How to Bypass SSL Pinning on Android with Frida and Objection (and What to Do When It Fails)

SSL pinning is the reason your proxy shows nothing when you point an Android app at it. The app sees a certificate it does not recognize, rejects the connection, and gives you no useful error. For anyone doing authorized security research, the fix is the same set of tools every time: Frida and objection. This post covers three working methods and what to try when the easy one fails.

A note on scope: bypass SSL pinning only on apps you own or are authorized to test. Pinning exists to protect users from network attackers; weakening it in a build you ship to users is a vulnerability, not a feature.

What SSL pinning actually is

Normally, an Android app trusts any certificate signed by a certificate authority in the device trust store, so a proxy CA you install lets you read the traffic. An app with pinning goes further: it checks the server’s certificate or public key against a value baked into the app, and rejects the connection when it does not match, regardless of whether the system trusts the certificate.

The common implementations are X509TrustManager customizations, OkHttp‘s CertificatePinner, and Conscrypt’s TrustManagerImpl on the platform side. Bypassing pinning means hooking those checks at runtime and making them always pass.

Prerequisites

• A connected device or emulator (adb devices shows it).
• pip install frida-tools objection on your machine, and frida-server running on the device (our Frida Gadget guide covers the non-rooted case).
• A proxy: Burp Suite or mitmproxy, with its CA certificate installed on the device.

One platform fact worth knowing: since Android 7.0 (API 24), apps no longer trust user-installed CA certificates by default. On a rooted device you can move your proxy CA into the system store; on a debuggable build you can add a network security config that trusts user CAs.

Method 1: objection’s one-command bypass

Objection is a runtime mobile-exploration toolkit built on Frida, and its pinning bypass is the fastest starting point:

objection -g com.example.app explore

Inside the objection shell, run:

android sslpinning disable

This injects hooks covering the common pinning implementations: TrustManagerImpl, OkHttp CertificatePinner, and WebViewClient.onReceivedSslError, among others. When it works, the app launches and your proxy starts showing decrypted traffic immediately.

Method 2: the universal Frida script

When objection misses a custom implementation, a hand-written Frida script gives you control over exactly which classes get hooked. The quickest path is the community universal bypass from Frida CodeShare:

frida -U --codeshare pcipolloni/universal-android-ssl-pinning-bypass-with-frida -f com.example.app

Or save the script locally and load it with frida -U -l bypass.js -f com.example.app. The core pattern in any such script is the same: find the validation method and replace its implementation with one that always succeeds. A minimal example targeting the platform trust manager:

Java.perform(function () {
  var TrustManagerImpl = Java.use('com.android.org.conscrypt.TrustManagerImpl');
  TrustManagerImpl.verifyChain.implementation = function (untrustedChain,
      trustAnchorChain, host, clientAuth, ocspData, tlsSctData) {
    console.log('[+] Bypassed verifyChain for: ' + host);
    return untrustedChain;
  };
});

A production bypass script adds hooks for OkHttp3 CertificatePinner.check and a permissive X509TrustManager, and wraps each in try/catch so a missing class does not kill the whole script.

Method 3: patch the APK for non-rooted devices

If you cannot run frida-server as root, patch the app to load Frida Gadget instead:

objection patchapk -s app.apk

This repackages the APK with the gadget embedded. Install the patched APK, then attach with objection -g com.example.app explore and run android sslpinning disable as in Method 1. See our Frida Gadget post for the full non-rooted workflow.

Method comparison

When the bypass fails: a troubleshooting checklist

Run through these in order when traffic still refuses to decrypt:

• Check the Frida version match. frida-server and frida-tools must be the same major version; a mismatch silently fails to attach. Note that Frida 16 removed the --no-pause flag, so older tutorials’ commands need adjusting.
• Confirm the app is actually hooked. frida-ps -U should list the target process. If objection attached but the process list looks wrong, you are not inside the app.
• Suspect native pinning. Apps can pin in C/C++ via OpenSSL or BoringSSL in a JNI library. Java-level hooks will not touch it; you need native hooks (see our Frida hooking guide) on functions like SSL_CTX_set_verify or custom verification callbacks.
• Look for Frida detection. Some apps detect frida-server or the gadget and refuse to run or behave differently. Symptoms look like pinning but the fix is anti-detection, not more hooks.
• Rule out root detection and emulator checks. An app that exits on a rooted device or emulator will fail before pinning is even reached; bypass those checks first.
• Verify the proxy chain itself. Disable the bypass and check the proxy CA is installed and trusted. If the app fails with the stock CA chain too, the problem is the proxy setup, not the pinning.

Key takeaways

• Start with objection’s one command (android sslpinning disable); it covers the common implementations in seconds.
• Escalate to a custom Frida script when the app pins in a non-standard place, wrapping every hook in try/catch.
• Native pinning needs native hooks. Java-level bypasses are invisible to C/C++ TLS stacks.
• Version mismatches are the most common silent failure. Match frida-server and frida-tools exactly, and remember Frida 16 removed --no-pause.
• Stay in scope. Only bypass pinning on apps you own or are authorized to test; never ship a weakened build.

References

• Zensar, “Android SSL Pinning Bypass Using Frida” — zensar.com
• Samaritan (Medium), “Frida + Objection for SSL pinning bypass to proxy with Burp Suite (2025)” — medium.com
• Undercode Testing, “Bypass Android SSL Pinning Like A Pro: Frida Dynamic Instrumentation For Mobile Pentesting” — undercodetesting.com
• hack-wiki notes, “SSL Pinning” — github.com