SSL Pinning Bypass via Proxy: How to Intercept Mobile App Traffic Without Breaking the Test

```html

You set up a proxy, connect the device — and still the application does not show traffic or crashes with an error. Most likely, the problem lies in SSL Pinning: a protection mechanism that developers intentionally embed into the application to block the interception of HTTPS requests. This is a headache for anyone analyzing the behavior of competing applications, testing advertising integrations, or studying marketplace APIs.

In this guide, we will discuss what SSL Pinning is, why it interferes with proxy operation, and how to bypass it step-by-step, without unnecessary theory.

What is SSL Pinning and why is it embedded in applications

SSL Pinning (or Certificate Pinning) is a security mechanism where a mobile application pre-embeds a specific SSL certificate or public key of the server. Each time it connects, the application checks: does the server's certificate match the one that is embedded inside? If not, the connection is terminated.

In a standard HTTPS scheme, a browser or application trusts any certificate signed by a trusted Certificate Authority (CA). This is what proxy tools like Charles Proxy or mitmproxy take advantage of: they substitute their certificate, decrypt the traffic, and forward it. The user sees all data exchanges in plain text.

SSL Pinning breaks this scheme. The application sees the proxy tool's certificate, realizes that it does not match the server's "native" certificate, and refuses to work. This is why you see errors like SSL handshake failed, Certificate verification failed, or simply a blank screen in the application.

Developers implement SSL Pinning for several reasons:

• Protection against Man-in-the-Middle (MITM) attacks
• Prevention of API reverse engineering
• Protection against bots and automated requests
• Hiding internal monetization logic and advertising integrations

Among the applications that actively use SSL Pinning are: banking applications, marketplaces (Wildberries, Ozon), advertising SDKs (Facebook, TikTok), payment systems, and large e-commerce platforms. This is why bypassing SSL Pinning is so important for marketers, arbitrage specialists, and competitive analysts.

Why the proxy does not work if the application has SSL Pinning

When you set up a proxy on your phone (for example, through Wi-Fi settings), all HTTP and HTTPS traffic goes through the proxy server. For HTTP, this works without problems — the traffic is already open. But for HTTPS, the proxy tool must "present itself" as the server by substituting its certificate.

This is where the conflict arises. Regular applications accept this certificate if you have installed the root certificate of the proxy tool in the device's system store. But applications with SSL Pinning ignore the system store — they only check their "embedded" certificate.

It is important to understand: the problem is not with the proxy server (whether residential, mobile, or data center). The proxy here acts as an intermediary node for routing traffic. The problem lies within the application itself, which refuses to accept the substituted certificate. Therefore, the solution needs to be sought at the application or device level, not at the proxy server level.

There are several types of SSL Pinning, and they differ in the complexity of bypassing:

Type of Pinning	What is checked	Difficulty of bypassing
Certificate Pinning	Full server certificate	Medium
Public Key Pinning	Public key from the certificate	High
Hash Pinning	Hash of the certificate or key	High
Network Security Config	Android config file (XML)	Low–medium

Tools for intercepting traffic: Charles, mitmproxy, Burp Suite

Before proceeding to bypass SSL Pinning, you need to choose a tool for intercepting traffic. They all work on the same principle: they set up a local proxy server through which the device's traffic passes. The difference lies in convenience, features, and price.

Charles Proxy

The most popular tool among marketers and testers without a deep technical background. It has a graphical interface and works on Windows and macOS. It allows you to see all requests and responses in a convenient tree, filter by domain, and edit requests on the fly. It is paid, but there is a trial period. It is excellent for analyzing marketplace APIs and advertising SDKs.

mitmproxy

A free open-source tool. It works through the command line, but there is a web interface (mitmweb). Very flexible: supports scripts for automatic traffic modification. It is well-suited for those who want to automate analysis or integrate interception into a testing pipeline. It is slightly more complex to set up than Charles.

Burp Suite

A professional security testing tool. It has a free Community version with basic functionality. It is especially convenient for detailed analysis of requests, working with cookies and sessions. It is actively used for analyzing competitors' APIs and researching advertising integrations. Its interface is more complex than Charles, but its capabilities are broader.

Tool	Interface	Price	For whom
Charles Proxy	GUI (convenient)	Paid (~$50)	Marketers, analysts
mitmproxy	CLI + Web UI	Free	Technical specialists
Burp Suite	GUI (complex)	Free / Pro	Security testers

For most tasks of a marketer or arbitrage specialist — analyzing advertising requests, studying marketplace APIs, monitoring application traffic — Charles Proxy will be the optimal choice. If automation or working without a GUI is needed — mitmproxy.

Methods for bypassing SSL Pinning: from simple to advanced

There are several approaches to bypassing SSL Pinning. They vary in complexity, device requirements, and reliability. Let's consider each — from the simplest to the most powerful.

