Pinned

Platform: HackTheBox | Category: Mobile | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: NA | Status: Solved Techniques: ssl_pinning_bypass, frida, zipalign, apksigner

Summary

Walkthrough of the HackTheBox challenge Pinned (Mobile). Bypass SSL pinning using Frida to intercept credentials and capture the flag.

Description

This app has stored my credentials and I can only login automatically. I tried to intercept the login request and restore my password, but this seems to be a secure connection. Can you help bypass this security restriction and intercept the password in plaintext?

Recon

Initial Analysis

• App uses SSL pinning to prevent MITM attacks
• Need to bypass SSL pinning to intercept traffic
• Target API level: 29 or higher

Foothold

Vulnerability / Misconfiguration

1. SSL pinning prevents certificate interception
2. App stores credentials locally

Exploitation

Step 1: Zipalign the APK

 bash read-only • copy allowed Copy
zipalign -p 4 pinned.apk patched_pinned.apk

Step 2: Generate Keystore

 bash read-only • copy allowed Copy
keytool -genkey -keystore a.keystore -keyalg RSA -keysize 2048 -validity 10000

Step 3: Sign the APK

 bash read-only • copy allowed Copy
apksigner sign --ks a.keystore patched_pinned.apk

Step 4: Install and Run

Install the patched APK on the device.

Step 5: Bypass SSL Pinning with Frida

 bash read-only • copy allowed Copy
frida --codeshare pcipolloni/universal-android-ssl-pinning-bypass-with-frida -f com.example.pinned -U

Step 6: Intercept Traffic

Use Burp Suite to intercept the login request and capture the password.

Flags

Key Takeaways / Lessons

• SSL pinning can be bypassed using Frida codeshare scripts
• Always check API level requirements for APK modifications
• Use zipalign and apksigner for APK patching

---