This is the most underrated channel I've ever came on RUclips, I was surprised by how little subscribes you have comparing to the quality of your content, please keep up the good work and never give up man.
You are awesome. Keep doing great things. I tried different method but your explanation is so easy to follow and everything work perfectly. Thanks dude :)
@@CorSecure Hey its me again lol, so I have tried to bypass the SSL of X (twitter) and I've used the code of someone you show in the video aswell as 3 others but it didnt work, do you have any idea why?
Hi thanx for sharing the good and valuable information I want to ask a question An application is not make any api question when its connect to proxy how to resolve that issue
On my x86 host and virtual device, when running frida with a codeshare, it's asking for an arm64 so Gadget. Why does frida think I am on an arm architecture? Of course supplying that arm64 Gadget just leads to another error. Is there a Frida Slack or similar channel where I can get support?
If this is the error message that I think it is, then it most likely means that the version numbers don't match between the frida server on the device and frida on your host machine. You can check the version numbers by running frida --version on your host and ./frida-server --version from the directory where it was installed on the mobile device. I'm not sure about a slack, but I usually check the frida github issues page whenever I am having problems. Most of the time there is already a thread that covers whatever problems I am having. github.com/frida/frida/issues/2326
The -U flag just tells Frida to connect to the device that is connected with ADB. it's technically not connected over USB, but from the perspective of Frida, being connected to ADB is the same thing as if it was connected with a USB cable.
When I run frida-ps on my host machine it shows processes running on my host machine, not the virtual device. Looks like when you run it, it's a list of processes on the device.
Yep. The -U flag tells it use the device that is connected with ADB. There is also an option to use the -R flag to connect to remote device. I never use that option though since I always have my device connected.
For some reason frida-ps -U was not showing anything for me, even though the server was running. Then what I did was just started the frida server using magisk-frida module. That worked
i don't know why but when i implement the codeshare ssl pinning bypass code it throws an error saying "Failed to spawn: need Gadget to attach on jailed Android; its default location is:"
The most likely issue is that the versions of Frida and the Frida server on your device don't match. Here's a github issues thread that might have some more information that could help. github.com/frida/frida/issues/2326
Thanks a lot for this video. This worked with one app but didn't work with 2 other apps. Frida server is running, but I get "the client failed to negotiate a TLS..." on Burpsuite. Any idea why? I got it working for one app but not the others, and I followed the same steps.
Hi @CorSecure, your video help to understand the ssl bypass but how can we prevent ssl pining from bypassing? Is there any way. If so can you make another video related this !
That's a difficult question. Ultimately, I don't think it is possible to implement SSL pinning in a way that is impossible to bypass. By the nature of mobile applications, the attacker has full access to the binary and can reverse engineer it to bypass any protections that are in place on the client side. However, there are some types of more robust pinning methods and other protections out there that can be much more difficult to bypass than the common types of pinning that I bypassed in this video. It's really a question of whether those more robust protections are worth the additional effort (or cost) associated with them.
I'm currently facing the issue of executing bypass ssl pinning. Frida-server is running but it shows like this: "Failed to spawn: need Gadget to attach on jailed Android; its default location is: C:\Users\MyWindows\AppData\Local\..." Is it a bug or I missed something? The current Frida version is 15.1.21
Is the device that you are using rooted? I have never seen this particular error before, but the phrase "jailed Android" make it seem like it is a non-rooted device. If so, I don't believe that this method of bypassing SSL Pinning will work. However, I do have another video that shows a different method of bypassing SSL Pinning that will work on a non-rooted device. ruclips.net/video/qaJBWcueCIA/видео.html
@@CorSecure yes, a rooted emulator. It's fixed now. Somehow my adb got disconnected and need to reconnect through tcpip to make it visible on adb devices. But I got the following error. Still in bypass ssl pinning. "" I've tried to turn off the check for server and publisher's certificate revocation, make codeshare as a trusted site, and sync my time windows with the internet. Nothing works with that.
@@AryYuliantoo I wish I could help, but I've never come across that error when using Frida before. My best recommendation would be to try using Objection, which I go over in the video I linked in my last comment. You may have better luck using that method to bypass SSL Pinning.
@@CorSecure no worries, found the answer. It had something to do with the expiring certificate from Let’s Encrypt. Even though you can't help directly but this little discussion could lead to the other things for me. Thanks for the quick response anyways. About non-root android, I have no idea how to install apksigner and zipalign in the windows command prompt. And also it's already worked right now. Great video! :)
@@CorSecure Failed to spawn: need Gadget to attach on jailed Android; its default location i s: C:\Users\Yogesh\AppData\Local\Microsoft\Windows\INetCache\frida\gadget-androi d-arm64.so same problem ... i am using rooted phone
I get this error "generic_x86_arm:/ # /system/bin/sh: /data/local/tmp/frida-server/: can't execute: Is a directory" I did all the steps correctly can anyone help?