Method 1: Installing the certificate in the system store (Android only)

The simplest way — but it only works for applications that use the system certificate store. On Android versions prior to 7.0, user certificates were accepted alongside system ones. Starting from Android 7.0, applications by default ignore user CAs. If the application explicitly allows user certificates in network_security_config.xml — this method will work. For most modern applications with SSL Pinning — it will not help.

Method 2: Frida — dynamic patching of the application

Frida is a tool for dynamic instrumentation of applications. It allows you to intercept function calls within the application "on the fly" and modify their behavior. There are ready-made scripts for bypassing SSL Pinning that disable certificate verification without modifying the APK. Requires root on Android or jailbreak on iOS. This is the most reliable and universal method.

Method 3: Patching the APK (Android)

Decompiling the APK file using apktool, removing or modifying the SSL Pinning code, rebuilding and signing the application. Does not require root, but requires technical skills to work with smali code. Works well for applications with a simple implementation of Pinning through Network Security Config. For applications with native code (C/C++) — it is significantly more complex.

Method 4: Objection — a wrapper over Frida for beginners

Objection is a Frida-based tool with a simpler command-line interface. It contains built-in commands to bypass SSL Pinning with one command: android sslpinning disable. Suitable for those who do not want to deal with writing Frida scripts manually. Requires root or jailbreak.

Method 5: Using a rooted emulator

Instead of a physical device, you can use an Android emulator (for example, Genymotion or the standard AVD from Android Studio) with root access enabled. This allows you to install system certificates and run Frida without the risk of "bricking" a real phone. A convenient option for regular testing in a working environment.

Step-by-step bypass of SSL Pinning on Android

Let's break down the most practical scenario: an Android device or emulator with root, the Objection tool + Frida, and the proxy tool Charles Proxy or mitmproxy.

Step 1: Set up the proxy tool on your computer

Launch Charles Proxy or mitmproxy. By default, they listen on port 8888 (Charles) or 8080 (mitmproxy). Remember the IP address of your computer on the local network — you will need it to set up the proxy on the device.

Step 2: Set up the proxy on the Android device

Go to Wi-Fi settings → select your network → click "Modify" → "Advanced options" → Proxy: Manual. Specify the computer's IP and the tool's port. Now all device traffic goes through your proxy.

Step 3: Install the proxy tool's certificate

Open the browser on the device and go to chls.pro/ssl (for Charles) or mitm.it (for mitmproxy). Download and install the certificate. On Android with root, additionally move the certificate to the system store — this is necessary for some applications.

Step 4: Run Frida-server on the device

Download the appropriate version of frida-server from GitHub (the version must match the version of Frida on your computer). Upload the file to the device via ADB:

adb push frida-server /data/local/tmp/
adb shell "chmod 755 /data/local/tmp/frida-server"
adb shell "su -c /data/local/tmp/frida-server &"

Step 5: Connect via Objection and disable SSL Pinning

On your computer, install Objection via pip and run it, specifying the application package name:

pip install objection
objection -g com.example.app explore

After connecting, execute the command to disable SSL Pinning in the Objection console:

android sslpinning disable

After this, open the application and start interacting with it. The traffic will appear in Charles or mitmproxy in decrypted form.

Step 6: For applications with Network Security Config

If the application uses network_security_config.xml, you can decompile the APK using apktool, find this file, and add permission for user certificates, then rebuild and re-sign the APK. This works without root, but requires disabling the application's signature verification.

Step-by-step bypass of SSL Pinning on iOS

On iOS, the situation is more complicated: most methods require jailbreak. Without it, the possibilities are limited. Let's consider both options.

Option A: With jailbreak (iOS 14-16, checkra1n / palera1n)

Step 1: Set up the proxy

On your iPhone, go to Settings → Wi-Fi → your network → Configure Proxy → Manual. Specify the IP of your computer and the port of Charles/mitmproxy.

Step 2: Install the certificate

Open Safari and go to chls.pro/ssl. Install the profile via Settings → General → VPN & Device Management. Then activate it in Settings → General → Trust Certificates.

Step 3: Install SSL Kill Switch 2 via Cydia/Sileo

SSL Kill Switch 2 is a tweak for jailbroken iOS that globally disables SSL Pinning for all applications. Find it in Cydia or Sileo, install it, and reboot the device. After this, most applications will stop checking certificates, and traffic will be visible in Charles.

Step 4: Alternative — Frida + Objection on iOS

Similar to Android: install frida-server via Cydia, connect via Objection on your computer, and execute ios sslpinning disable. This method is more flexible and works for applications that SSL Kill Switch 2 does not cover.

Option B: Without jailbreak (limited capabilities)

Bypassing SSL Pinning on iOS without jailbreak is significantly more difficult. One option is to use the tool Proxyman with its SSL Proxying feature for iOS without jailbreak. Proxyman installs a special profile on the device and uses a VPN interface to intercept traffic. It works for many applications, but not for all with strict Pinning.

Another option is to use the iOS simulator in Xcode. The simulator does not have SSL Pinning at the OS level, and many applications can be launched in it (if they support the simulator). But this is suitable only for testing, not for analyzing production applications.

Which type of proxy to choose for testing mobile applications

After SSL Pinning is bypassed, the application's traffic goes through your proxy tool (Charles, mitmproxy). But for some tasks, you also need to route traffic through an external proxy server — for example, so that the application "sees" another region or another IP address. Here, it is important to choose the right type of proxy.

Residential Proxies

Residential proxies use IP addresses of real home users. Mobile applications, especially advertising SDKs and marketplaces, trust such IPs significantly more than data center addresses. If you are analyzing application behavior based on region — residential proxies will provide the most "clean" picture, close to a real user.

Mobile Proxies

Mobile proxies operate through real mobile networks (3G/4G/5G). This is especially relevant when testing mobile applications: IPs from mobile networks have the highest trust level with Facebook Ads SDK, TikTok, and other advertising platforms. If your goal is to analyze advertising requests from the application or test SDK behavior in a mobile environment, mobile proxies are the optimal choice.

Data Center Proxies

Data center proxies are suitable for tasks where speed is more important than the "naturalness" of the IP: for example, for mass parsing of open APIs or performance testing. They are less preferred for analyzing advertising SDKs and secure applications, as they are easily recognized by anti-fraud systems.

Type of Proxy	Application Trust	Speed	Best Scenario
Residential	High	Medium	Regional analysis, marketplaces
Mobile	Maximum	Medium	Advertising SDKs, Facebook, TikTok
Data Centers	Low	High	Parsing open APIs, load testing

Practical scenarios: arbitration, e-commerce, marketing

Let's break down specific tasks for which marketers and arbitrage specialists bypass SSL Pinning.

Scenario 1: Analyzing Facebook and TikTok advertising SDKs

Arbitrage specialists working with Facebook Ads and TikTok Ads often want to understand what data the SDK sends to the server: what events are recorded, how attribution requests are formed, what parameters affect campaign optimization. Without bypassing SSL Pinning, this is impossible — both SDKs use Certificate Pinning.

After bypassing via Frida/Objection, you can see all SDK events in Charles: installs, purchases, registrations — and ensure that tracking is set up correctly. This is especially important when setting up CAPI (Conversions API) and checking event deduplication.

Scenario 2: Monitoring prices on Wildberries and Ozon through the application

The Wildberries and Ozon applications use SSL Pinning to protect their APIs. Sellers who want to monitor competitor prices through a mobile application (rather than the web version) encounter this protection. After bypassing SSL Pinning, you can study the structure of API requests and understand which endpoints are used to obtain data on prices, availability, and product ratings.

Important: the obtained data can only be used for personal analysis. Automated parsing through replaying API requests violates the terms of use of most platforms.

Scenario 3: Testing advertising creatives from different regions

Marketers testing ads in Facebook Ads and TikTok Ads from different regions want to see how the application behaves when connected via IP from a specific country. The combination of bypassing SSL Pinning + residential proxy from the desired region allows you to see what content and prices are shown to users from that region.

Scenario 4: QA testing of your own application

If you are developing your own mobile application or working with a development team, intercepting traffic with SSL Pinning bypass is standard QA practice. This allows you to check the correctness of requests, find data leaks, and verify the operation of analytics and advertising SDKs in real conditions before release.

Scenario 5: Analyzing competitors in the mobile games and applications niche

Mobile game marketers use traffic interception to analyze competitors' monetization: what offers are shown, how the in-game purchase system works, which advertising networks are used. This helps build more effective UA (User Acquisition) and monetization strategies.

Checklist: check your setup before testing

Before you start intercepting traffic, make sure everything is set up correctly. Here is the complete checklist:

Common problems and their solutions

Problem	Cause	Solution
Traffic does not appear in Charles	Incorrect IP/port of the proxy	Check the IP of the computer and the port
SSL error in Charles	Certificate not installed or not activated	Reinstall and activate the certificate
Frida does not connect	Version mismatch between frida/frida-server	Synchronize versions
Objection does not disable Pinning	Native code (C/C++) with Pinning	Use a custom Frida script
The application crashes after bypass	The application checks integrity	Also disable root detection via Objection

Conclusion

SSL Pinning is a serious protection, but not insurmountable. For most practical tasks of a marketer or arbitrage specialist, a combination of: Android emulator with root + Frida/Objection + Charles Proxy is sufficient. On iOS — SSL Kill Switch 2 if jailbreak is available or Proxyman without it. The main thing is to correctly set up the chain: proxy tool on the computer → traffic through it → bypass Pinning on the device.

Remember that bypassing SSL Pinning in third-party applications is only permissible for personal analysis and research. Automated parsing and replaying API requests violate the terms of use of most platforms.

If your task is to analyze mobile application traffic in different regions or test the behavior of advertising SDKs from specific countries, you will need not only to bypass SSL Pinning but also a quality proxy server. For working with advertising platforms (Facebook Ads, TikTok Ads) and marketplaces, we recommend using mobile proxies — they have the highest trust level with anti-fraud systems and allow you to correctly emulate a real mobile environment.