SSL Pinning Bypass Trick PT1(Copying Burp certificate to CA Directory)

 Hi everyone as you are aware I update this blog when I get stuck in some situation and after multiple attempts if I bypass that situation I write a blog about it.

So today we will be discussing multiple issues which I faced while bypassing SSL pinning in one Application. lets call it 1APP

So 1APP is configured in a way that normal installing burpsuite certificate in Andriod was not working. Running the application with normal burp certificate it was giving error like "java.security.cert.certpathvalidatorexception" webhook etc.

After decompiling the app using online tools or you can use APKTOOL. In "resources\res\xml" directory I checked for "network_security_config.xml" after reviewing the XML file it was clear application is only trusting those certificate which are installed in CA directory of Device.

So it was cleared that we have to copy our certificate to Android CA directory. After alot of searching I came across an awesome article where he explained it very nicely (article Link: https://blog.ropnop.com/configuring-burp-suite-with-android-nougat/)

I will write the article  details here also, incase in future the above article is not available

=================================

Export and convert the Burp CA The first step is to get the Burp CA in the right format. Using Burp Suite, export the CA Certificate in DER format. I saved it as cacert.der

Save the certificate with any name e.g cacert.der

Next we would need openssl for that you can use Kali Linux or if you are using windows you have to install GIT and GIT BASH. 

Android wants the certificate to be in PEM format, and to have the filename equal to the subject_hash_old value appended with .0.

Note: if you are using OpenSSL <1.0, it’s actually just the subject_hash, not the “old” one

Use openssl to convert DER to PEM, then output the subject_hash_old and rename the file:

Run below commands using kali linux or git bash. if you are using kali make sure to copy the cacert.der to kali linux

openssl x509 -inform DER -in cacert.der -out cacert.pem
openssl x509 -inform PEM -subject_hash_old -in cacert.pem |head -1
mv cacert.pem <hash>.0

The 1st command will change the DER file to PEM file.

second command will give you the hash value (Alpha-number value)

note down the hash value and run the 3rd command make sure to replace <hash> with your hash value

For example, with my certificate:

Next we have to move this <hash>.0 file to Android device. Make sure you know how to connect to your device using ADB Shell. After connecting the device run below command

adb push <cert>.0 /sdcard/

make sure you change <cert> value to the hash value which we noted before

it will copy the certificate to /sdcard/ directory of your device. Next we need to copy this file from sdcard to "/system/etc/security/cacerts/" of android but for that we need to have write access on cacerts directory. which can be achieve using 2 methods. the 1st method worked on my genymotion device but wasnt working on real tablet. so i will share both methods here

1. Method:

adb root
adb remount

mv /sdcard/<cert>.0 /system/etc/security/cacerts/

chmod 644 /system/etc/security/cacerts/<cert>.0

reboot

make sure you change <cert> value to the hash value which we noted before

if remount command gives u error. or MV command gives you error of access denied in that case follow the 2nd method

2. Method

adb shell
su

mount -o rw,remount,rw /

mv /sdcard/<cert>.0 /system/etc/security/cacerts/

chmod 644 /system/etc/security/cacerts/<cert>.0

reboot

make sure you change <cert> value to the hash value which we noted before

After the device reboots, browsing to Settings -> Security -> Trusted Credentials should show the new “Portswigger CA” as a system trusted CA.

Now run the application and we were able to bypass SSL pinning.

Thanks