SSLPinDetect Advanced SSL Pinning Detection for Android Secu...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://petruknisme.medium.com/sslpindetect-advanced-ssl-pinning-detection-for-android-security-analysis-1390e9eca097
• Blog Title: SSLPinDetect: Advanced SSL Pinning Detection for Android Security Analysis
• Suggested Section: Mobile Application Pentesting -> Android -> SSL/TLS Pinning (Detection & Bypass) [add a Static Detection subsection referencing SSLPinDetect and pattern examples]

🎯 Content Summary

SSLPinDetect

Overview

SSLPinDetect is an open‑source static-analysis utility to quickly locate SSL/TLS pinning logic in Android apps. It decompiles an APK to Smali and scans for curated patterns covering popular frameworks and custom implementations, returning precise file paths, line numbers, and code previews to guide further analysis.

Why it matters

SSL pinning thwarts man‑in‑the‑middle (MITM) interception during...

🔧 Technical Details

Static pattern discovery of SSL pinning in Android Smali: Decompile an APK with apktool, then scan Smali using pre‑compiled regex signatures that target known pinning constructs (OkHttp CertificatePinner usage, custom javax.net.ssl.X509TrustManager.checkServerTrusted, SSLContext.init with custom managers, and Network Security Config XML). The tool returns file/line/snippet, enabling fast navigation to enforcement points that matter for deeper code review or runtime testing.

Customizable rulesets for broader coverage: Maintain a JSON rules file (or use the public smali-sslpin-patterns set) to add signatures for proprietary libraries or app‑specific pinning styles. This turns the approach into a reusable playbook: define bytecode identifiers and method names, scan at scale, and triage matches by location and preview.

🤖 Agent Actions

I explored the Mobile Application Pentesting -> Android content and found that while SSL/TLS pinning bypass is covered, there wasn’t a concise “Static detection” subsection to quickly locate pinning logic during static analysis.

What I updated:

• Added a new subsection “Static detection of SSL/TLS pinning” under Android Applications Pentesting (src/mobile-pentesting/android-app-pentesting/README.md), placed right before the existing “Bypassing SSL Pinning” section.
  • Explained why static detection helps plan runtime hooks/patches.
  • Documented SSLPinDetect: overview, detections covered (OkHttp CertificatePinner, custom X509TrustManager checkServerTrusted, SSLContext.init with custom managers, Network Security Config XML), prerequisites, installation steps, and usage (basic/verbose).
  • Included a JSON pattern snippet for CertificatePinner and TrustManager override examples.
  • Noted performance aspects (multi-threaded, memory-mapped I/O, pre-compiled regex), extensibility with custom JSON rules, and linked the pattern collection repo.
  • Guidance on triaging matched locations to plan Frida hooks/patches/config review.
• Restored the “#### Bypassing SSL Pinning” header after insertion (so the original bypass content remains intact).
• Updated the References section of the same page to include:
  • SSLPinDetect Medium blog
  • SSLPinDetect GitHub
  • smali-sslpin-patterns repo

Files modified:

• src/mobile-pentesting/android-app-pentesting/README.md

No new files were created.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

🗑️ File Cleanup

• searchindex.js removed: This auto-generated file has been removed to prevent conflicts.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://petruknisme.medium.com/sslpindetect-advanced-ssl-pinning-detection-for-android-security-analysis-1390e9eca097

Content Categories: Based on the analysis, this content was categorized under "Mobile Application Pentesting -> Android -> SSL/TLS Pinning (Detection & Bypass) [add a Static Detection subsection referencing SSLPinDetect and pattern examples]".

Repository Maintenance:

• MD Files Formatting: 878 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge