Skip to content
attack.paths
Connexion
← RegistryDossier · 6 steps · 5 edges

Root detection + SSL pinning bypass → MITM the API

Rooted test device with Frida. Hook the app's root-detection and OkHttp CertificatePinner; route traffic through Burp to expose the entire authenticated API surface.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: tester has the APK + a rooted Android device (or emulator) with frida-server running. The app implements root detection and certificate pinning that block out-of-the-box MITM.

§ Steps

  1. 01
    Map the authenticated APIReconnaissance
    W-RECON-API-DISCO— API Endpoint Discovery
  2. 02
    Exploit web-class vulns on the mobile APIPrivilege Escalation
    W-BOLA— Broken Object Level Authorization (API BOLA)
  3. 03
    Pull APK + reverse with jadxReconnaissance
    MOB-APK-REVERSE— APK Reverse Engineering
  4. 04
    Route traffic via BurpCredential Access
    T1557— Adversary-in-the-Middle
  5. 05
    Bypass root detectionDefense Evasion
    MOB-ROOT-DETECT-BYPASS— Android Root Detection Bypass

    frida -U -f <pkg> -l fridantiroot.js

  6. 06
    Bypass SSL pinningDefense Evasion
    MOB-SSL-PINNING-BYPASS— SSL / Certificate Pinning Bypass

    objection --gadget <pkg> explore → android sslpinning disable

§ References

§ Frequently asked

What is the "Root detection + SSL pinning bypass → MITM the API" attack path?
Rooted test device with Frida. Hook the app's root-detection and OkHttp CertificatePinner; route traffic through Burp to expose the entire authenticated API surface. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Map the authenticated API (W-RECON-API-DISCO) — a reconnaissance primitive. Assumed environment: tester has the APK + a rooted Android device (or emulator) with frida-server running.
What is the final impact of this kill-chain?
The final step lands on Bypass SSL pinning (MOB-SSL-PINNING-BYPASS), which falls under Defense Evasion. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers