Frida tls pinning

Skill Rudra-ravi/frida-skills/frida-tls-pinning

Ai skills for Frida dynamic instrumentation across Android, iOS, native hooks, agents, and troubleshooting

Install

npx -y skills add Rudra-ravi/frida-skills --skill frida-tls-pinning

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Analyze and bypass TLS or SSL pinning with Frida on Android, iOS, Flutter, React Native, native BoringSSL/OpenSSL, Conscrypt, OkHttp, NSURLSession, SecTrust, and app-specific trust code.

SKILL.md

1.8 KB, as published. Nobody here has run it

Frida TLS Pinning

Use this skill when HTTPS traffic is blocked by certificate pinning or custom trust validation.

Identify The Stack First

Android Java: OkHttp, TrustManager, Conscrypt, WebView, network security config.
Android native: BoringSSL, OpenSSL, Cronet, proxygen, Flutter engine.
iOS: NSURLSession, delegate trust challenges, SecTrustEvaluate*, native BoringSSL.
Cross-platform: React Native, Flutter, Unity, custom native networking.

Do not start with a universal bypass as the final answer. Use public scripts to discover which hook fires, then keep only the needed hooks.

Android Probe

Java.perform(() => {
  for (const name of [
    "okhttp3.CertificatePinner",
    "com.android.org.conscrypt.TrustManagerImpl",
    "javax.net.ssl.SSLContext"
  ]) {
    try { console.log("found", name, Java.use(name)); } catch (_) {}
  }
});

iOS Probe

if (ObjC.available) {
  for (const name of Object.keys(ObjC.classes).filter(n => n.includes("Trust") || n.includes("Session"))) {
    console.log(name);
  }
}

Native Probe

for (const m of Process.enumerateModules()) {
  if (/ssl|crypto|boring|cronet|liger/i.test(m.name)) console.log(m.name, m.base, m.path);
}

Verification

Proxy is trusted by the device or app profile.
The hook logs during the exact request that was blocked.
The same request succeeds after mutation.
Traffic is visible or the app behavior proves trust validation was bypassed.
The final script documents app version, platform, library, and rollback command.

References

Read references/tls-patterns.md for framework-specific hook options.