I don't think I've ever gotten that particular error, but I found this post on stackoverflow that had the same issue. I hope this helps. stackoverflow.com/questions/62171745/frida-server-unable-to-connect
@@CorSecure Thank you so much bro for your effort but I am on a non-rooted phone and I also google the issue but every forum and comment is telling the solution over a rooted phone
@@pakvsenglive3755 oh yea. this won't work without a rooted phone because you need to install and run the frida server on the device. however, I do have another video showing how to bypass SSL Pinning using objection that does not require a rooted device. if you want to try following that process, it might work better for you. ruclips.net/video/qaJBWcueCIA/видео.html
I followed the process and it worked for the first app I tried. However I'm trying on a different app and getting the following message: "Failed to spawn: need Gadget to attach on jailed Android; its default location is: /Users/user/.cache/frida/gadget-android-arm64.so". Any idea how to fix this?
That error most likely means that either the frida-server is not running on the Android device or the version numbers of the frida-server (on the Android device) and frida (on the PC) do not match.
If the proxy is configured correctly, then SSL pinning is a very likely reason why you wouldn't be seeing traffic. You should see some TLS errors in the error log on your Burp Suite dashboard if that is the case. I have some additional instructions on my website if that helps. corsecure.blog/2023/08/24/bypassing-ssl-pinning-with-frida/
Thank you ! Your channel is so underrated !
This is the most underrated channel I've ever came on RUclips, I was surprised by how little subscribes you have comparing to the quality of your content, please keep up the good work and never give up man.
Thanks!
You are awesome. Keep doing great things. I tried different method but your explanation is so easy to follow and everything work perfectly. Thanks dude :)
Thanks! I'm glad it helped!
Great! Your audio quality is getting better compared to previous videos
I've watched videos from your first ever one to this one and you explain things so well tysm
thanks!
@@CorSecure Hey its me again lol, so I have tried to bypass the SSL of X (twitter) and I've used the code of someone you show in the video aswell as 3 others but it didnt work, do you have any idea why?
a bit tricky but I got it working in this order emu, server, twitter, burp, connection last approximately 3 minutes then I need to reboot my pc
Hi thanx for sharing the good and valuable information
I want to ask a question
An application is not make any api question when its connect to proxy how to resolve that issue
On my x86 host and virtual device, when running frida with a codeshare, it's asking for an arm64 so Gadget. Why does frida think I am on an arm architecture? Of course supplying that arm64 Gadget just leads to another error. Is there a Frida Slack or similar channel where I can get support?
If this is the error message that I think it is, then it most likely means that the version numbers don't match between the frida server on the device and frida on your host machine. You can check the version numbers by running frida --version on your host and ./frida-server --version from the directory where it was installed on the mobile device.
I'm not sure about a slack, but I usually check the frida github issues page whenever I am having problems. Most of the time there is already a thread that covers whatever problems I am having.
github.com/frida/frida/issues/2326
i need help i got this error Unable to load SELinux policy from the kernel: Failed to open file “/sys/fs/selinux/policy”: Permission denied
I found this thread on GitHub about this issue. Hopefully some of the comments on that thread will help.
github.com/frida/frida/issues/597
Hi,
What should be the package extensions of frida if I'm using mac book pro M1 chip and how to install it
Also works on some Windows apps?
why do you specify -U on frida-ps since you are using an emulator and not a real device over USB?
The -U flag just tells Frida to connect to the device that is connected with ADB. it's technically not connected over USB, but from the perspective of Frida, being connected to ADB is the same thing as if it was connected with a USB cable.
When I run frida-ps on my host machine it shows processes running on my host machine, not the virtual device. Looks like when you run it, it's a list of processes on the device.
Yep. The -U flag tells it use the device that is connected with ADB. There is also an option to use the -R flag to connect to remote device. I never use that option though since I always have my device connected.
For some reason frida-ps -U was not showing anything for me, even though the server was running. Then what I did was just started the frida server using magisk-frida module. That worked
i don't know why but when i implement the codeshare ssl pinning bypass code it throws an error saying "Failed to spawn: need Gadget to attach on jailed Android; its default location is:"
The most likely issue is that the versions of Frida and the Frida server on your device don't match. Here's a github issues thread that might have some more information that could help.
github.com/frida/frida/issues/2326
Thanks a lot for this video. This worked with one app but didn't work with 2 other apps. Frida server is running, but I get "the client failed to negotiate a TLS..." on Burpsuite. Any idea why? I got it working for one app but not the others, and I followed the same steps.
