Android: Defeat Certificate Pinning with Frida

mobile · hard · +125 XP

Scenario

A banking APK refuses to talk through your proxy — it pins its server certificate. Static patching is fragile; runtime hooking is cleaner.

frida -U -f com.target.app with a pinning-bypass script that neuters checkServerTrusted / OkHttp CertificatePinner.
Route traffic through mitmproxy and watch the login call.
The app ships an obfuscated API secret in the X-Client-Token header.

The captured token is Caesar-ciphered. The shift equals the letter count of the tool you used to bypass pinning. Decode to reveal your flag.

// graded hints — spend XP when stuck

// captured payload · caesar

mh{fsiwtni-hjwy-unssnsl-gdufxx-201_j7592j4g45f6}

Caesar cipher — shift 5. Letters wrap; non-letters preserved.

// this payload is unique to your account — decode it, then submit the recovered hc{...} flag below

// submit flag

// no solves yet

11 of 12 · mobile

// install app

Install hacking.community for fast access, offline reading, and push notifications. No app store needed.