Issue getting frida script to work about instagram-ssl-pinning-bypass

[Eltion]

@pizzaso
Yes that's all it does. That's really strange problem. I just tested with x86 and frida it's working.

frida-server version : 15.1.22

Unfortunately I can't test for arm.

[Eltion]

Of course. Can you tell me the following?

Which instagram version are you using?
Can you show me the log of the script after running frida?
Which tool are you using to capture the trafic?

Also could you try the patched apk if it's working for you?

[pizzaso]

@Eltion,

Thank you for the quick reply,

The app version is 241.1.0.18.114, for frida i'm running the script and the two functions are hooked (i can see the verify one called when opening the app) but the certificate errors are still there, and i've tried using both mitmproxy and burp but to no avail.

I prefer running the gadget instead of the patched apk as the versions change quickly but if i can't solve this i guess there is not other way then.

[Eltion]

@pizzaso

Do you see requests to i.instagram.com or no requests at all?

[pizzaso]

@Eltion

No, no requests at all

[Eltion]

@pizzaso
Can you share with me the error from mitmproxy or burp. In mitmproxy you can go to events Shift + E. Or in Brup you can check the log in Dashboard -> Event Logs

[pizzaso]

@Eltion

This is for Burp (certificate unknown):

and mitmproxy:

Rarely do i see an error for i.instagram.com (also saw this error a few times before , and that's when i bumped my java version from 8 to 16 and also tried mitmproxy)

No sure the above is helpful, these domains suggest that they speak MQTT and i know that's not what we are patching for but maybe it could help.

[Eltion]

Yes your correct. Actually we are only patching for the instagram api requests. A lot of the others are patched using the build in android CertificateFactory. To do that you can use https://codeshare.frida.re/@pcipolloni/universal-android-ssl-pinning-bypass-with-frida/. But I would expect that i.instagra.com requests to be captured.

If you may capture one of such request and share the error with me it would help me a lot. Thanks.

[pizzaso]

@Eltion

This is for Burp (after navigating a lot of screens):

this is when i decided to use mitmproxy, for the latter, it just gives a generic "certificate not trusted" error.

[Eltion]

@pizzaso That's interesting. I think this probably is an error with the proxy setup. Can you update to the latest version of Brup?

[pizzaso]

@Eltion Yes ,i am using the up to date version 2022.5.2

[Eltion]

It looks this is a openJDK problem as you mentioned https://bugs.openjdk.org/browse/JDK-8221218. Can you run java --version and check java version.

For me its:

openjdk 17.0.3 2022-04-19 OpenJDK Runtime Environment Temurin-17.0.3+7 (build 17.0.3+7) OpenJDK 64-Bit Server VM Temurin-17.0.3+7 (build 17.0.3+7, mixed mode, sharing)

[pizzaso]

@Eltion

This is the output:

>java -version
openjdk version "16.0.2" 2021-07-20
OpenJDK Runtime Environment Temurin-16.0.2+7 (build 16.0.2+7)
OpenJDK 64-Bit Server VM Temurin-16.0.2+7 (build 16.0.2+7, mixed mode, sharing)

I was using java 8 and updated because of the error above to version16 but no luck, I'll try reinstalling Burp maybe it'll help although i have little hope.

[Eltion]

Can you also update Java from here https://adoptium.net/

[pizzaso]

No luck 😥

>java -version
openjdk version "17.0.3" 2022-04-19
OpenJDK Runtime Environment Temurin-17.0.3+7 (build 17.0.3+7)
OpenJDK 64-Bit Server VM Temurin-17.0.3+7 (build 17.0.3+7, mixed mode, sharing)

#Tried to launch the jar directly instead of the windows executable

>java -jar -Xmx4g burpsuite_community_v2022.5.2.jar
Your JRE appears to be version 17.0.3 from Eclipse Adoptium
Burp has not been fully tested on this platform and you may experience problems.
Built new session factory

[pizzaso]

@Eltion,

The patched apk worked fine but the frida script didn't, not sure what that means 😕 ??

[pizzaso]

@Eltion,

At least i know it's not a problem with the certificate or the proxy

[pizzaso]

@Eltion

I just reviewed the script, it's doing the same thing apart that it bundles the frida script and the frida gadget inside the app essentially assuming that you'll work with a non-rooted phone.

I have a rooted phone so it should'nt be a problem for me running the bypass directly, hmm not sure what's happening?

[pizzaso]

Consider this resolved