search

httptoolkit / frida-interception-and-unpinning

Frida scripts to directly MitM all HTTPS traffic from a target mobile application
https://httptoolkit.com/android/
GNU Affero General Public License v3.0
905 stars 178 forks source link

SSL unpinning not working on Instagram app #5

Closed mnkgrover08 closed 2 years ago

mnkgrover08 commented 2 years ago

com.instagram.android

Screenshot 2021-10-08 at 17 42 46 Screenshot 2021-10-08 at 17 46 06
pimterry commented 2 years ago

This is a known issue that's documented in the guide for this script under Caveats:

Notably some apps which will go above and beyond, by implementing their own custom certificate pinning techniques from scratch, to make disabling it as difficult as possible. The prime example of this is the various Facebook apps, which all use their own custom reimplementation of TLS rather than the standard platform APIs.

It's definitely possible to automatically remove certificate pinning features from that too within the same Frida script in theory (contributions very welcome!), but it's significantly more difficult than mocking out a well-known common library, so I haven't done that yet, and so this script won't work for Facebook, Facebook Messenger, Instagram, or similar.

Fortunately that doesn't matter though, because Facebook offer a whitehat option in their apps to allow security researchers to disable certificate pinning directly, and you can just use that instead.

You might also find https://github.com/itsMoji/Instagram_SSL_Pinning useful.