312-50 Question 397
Single answer▪ Hacking Android OSDuring an authorized mobile application assessment, you are testing an Android app that is marked with android:debuggable="false" and does not trust user-installed CAs. The app communicates only over HTTPS and uses certificate pinning, which prevents your proxy from inspecting API requests. You have physical access to a rooted test device and approval to perform dynamic analysis on the app in its running state. Which approach is the MOST effective for intercepting and inspecting the app's HTTPS traffic without rebuilding the APK?
- A
Use Frida to hook the app's SSL/TLS certificate validation or pinning logic at runtime, then route traffic through an intercepting proxy
- B
Install Burp Suite's CA certificate as a user certificate on the device and configure the Android Wi-Fi proxy settings
- C
Use adb backup to extract the app's private storage and recover the TLS session keys for decryption in Wireshark
- D
Re-sign the APK with your own certificate and enable networkSecurityConfig to trust user CAs, then reinstall it over the existing app
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use runtime instrumentation to bypass certificate pinning dynamically. In Android app assessments, HTTPS interception often fails because of two separate but related controls: trust restrictions for user-installed CAs and certificate pinning. Simply installing a proxy CA certificate is often insufficient, especially on newer Android versions where apps may not trust user CAs by default unless configured through Network Security Configuration. Even if the CA is trusted, certificate pinning adds another validation layer that blocks man-in-the-middle inspection.
With root access and authorization, tools such as Frida are widely used to hook Java or native methods involved in TLS validation at runtime. This preserves the original APK and avoids the operational issues of decompiling, patching, rebuilding, and re-signing. In practice, testers often combine Frida with Burp Suite or OWASP ZAP for traffic inspection.
Relevant guidance includes Android's Network Security Configuration documentation, which explains trust anchors and user CA behavior, and OWASP Mobile Application Security Testing Guide (MASTG), which covers Android network testing, interception challenges, and common approaches to bypass certificate pinning during authorized assessments.
- A. Correct.
Correct. In a rooted, authorized testing scenario, runtime instrumentation with a framework such as Frida is a practical way to bypass certificate pinning without modifying and rebuilding the APK. By hooking methods involved in TrustManager, HostnameVerifier, or app-specific pinning checks, the tester can neutralize pinning and then use an intercepting proxy such as Burp Suite or OWASP ZAP to inspect HTTPS requests. This is commonly used in Android dynamic analysis when the app does not trust user CAs and static patching is undesirable.
- B. Incorrect.
Incorrect. This may work for apps that trust user-installed certificate authorities, but the scenario explicitly states that the app does not trust user-installed CAs and also uses certificate pinning. On newer Android versions, many apps rely on the default network security behavior that excludes user CAs unless explicitly allowed, and pinning would still block interception even if the CA were trusted.
- C. Incorrect.
Incorrect. adb backup does not provide a reliable way to recover TLS session keys from modern Android apps, and many apps disable backup entirely. Even if app data were extracted, TLS session secrets are not typically stored in a manner that allows straightforward decryption of captured traffic. This option reflects a misunderstanding of how TLS key material is handled in memory versus app storage.
- D. Incorrect.
Incorrect. Re-signing and reinstalling the APK changes the app package signature and generally prevents installation over the existing app unless the original signing key is used. It also violates the requirement to avoid rebuilding the APK. While patching network security settings can be useful in some lab workflows, it is not the most effective answer for this specific constraint and can also alter app behavior in ways that reduce test fidelity.