Certificate pinning prevents a rogue CA from issuing a fraudulent certificate for your domain. It stops that attack. Frida stops pinning, and does not require a rooted device since Frida Gadget ships inside the repackaged APK.
A penetration tester opens a terminal and runs one command. Within 60 seconds, they read plaintext credentials from an app whose README advertises bank-grade TLS pinning. The pinning is real. The protection is not.
Pinning the Wrong Thing: Certificate Hash vs. SPKI Hash vs. Leaf vs. Chain
Most apps pin the certificate DER hash. Every cert rotation breaks the pin and forces an emergency app store release. The Let's Encrypt 90-day cycle turns this design choice into a continuous crisis operation.
The SHA-256 SPKI hash, the MASVS-NETWORK-2 recommendation, survives rotation as long as the key pair is reused. OWASP MASTG-KNOW-0015 distinguishes three pinning targets: full certificate, public key, and SPKI SHA-256 hash. Only SPKI survives certificate renewal without requiring an app update.
Most production apps still pin the leaf certificate DER hash, the operationally fragile choice. MASWE-0047 documents the failure mode: a leaf cert expiring in 90 days triggers emergency release cycles. OkHttp's CertificatePinner API accepts SPKI hashes as the correct input. Copy-paste tutorials and Javadoc examples repeatedly push developers toward certificate-level pinning.
The 60-Second Bypass: What objection and Frida Gadget Actually Hook
objection --gadget com.target.app explore followed by android sslpinning disable covers approximately 80% of production Android apps. The command hooks OkHttp CertificatePinner.check(), X509TrustManagerExtensions, and the native OpenSSL layer in a single pass.
Frida Gadget eliminates the root requirement since Frida 12.x. The attacker injects libgadget.so into the APK with apktool, re-signs with any controlled key, and distributes via sideload. No ADB. No system-level access.
The attack requires four tools: apktool to decompile the APK, Frida Gadget as the libgadget.so binary, jarsigner to re-sign. Objection drives hooks at runtime via a single command. All four are on any pentester's laptop. Total setup time for a new target is under 20 minutes.
The pcipolloni universal-android-ssl-pinning-bypass script overwrites TrustManager.checkServerTrusted() to always return void. This bypasses all Java-layer pinning regardless of library. The 20% of apps that survive objection use BoringSSL or Conscrypt native pinning at the C layer. These require separate native hooks with a distinct Frida script.
iOS Is Not Safer: Ten Hook Points, One Frida Script
iOS pinning converges on core Security.framework functions: SecTrustEvaluate, SecTrustEvaluateWithError, SecCertificateCopyData. One Frida script neutralizes Alamofire, URLSession, and Apple's internal AKCertificatePinning because all three call the same framework functions.
ios-ssl-pinning-bypass.js (Frida 17.8.3, tested on iOS 17.4.1) hooks 10 distinct points at once: SecTrustEvaluate, SecTrustEvaluateWithError, SecTrustGetTrustResult, SecTrustSetExceptions, SSL_CTX_set_custom_verify, SSL_set_custom_verify, sec_protocol_options_set_verify_block, Alamofire.SessionDelegate, AKCertificatePinning, and AACertificatePinner.
SecTrustEvaluate was deprecated in iOS 12. Apps still using it have been in production for 6+ years and are trivially hookable. The non-jailbreak iOS bypass via Frida Gadget repackaged into the IPA requires only a USD 99 Apple Developer account and TestFlight or sideload distribution.
HPKP Died in 2018 Teaching This Lesson
Chrome 67 removed HTTP Public Key Pinning in May 2018. The documented reason from the Blink team: "high risk of bricking sites, low benefit versus CT." At peak adoption, HPKP was present on 3,500 of the top 1 million sites. By end of 2019, that number had dropped to 650 as developers absorbed the lockout risk.
RansomPKP demonstrated a practical abuse vector: an attacker serves a valid HPKP header pinning an attacker-controlled key. This locks domain cert rotation for the full max-age duration. HPKP Suicide was the accidental equivalent: the developer loses access to the pinned private key and the domain is unrecoverable during max-age.
Mobile pinning faces the same cost-benefit problem, plus app store release latency as an additional recovery obstacle. A hardcoded pin to an expired cert requires an emergency App Store or Play Store release. Review queues add 24 to 72 hours during which the app fails for all active users. Chrome replaced HPKP with Expect-CT, delegating CA-compromise detection to Certificate Transparency logs.
What Pinning Stops and What It Does Not
Pinning stops one specific threat: a rogue CA issuing a valid-chain certificate for your domain. That is the DigiNotar scenario from 2011, when a compromised Dutch CA issued hundreds of fraudulent certificates for Google, Skype, and CIA domains.
Pinning does not stop: hooking TrustManager via Frida Gadget without root, a repackaged APK with Frida Gadget embedded. It also does not stop direct server compromise or MITM by the device owner. Certificate Transparency addresses the same threat without operational cost. Any fraudulent issuance appears in public logs within 24 hours. Chrome has enforced CT for all TLS certs since April 2018.
OWASP MASVS-NETWORK-2 (2025) classifies pinning as L2 and notes it is not recommended in the standard threat model for most consumer applications. For the single threat pinning addresses, CT is a superior control with no operational downside.
Security teams frequently cite public Wi-Fi compromise as the motivation for pinning. HSTS already addresses that scenario: any downgrade attempt to HTTP is blocked by the app's network stack. Pinning adds operational complexity to cover a threat that HSTS and CT already address more reliably.
When the Pin Is Configured but Does Not Execute
CVE-2026-80230 (fixed in curl 8.22.0, 2026-09-02): CURLOPT_PINNEDPUBLICKEY is silently ignored when CURLOPT_SSL_VERIFYPEER=0 and CURLOPT_SSL_VERIFYHOST=0 are both set. This combination is standard in test configurations that never get reverted for production.
CVE-2025-5025: curl's wolfSSL backend ignores CURLOPT_PINNEDPUBLICKEY on QUIC connections. Pinning was not ported to the HTTP/3 transport path. The outcome: documentation says pinning is active, tests pass over HTTP/1.1 and HTTP/2. The app uses HTTP/3 in production, and the pin never executes.
CERT/CC VU#582497 documented 1,074 of 13,500 analyzed Android apps with broken SSL validation at the TrustManager level. Pinning code was present but structurally unreachable. That is the dangerous class: documentation says "pinning enabled," tests pass, the application is vulnerable in production.
The most common silent failure pattern is not technical, it is cultural. The test configuration that disables SSL verification is created to speed development and never removed before deploy. CVE-2026-80230 exists because that trajectory is repeatable across codebases of any size.
Controls That Survive Frida: Attestation and Request Signing
The Play Integrity API (Android) and App Attest (iOS) use server-to-server attestation with tokens signed by Google and Apple respectively. Attestation happens server-side, not on the device. There is no local code for Frida to hook.
Request signing with hardware-bound keys in Android Keystore or iOS Secure Enclave cannot have keys extracted even on rooted devices. Signing logic observed via Frida can be replicated only if the payload does not include a per-request timestamp plus nonce.
The Play Integrity API issues three verdict tiers: MEETS_BASIC_INTEGRITY, MEETS_DEVICE_INTEGRITY, and MEETS_STRONG_INTEGRITY. Only MEETS_STRONG_INTEGRITY confirms the app runs on certified Android hardware without compromise signals. Backends that accept basic-level verdicts as a security control open the same attack surface that Frida Gadget exploits.
MAGO Intel at intel.mago.team identifies mobile API endpoints without attestation headers or request signatures. These are the endpoints where Frida bypass produces exploitable traffic. The question is not whether pinning is configured. It is whether the pin survives a repackaged APK with Frida Gadget embedded.
Top comments (0)