Agent skill · security · yaklang
mobile-ssl-pinning-bypass
Mobile SSL pinning bypass playbook. Use when intercepting HTTPS traffic from mobile applications that implement certificate pinning, public key pinning, or SPKI hash pinning on Android and iOS, including React Native, Flutter, and Xamarin frameworks.
Why this skill is useful
Adds detailed executable scripts for bypassing SSL pinning in mobile applications, including specific techniques for various frameworks.
What it needs
Requires frida, objection, ssl-kill-switch, xposed installed locally. About 9k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Mobile SSL Pinning Bypass — Expert Attack Playbook AI LOAD INSTRUCTION: Expert SSL pinning bypass techniques for mobile platforms. Covers Android and iOS bypass methods (Frida, Objection, Xposed, SSL Kill Switch), framework-specific bypasses (Flutter, React Native, Xamarin), and troubleshooting non-standard pinning implementations. Base models miss framework-specific hook points and multi-layer pinning configurations. 0. RELATED ROUTING Before going deep, consider loading: android-pentesting-tricks for broader Android testing beyond SSL bypass ios-pentesting-tricks for broader iOS testing beyond SSL bypass api-sec once traffic is intercepted for API-level testing --- 1. SSL PINNING TYPES Pinning Type What Is Pinned Resilience Common In --- --- --- --- Certificate pinning Exact leaf certificate (DER/PEM) Low (breaks on cert rotation) Legacy apps Public key pinning Subject Public Key Info Medium (survives cert renewal if key unchanged) Modern apps SPKI hash pinning SHA-256 of SPKI Medium (same as public key) OkHttp, AFNetworking CA pinning Intermediate or root CA cert High (any cert from that CA works) Enterprise apps Multi-pin (backup pins) Primary + backup pins High (fallback pins) HPKP-aware apps How Pinning Works --- 2. ANDROID BYPASS METHODS 2.1 Frida Universal SSL Bypass 2.2 Objection (One Command) 2.3 Network Security Config (Debug Override) Workflow: decompile APK → add/modify config → repackage → re-sign → install. 2.4 Xposed / LSPosed Modules Module Method Scope Root Required --- --- --- --- JustTrustMe Hooks TrustManager + OkHttp Per-app Yes (Xposed) SSLUnpinning Hooks certificate validation Per-app Yes (LSPosed) TrustMeAlready Global TrustManager bypass System-wide Yes (LSPosed) 2.5 Magisk + System CA Installation 2.6 Manual Decompile → Patch → Repackage --- 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/mobile-ssl-pinning-bypass