sensepost / sensepost/objection
[bug & solution] Suggest change to the bypassing SSL-Pinning of Okhttp3 since original code doesn't work
Nobody has claimed this yet.
- #572 by @kiven7299 — closed without merging
- Dominant language
- Python
- Stars
- 9.4k
- Forks
- 1k
- Avg merge
- 14d 5h
- Merged PRs (30d)
- 1
Description
About the issue
There is an Android app which demo ssl-pinning: https://github.com/httptoolkit/android-ssl-pinning-demo.
Try disable its ssl-pinning with Objection (command android sslpinning disable) fails for Okhttp3 library:
- As can be seen bellow, the pinning still performs well:
Spot the bug in Objection's frida scripts
In file agent.js, function const okHttp3CertificatePinnerCheckOkHttp = (ident) => {...}. The issue is red-underlined code bellow:
- Since there is no
check$okhttpwith argument ofu15type, the code fails to hook into.
Suggest fix
Just hook okhttp3.CertificatePinner.check$okhttp without overload(...)
- Change the red-underlined code to
const CertificatePinnerCheckOkHttp = certificatePinner.check$okhttp
Result
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in agent.js at okHttp3CertificatePinnerCheckOkHttp and compare the current check$okhttp hook with the Okhttp3 behavior described in the issue. Reproduce the failure with the linked Android SSL-pinning demo and run Objection's android sslpinning disable command; done means the pinning is bypassed successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, javascript
- Domain
- mobile, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100