danieldev23/frida-ssl-bypassFrida toolkit that bypasses SSL/TLS certificate pinning on Android apps, hooking Java TrustManager, OkHttp, Conscrypt, and native OpenSSL/BoringSSL layers.
Universal SSL/TLS Certificate Pinning Bypass for Android
Author: Danieldev (GitHub: @danieldev23 | Telegram: @zadevz)
A comprehensive Frida toolkit that defeats SSL pinning on any Android app — covering both Java and Native layers, from standard OkHttp pinning to Facebook's custom proxygen native implementation.
| Feature | Status |
|---|---|
| Java TrustManager / SSLContext | ✅ |
| HostnameVerifier (Allows all hostnames) | ✅ |
| OkHttp CertificatePinner (Standard) | ✅ |
| Obfuscated OkHttp (FB, banking apps) | ✅ |
| Conscrypt / Android TLS provider | ✅ |
| NetworkSecurityConfig (Android 7.0+) | ✅ |
| WebViewClient SSL error bypass | ✅ |
| Apache HTTP client (Legacy apps) | ✅ |
| TrustKit Pinning Library | ✅ |
| Native OpenSSL / BoringSSL | ✅ |
Flutter (ssl_verify_peer_cert) | ✅ |
Facebook Proxygen (verifyWithMetrics) | ✅ |
| Auto-detect loaded SSL modules | ✅ |
| CModule Native Replacement (0ms overhead) | ✅ |
| Script | Description |
|---|---|
scripts/universal_bypass.js | Universal script — works on any Android app |
scripts/fb4a_bypass.js | Optimized script specifically for Facebook (FB4A) with Ghidra-confirmed symbols |
pip install frida-tools)frida-server running in /data/local/tmp/ on the devicerun.sh# Clone the repository
git clone https://github.com/danieldev23/frida-ssl-bypass.git
cd frida-ssl-bypass
# Make the runner executable
chmod +x run.sh
# ── Universal bypass (Any app) ──
./run.sh -p com.example.app # Attach to running app
./run.sh -p com.example.app -m spawn # Spawn app and hook
# ── Facebook specific bypass ──
./run.sh -p com.facebook.katana -s fb4a # FB4A optimized mode
./run.sh # Default: Attach to Facebook
# ── Direct Frida CLI usage ──
frida -U -f com.instagram.android -l scripts/universal_bypass.js
frida -U -p 1234 -l scripts/universal_bypass.js
run.sh)./run.sh [options]
-p, --package <name> Target package name (default: com.facebook.katana)
-s, --script <name> Script to use: fb4a | universal (default: universal)
-m, --mode <mode> Mode: attach | spawn (default: attach)
-h, --help Show help message
SSLContext.init() → Injects TrustAllManager (trusts all certificates)
HostnameVerifier → Returns true for all domain names
CertificatePinner.check() → Noop (scans for standard and obfuscated classes)
Conscrypt → Bypasses certificate chain verification
NetworkSecurityConfig → Trusts user-added CA certificates
WebViewClient → Automatically proceeds on SSL errors
SSL_CTX_set_verify() → Forces SSL_VERIFY_NONE (0)
SSL_get_verify_result() → Always returns X509_V_OK (0)
SSL_set_custom_verify() → Disables custom verification callback
verifyWithMetrics() → CModule stub returns TRUE (Facebook Proxygen)
ssl_verify_peer_cert() → Returns 1 (Flutter / Dart Engine)
The toolkit auto-detects SSL modules loaded into memory using two strategies:
android_dlopen_ext / dlopen to intercept native SSL libraries as they load into RAM (with backoff polling fallback).frida-ssl-bypass/
├── README.md # Documentation (English)
├── LICENSE # MIT License
├── run.sh # Auto-runner script for frida-server & hooks
├── .gitignore
└── scripts/
├── universal_bypass.js # Universal bypass script for any app
└── fb4a_bypass.js # FB4A specific optimized bypass script
This project is intended strictly for security research and educational purposes. Only use this tool on applications you own or have explicit authorization to audit. The author assumes no liability for any misuse.
Distributed under the MIT License — See LICENSE for full details.
| Application | Package Name | Recommended Script | Notes |
|---|
com.facebook.katana | fb4a / universal | C/C++ Native Proxygen bypass | |
com.instagram.android | universal | OkHttp + Native OpenSSL | |
com.whatsapp | universal | Noise Protocol + Native SSL | |
| Twitter / X | com.twitter.android | universal | OkHttp Pinning |
| TikTok | com.zhiliaoapp.musically | universal | BoringSSL custom verification |
| Banking Apps | varies | universal | Conscrypt + TrustKit |
| Flutter Apps | varies | universal | Hooks verify chain in libflutter.so |
| React Native | varies | universal | Covers underlying OkHttp layer |