How to bypass SSL pinning
You've set up a proxy, trusted its certificate, pointed your phone at it — and one app still shows nothing but failed handshakes. That app is pinning. Here's what pinning is, why it beats the usual certificate trust, and how to get past it on apps you have the right to test.
Why trusting a certificate isn't enough
Normally a debugging proxy works because you add its root certificate to the device's trust store, and the app accepts any certificate that chains back to it. A pinned app skips the trust store. It ships with a copy of its real server's certificate (or its public-key hash) compiled in, and it checks the live connection against that copy. Your proxy's certificate doesn't match, so the app drops the connection on purpose. No amount of trusting your CA changes that — the check isn't asking the OS what's trusted.
To read the traffic you have to change what the app does at runtime, or what it contains, so it stops pinning. That means working on the client, which is why this needs a rooted or emulated Android device, or a jailbroken iPhone.
Android
Frida (most reliable). Frida injects into the running app and hooks the functions that do the pinning check, forcing them to pass. On a rooted device or an emulator you run frida-server on the device and a script from your Mac:
frida -U -f com.example.app -l disable-pinning.js
Community scripts hook the usual suspects — OkHttp's CertificatePinner, the default TrustManager, Conscrypt — in one pass. The objection toolkit wraps this so you don't have to write the script: objection -g com.example.app explore, then android sslpinning disable.
Repackage the APK. If you can't run Frida, decode the APK, add a network security config that trusts user certificates, and rebuild and resign it. This works without root but fails on apps that check their own signature, and it's more fiddly than Frida.
Emulator note. A Google-APIs emulator image (not a Play-store image) gives you root-like access, which makes the Frida route much smoother than fighting a physical device.
iOS
iOS is harder because you generally need a jailbroken device. With one, SSL Kill Switch patches the system TLS functions so pinning checks always succeed across apps, and Frida works the same way it does on Android for targeted hooks. Without a jailbreak there's no reliable, general bypass on a stock iPhone.
Getting the device wired up
Before any of this, the device has to trust your proxy's certificate and route traffic to your Mac — and that setup is the tedious part people get wrong. elcapture does the Android side in one step: over adb it installs the certificate as a system-level CA and points the device's proxy at your Mac, which is exactly the groundwork the Frida method assumes is already done. From there you attach your pinning-bypass script and the previously invisible requests start landing in the list.