed.tech/tags/debugging.md>), [frida](<https://devfeed.tech/tags/frida.md>), [http](<https://devfeed.tech/tags/http.md>), [interception](<https://devfeed.tech/tags/interception.md>), [security](<https://devfeed.tech/tags/security.md>), [security-research](<https://devfeed.tech/tags/security-research.md>), [tls](<https://devfeed.tech/tags/tls.md>)

## AI overview

This tutorial explains Android certificate pinning, why it prevents HTTPS interception, and how Frida can be used to remove SSL pinning so researchers, developers, and privacy advocates can inspect an app's traffic.

## Source excerpt

Some Android apps go to astounding lengths to ensure that even the owner of a device can never see the content of the app's HTTPS requests. This is problematic for security research, privacy analysis and debugging, and for control over your own device in general. It's not a purely theoretical problem either - protections like this attempt to directly block HTTPS inspection tools like HTTP Toolkit, which allow you to automatically intercept HTTPS from Android devices for inspection, testing & mocking, like so: This depends on the target application(s) trusting the debugging proxy's certificate for HTTPS traffic. These HTTP interception and mocking techniques are super useful for testing and understanding most apps, but they have issues with the small set of hyper-vigilant apps that add extra protections aiming to lock down their HTTPS traffic and block this kind of inspection. In the end, this is your Android device, and whether you're a security researcher checking for vulnerabilities, a developer trying to understand how an app uses its API, or a privacy advocate documenting what data an app is sharing, you should be able to see the messages that the apps you use transmit and receive on your own phone. Protections like certificate pinning make this difficult. Let's talk about how you can fight back, by using Frida to remove SSL pinning, and expose the real traffic that any app is sending. What's certificate pinning? By default, when an Android app makes an HTTPS connection, it makes sure that it's talking to a trusted server by comparing the issuer of the server's certificate to Android's built-in list of trusted system certificate authorities. 99% of apps stick with that default. You can't change the system certificate authorities on normal devices, so this list is fairly reliable and secure. You can change it though on rooted devices and most emulators, so it's quite possible to intercept and inspect HTTPS traffic from these apps by using a debugging proxy for HT