# Clone the repository
git clone https://github.com/danieldev23/frida-ssl-bypass.git
cd frida-ssl-bypass

# Make the runner executable
chmod +x run.sh

# ── Universal bypass (Any app) ──
./run.sh -p com.example.app                           # Attach to running app
./run.sh -p com.example.app -m spawn                  # Spawn app and hook

# ── Facebook specific bypass ──
./run.sh -p com.facebook.katana -s fb4a                # FB4A optimized mode
./run.sh                                               # Default: Attach to Facebook

# ── Direct Frida CLI usage ──
frida -U -f com.instagram.android -l scripts/universal_bypass.js
frida -U -p 1234 -l scripts/universal_bypass.js

./run.sh [options]

  -p, --package <name>    Target package name (default: com.facebook.katana)
  -s, --script  <name>    Script to use: fb4a | universal (default: universal)
  -m, --mode    <mode>    Mode: attach | spawn (default: attach)
  -h, --help              Show help message

SSLContext.init()          → Injects TrustAllManager (trusts all certificates)
HostnameVerifier           → Returns true for all domain names
CertificatePinner.check()  → Noop (scans for standard and obfuscated classes)
Conscrypt                  → Bypasses certificate chain verification
NetworkSecurityConfig      → Trusts user-added CA certificates
WebViewClient              → Automatically proceeds on SSL errors

SSL_CTX_set_verify()       → Forces SSL_VERIFY_NONE (0)
SSL_get_verify_result()    → Always returns X509_V_OK (0)
SSL_set_custom_verify()    → Disables custom verification callback
verifyWithMetrics()        → CModule stub returns TRUE (Facebook Proxygen)
ssl_verify_peer_cert()     → Returns 1 (Flutter / Dart Engine)

frida-ssl-bypass/
├── README.md                       # Documentation (English)
├── LICENSE                         # MIT License
├── run.sh                          # Auto-runner script for frida-server & hooks
├── .gitignore
└── scripts/
    ├── universal_bypass.js         # Universal bypass script for any app
    └── fb4a_bypass.js              # FB4A specific optimized bypass script