https://github.com/iSECPartners/Android-SSL-TrustKiller

Bypass SSL certificate pinning for most applications
https://github.com/iSECPartners/Android-SSL-TrustKiller

Last synced: 5 months ago
JSON representation

Bypass SSL certificate pinning for most applications

• Host: GitHub
• URL: https://github.com/iSECPartners/Android-SSL-TrustKiller
• Owner: iSECPartners
• License: other
• Created: 2013-11-20T20:58:41.000Z (over 12 years ago)
• Default Branch: master
• Last Pushed: 2018-07-18T10:06:09.000Z (about 8 years ago)
• Last Synced: 2025-10-11T07:07:05.080Z (10 months ago)
• Language: Java
• Homepage:
• Size: 921 KB
• Stars: 726
• Watchers: 47
• Forks: 129
• Open Issues: 8
• Metadata Files:
  • Readme: README.md
  • License: LICENSE.txt

Awesome Lists containing this project

• awesomemobilepentest - Cydia Substrate Module: Android SSL Trust Killer - Blackbox tool to bypass SSL certificate pinning for most applications running on a device. (Awesome Mobile Application Penetration Testing  / Android Application Penetration Testing)

README

          
Android-SSL-TrustKiller

=======================

Blackbox tool to bypass SSL certificate pinning for most applications 

running on a device.

Description

-----------

This tool leverages Cydia Substrate to hook various methods 

in order to bypass certificate pinning by accepting

any SSL certificate.

Usage

-----

* Ensure that Cydia Substrate has been deployed on your test device. The installer requires a rooted device and can be found on the Google Play store at https://play.google.com/store/apps/details?id=com.saurik.substrate&hl=en 

* Download the pre-compiled APK available at https://github.com/iSECPartners/Android-SSL-TrustKiller/releases

* Install the APK package on the device:

        adb install Android-SSL-TrustKiller.apk

* Add the CA certificate of your proxy tool to the device's trust store.

Notes

-----

Use only on a test devices as anyone on the same network can intercept traffic from a number of applications including Google apps. This extension will soon be integrated into Introspy-Android (https://github.com/iSECPartners/Introspy-Android) in order to allow you to proxy only selected applications.

License

-------

See ./LICENSE.

Authors

-------

Marc Blanchou