WooyunDota/DroidSSLUnpinning

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1509 stars · 349 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A collection of Frida hook scripts (ObjectionUnpinningPlus) that bypass Android certificate pinning so HTTPS traffic can be intercepted with a proxy. It covers hooks for okhttp, webview, JSSE, TrustKit, Cronet, network_security_config, and more.

Use cases

• bypass android ssl pinning to capture https traffic
• intercept app traffic with mitm proxy when certificate is pinned
• hook okhttp and webview certificate validation with frida
• disable network_security_config pinning on android 7+
• penetration test android app tls protections
• handle mutual tls pinning during traffic analysis

When to choose

• you need a ready-made Frida script covering many pinning implementations (okhttp, TrustKit, Cronet, etc.)
• you are doing authorized mobile app security testing on Android
• you want to attach or spawn hooks quickly via the Frida CLI

When to avoid

• you target iOS or non-Android platforms
• you need a maintained tool with active updates and a license
• you want an Xposed-based solution without compiling (use JustTrustMe instead)
• you lack authorization to test the target app

Facets

cli-tool · maturity maintenance

security penetration-testing reverse-engineering security penetration-testing android-tools developer-tools cli python ssl-unpinning frida certificate-pinning mobile-security hooking traffic-interception android

Member repositories

For agents

markdown · JSON · MCP: product_card(name="WooyunDota/DroidSSLUnpinning")