0

I'm doing a study for university and part of this study is to gather a group of android applications and check which of these applications use Cert Pinning. I am doing this by using fiddler as a proxy(I have also download fiddler certificate on my Android Phone) the applications which work normally do not have certificate pinning while the others who stop working do have certificate pinning.

The problem is that all the applications are working normally, this include applications such as youtube, gmail, play store. This means I can capture the traffic on Fiddler from these apps. My friend tried this as well on a more modern Android device and he is not able to capture any traffic from the mentioned apps and also from other apps which most probably have cert pinning. However I am able to capture from most applications ( but not from facebook, instagram and tiktok).

Does this have to do with my Android version, I have android 5.1.1. Does anyone have an idea what is the causing this, and if there's a way to enable certificate pinning ?

TIA

Improve this question
3
  • You are lucky, because of your very old Android version you have at least some apps that work. Starting with Android 6 the certificate you installed is useless as apps ignore it by default. If you want to bypass certificate pinning try Xposed + TrustMeAlready plugin or Frida/Objection (both require a rooted device). For more details please read stackoverflow.com/q/57568571/150978
    – Robert
    Commented Feb 23, 2021 at 18:44
  • At this stage I am not trying to bypass certificate pinning, I know how to do that with objection and frida. My issue is that I want to analyze which apps use certificate pinning or not, but having that all apps are working I cannot do this. But I guess you still answered my question, If I update to a more modern Android version this will not happen.
    – Angele Aquilina
    Commented Feb 24, 2021 at 14:50
  • Also kindly note to use objection and Frida there is no need to root the phone. Just use objection and frida gadget.
    – Angele Aquilina
    Commented Feb 24, 2021 at 14:51

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .