BERRY9 IT Services, home +91 86868 92922

Intercepting Mobile API Traffic: Certificate Pinning Bypass

Many of the bugs in a mobile application are not in the mobile binary at all — they are in the API the app talks to. Seeing that traffic is step one of a mobile test. Modern apps pin certificates, which means dropping a Burp CA onto the device is not enough. Here is the workflow.

Request a scoping call Call +91 86868 92922

Mobile apps · By Thimmagurudu Bathini · Published · 6 min read · Last reviewed

Step one — install Burp's CA at the system level

On rooted Android, push the CA into /system/etc/security/cacerts with the right filename hash. On jailbroken iOS, install the profile via the Settings UI; on iOS 14+ also enable trust in the certificate-trust settings panel. Without this, even an app that does not pin will reject the proxy.

Step two — disable certificate pinning

For most Android apps, objection with android sslpinning disable handles the OkHttp, TrustManager, and WebView pinning patterns. For iOS, ios sslpinning disable covers NSURLSession, AFNetworking, TrustKit.

Step three — handle the edge cases

Some apps roll custom pinning. Some use Network Security Config that prevents user-installed CAs from being trusted (Android 7+ default). The fix is the same: write a Frida script that hooks the specific validation function and returns the success value, or repackage the APK with a modified Network Security Config and disabled pinning.

What we look for in the traffic

  • Authorization model: are object IDs validated against the user, or trusted from the request?
  • Sensitive data in responses: PII the screen never displays but the response contains
  • Endpoints used by the admin/internal version of the app that the regular client should not reach
  • API versioning issues — old endpoints with weaker checks still live

The work is half mobile, half API. Our mobile VAPT includes API coverage; the API security engagement covers it in more depth.

Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.

Plan your next security test

Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.

Request a scoping call WhatsApp