Bypassing SSL Pinning on Android via Reverse Engineering

[Nytro]

Bypassing SSL Pinning on Android via Reverse Engineering

Denis Andzakovic – Security-Assessment.com

15 May 2014

Table of Contents
Bypassing SSL Pinning on Android via Reverse Engineering ......................................................................... 1
Introduction .................................................................................................................................................. 3
Tools Used ..................................................................................................................................................... 3
The Victim ..................................................................................................................................................... 3
The Approach ................................................................................................................................................ 4
Reversing ....................................................................................................................................................... 5
Retrieving and Disassembling the APK ..................................................................................................... 5
Patching .................................................................................................................................................... 6
Patch at class instantiation ................................................................................................................... 6
Patch the Class ...................................................................................................................................... 7
Hijacking the Keystore .......................................................................................................................... 8
Repacking and Running ........................................................................................................................... 10
Tricks ........................................................................................................................................................... 11
Information in Stack Traces .................................................................................................................... 11
Decompiling into Java Code .................................................................................................................... 12
References .................................................................................................................................................. 12

Download: http://www.exploit-db.com/wp-content/themes/exploit/docs/33430.pdf