How to avoid certificate pinning in the latest versions of Android

We previously explained how to construct an analysis environment enabling the certificate pinning process to be bypassed in Android applications, in order to be able to examine network traffic and to easily determine what data is being transmitted over secure communications protocols. In particular, we looked at the steps to take to install Cydia Substrate and Android SSL TrustKiller, and therefore analyze packets sent using SSL.

The disadvantage of these applications is that they are limited to Android versions no later than 4.2.2, despite the fact that the device or application we are auditing very often exceeds these specifications. We should be asking ourselves whether we can sidestep this protective framework within a controlled environment. This tutorial will teach you how to use Xposed and its JustTrustMemodule to do this.

How to avoid certificate pinning in the latest versions of Android