Hi @CorSecure, your video help to understand the ssl bypass but how can we prevent ssl pining from bypassing? Is there any way. If so can you make another video related this !
That's a difficult question. Ultimately, I don't think it is possible to implement SSL pinning in a way that is impossible to bypass. By the nature of mobile applications, the attacker has full access to the binary and can reverse engineer it to bypass any protections that are in place on the client side. However, there are some types of more robust pinning methods and other protections out there that can be much more difficult to bypass than the common types of pinning that I bypassed in this video. It's really a question of whether those more robust protections are worth the additional effort (or cost) associated with them.
I'm currently facing the issue of executing bypass ssl pinning.
Frida-server is running but it shows like this:
"Failed to spawn: need Gadget to attach on jailed Android; its default location is: C:\Users\MyWindows\AppData\Local\..."
Is it a bug or I missed something?
The current Frida version is 15.1.21
Is the device that you are using rooted? I have never seen this particular error before, but the phrase "jailed Android" make it seem like it is a non-rooted device. If so, I don't believe that this method of bypassing SSL Pinning will work. However, I do have another video that shows a different method of bypassing SSL Pinning that will work on a non-rooted device.
ruclips.net/video/qaJBWcueCIA/видео.html
@@CorSecure yes, a rooted emulator. It's fixed now. Somehow my adb got disconnected and need to reconnect through tcpip to make it visible on adb devices. But I got the following error. Still in bypass ssl pinning.
""
I've tried to turn off the check for server and publisher's certificate revocation, make codeshare as a trusted site, and sync my time windows with the internet. Nothing works with that.
@@AryYuliantoo I wish I could help, but I've never come across that error when using Frida before. My best recommendation would be to try using Objection, which I go over in the video I linked in my last comment. You may have better luck using that method to bypass SSL Pinning.
@@CorSecure no worries, found the answer. It had something to do with the expiring certificate from Let’s Encrypt. Even though you can't help directly but this little discussion could lead to the other things for me. Thanks for the quick response anyways.
About non-root android, I have no idea how to install apksigner and zipalign in the windows command prompt. And also it's already worked right now. Great video! :)
@@CorSecure Failed to spawn: need Gadget to attach on jailed Android; its default location i s: C:\Users\Yogesh\AppData\Local\Microsoft\Windows\INetCache\frida\gadget-androi d-arm64.so
same problem ... i am using rooted phone
Can you provide the steps on how you rooted your emulator?
he already showed it in previous series. emulator already rooted, just run adb shell as root
I get this error "generic_x86_arm:/ # /system/bin/sh: /data/local/tmp/frida-server/: can't execute: Is a directory" I did all the steps correctly can anyone help?
Thank you for this wonderful tutorial. Worked Perfectly.
I got the following error at objecton explore
Unable to connect to the frida server: unable to connect to remote frida-server: closed
I don't think I've ever gotten that particular error, but I found this post on stackoverflow that had the same issue. I hope this helps.
stackoverflow.com/questions/62171745/frida-server-unable-to-connect
@@CorSecure Thank you so much bro for your effort but I am on a non-rooted phone and I also google the issue but every forum and comment is telling the solution over a rooted phone
@@pakvsenglive3755 oh yea. this won't work without a rooted phone because you need to install and run the frida server on the device. however, I do have another video showing how to bypass SSL Pinning using objection that does not require a rooted device. if you want to try following that process, it might work better for you.
ruclips.net/video/qaJBWcueCIA/видео.html
@@CorSecure Bruh , I am already using objection and facing this error on objection explore .
I followed the process and it worked for the first app I tried. However I'm trying on a different app and getting the following message: "Failed to spawn: need Gadget to attach on jailed Android; its default location is: /Users/user/.cache/frida/gadget-android-arm64.so". Any idea how to fix this?
That error most likely means that either the frida-server is not running on the Android device or the version numbers of the frida-server (on the Android device) and frida (on the PC) do not match.
how did you solve the error
Hello, Will this work with facebook?
Thank you very much! Everything worked perfectly
Can you make an explanation through Android?
If an app returns no data via proxy does it mean I should use this? Or what else can it be? Nice vid btw
If the proxy is configured correctly, then SSL pinning is a very likely reason why you wouldn't be seeing traffic. You should see some TLS errors in the error log on your Burp Suite dashboard if that is the case.
I have some additional instructions on my website if that helps.
corsecure.blog/2023/08/24/bypassing-ssl-pinning-with-frida/
how to avoid ssl pinning
Emulator name pls
I am using the Android Studio emulator. I have another video where I walk through how I set up my emulator.
ruclips.net/video/0rz8KbhwR6s/видео.html
done