Pasted

/*
    Android SSL Re-pinning frida script v0.2 030417-pier 
 
   $ adb push burpca-cert-der.crt /data/local/tmp/cacert.crt
   $ frida -U -f it.app.mobile -l frida-android-repinning.js --no-pause
 
   Original Script: https://techblog.mediaservice.net/wp-content/uploads/2017/07/frida-android-repinning_sa-1.js 
*/
setTimeout(function(){
    Java.perform(function(){
        console.log("");
        console.log("[.] Cert Pinning Bypass in process...");
 
        var CertificateFactory = Java.use("java.security.cert.CertificateFactory");
        var FileInputStream    = Java.use("java.io.FileInputStream");
        var BufferedInputStream= Java.use("java.io.BufferedInputStream");
        var X509Certificate    = Java.use("java.security.cert.X509Certificate");
        var KeyStore           = Java.use("java.security.KeyStore");
        var TrustManagerFactory= Java.use("javax.net.ssl.TrustManagerFactory");
        var SSLContext         = Java.use("javax.net.ssl.SSLContext");
 
        // Load CAs from an Input Stream
        console.log("[+] Loading our CA Cert looking Motherfucker!...");
        cf = CertificateFactory.getInstance("X.509");
 
        try {
            var fileInputStream = FileInputStream.$new("/data/local/tmp/cacert.crt");
        }catch(err){
            console.log("[o] "+err);
        }
 
        var bufferedInputStream = BufferedInputStream.$new(fileInputStream);
        var ca = cf.generateCertificate(bufferedInputStream);
        bufferedInputStream.close();
 
        var certInfo = Java.cast(ca, X509Certificate);
        console.log("[o] Our CA Info: "+certInfo.getSubjectDN());
 
        // Create a Keystore containing a Full of fucking shit and trusted CAs
        console.log("[+] Creating a KeyStore for our CA .. Assholes!");
        var keyStoreType = KeyStore.getDefaultType();
        var keyStore = KeyStore.getInstance(keyStoreType);
        keyStore.load(null, null);
        keyStore.setCertificateEntry("ca", ca);
 
        // Create a Trustmanager that trusts me and the CAs in our KeyStore MotherFucker!!
        console.log("[+] Creating a TrustManager that trust our love ones in our fucking KeyStore shit...");
        var tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
        var tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
        tmf.init(KeyStore);
        console.log("[+] Our TrustManager is ready.. so am i...");
 
        console.log("[+] Hijacking SSLContext methods now...");
        console.log("[+] Waiting for the app to provoke me and also to invoke SSLContext.init()...");
 
        SSLContext.init.overload("[Ljavax.net.ssl.KeyManager;","[Ljavax.net.ssl.TrustManager;","java.security.SecureRandom").implementation = function(a,b,c){
            console.log("[o] App provoked me and this little shit here >> javax.net.ssl.SSLContext.init...");
            SSLContext.init.overload("[Ljavax.net.ssl.KeyManager;","[Ljavax.net.ssl.TrustManager;","java.security.SecureRandom").call(this, a, tmf.getTrustManagers(), c);
            console.log("[+] SSLContext initialized with our custom Shit TrustManager!");
        }
 
    });
},0);