From Frida to Objection: Automating the SSL Pinning Bypass🚀

In Part 1 we did the SSL Pinning bypass by hand, so to speak: we spun up frida-server, downloaded a universal script and injected it with Frida. It works perfectly, but it's several steps and can be a bit of a hassle for you if you're just starting out.

In this 2nd edition we'll pull off exactly the same thing, buuuut with a tool that turns it into a single command: Objection! :)

If you already followed the first post, this is going to feel waaaay better!

What is Objection?

Objection is a runtime exploration tool for mobile apps, built on top of Frida. In other words, it uses the same engine you already know, but gives you an interactive console with ready-to-use commands, without having to write or hunt down scripts.

Why use it for the pinning bypass?

• You don't need to download or maintain third-party scripts (unlike Frida).
• One command covers the most common pinning libraries (OkHttp, TrustManager, Conscrypt, etc.).
• The same session lets you keep exploring the app afterwards (files, memory, classes).

The only thing it asks in return is that frida-server is already running on the device, exactly what we left ready in Part 1.

Prerequisites ✅

We already set all of this up in Part 1, so here's just a recap:

• frida-server: running on the device or emulator (same version as your desktop Frida).
• Burp Suite: proxy listening (e.g. all.interface:8082) and its CA certificate installed on the device.

• Proxy configured: the device's Wi-Fi pointing to your computer's IP.
• Target app installed: we'll keep using AndroGoat.

If any of this sounds unfamiliar, take a spin through Part 1 before moving on 👆

Step 1: Install Objection ⚙️

Objection installs with pip, just like the Frida tools. In your terminal:

pip3 install objection

pip3 install objection

Check it installed correctly:

objection version

objection version

If it returns a version number, you're good to go.

Step 2: Connect Objection to the app 🔌

With frida-server already running, we tell Objection which app to hook into using its package name (the same owasp.sat.agoat we identified in Part 1 with frida-ps -Ua).

objection -n "owasp.sat.agoat" start

objection -n "owasp.sat.agoat" start

What does each part do?

• -n "owasp.sat.agoat": the "name" of the identifier / target, i.e. the app's package.
• start: starts a new session.

Step 3: The automated command ⭐

Inside Objection's console, the bypass is literally one line:

android sslpinning disable

android sslpinning disable

What happens under the hood? Objection injects hooks at the most common places where Android apps validate certificates and, instead of letting validation fail against Burp's certificate, forces it to accept it. Among others, it intercepts:

• TrustManager / X509TrustManager (the platform's standard validation).
• OkHttp3's certificate pinner, very common in modern apps.
• Checks via SSLContext, Conscrypt and related paths.

You'll see a series of lines like [+] ... pinner ... hooked in the console, confirming each hook applied. That means pinning is now disabled in memory, for this session only, so the APK isn't modified and nothing is permanent.

Step 4: Verify in Burp (PoC) 🎯

With pinning disabled, it's time to confirm the traffic actually shows up in Burp. We'll use AndroGoat again:

1. On the device, open AndroGoat and go to the Certificate Pinning module.
2. Tap the button that sends the HTTPS request to owasp.org.

3. Go to Burp's HTTP history and, if everything went well, you'll see the request logged with a 200 OK.

Before the bypass, that same request failed or didn't even show up, because the app was rejecting Burp's certificate.

That's it!! The same result as Part 1, but without touching a single script. 🎉

Conclusion 🎯

And just like that, what took several steps with Frida in Part 1, in this 2nd edition we solved with a single command: android sslpinning disable. Keep in mind, Objection doesn't replace Frida but builds on it, and it saves you a ton of time when pinning uses well-known libraries.

Once again, I hope this little post was useful to you. I made it as beginner-friendly as possible for newcomers and future mobile pentesters.

Disclaimer: this material is for educational purposes only. Always remember to run these tests in controlled environments and with the proper authorization.

Happy Hacking!! 🎯🚀