Crush SSL/TLS pinning defenses with ease — dynamic, modular, and built for Frida.
PinSlayer is a universal SSL Pinning bypass framework powered by Frida. It hooks into SSL trust mechanisms across Android apps at runtime — enabling full interception of HTTPS traffic without modifying APKs or requiring complex repackaging.
Whether you're testing hardened banking apps, React Native builds, or deeply obfuscated pinning logic — PinSlayer slays it all.
- 🔒 Bypass SSL Pinning for:
TrustManager,X509TrustManagerHostnameVerifierSSLSocketFactory,HurlStack- OkHttp, Volley, Retrofit
- Flutter, React Native, Cordova/WebView
- 🧠 Smart native-level hooking:
SSL_CTX_set_custom_verify,SSL_get_peer_cert_chain, etc.
- 🧰 Fully dynamic – no repackaging or certificate injection
- ⚔️ Compatible with Zygisk, Magisk, and Rooted/Non-rooted setups
- 🎯 Tested on Android 7 to Android 14+
- Frida
- Rooted or Frida-server-enabled Android device
- HTTPS proxy tool: Burp Suite or mitmproxy
git clone https://github.com/your-username/pinslayer.git
cd pinslayer
# Run Frida with the script
frida -U -n <package-name> -l pinslayer.js✅ Make sure your device trusts your proxy's root CA (install it manually or push it to /system/etc/security/cacerts/ if rooted).
| App Type | Status |
|---|---|
| React Native | ✅ Bypassed |
| Flutter | ✅ Bypassed |
| Obfuscated APK | ✅ Bypassed |
| OkHttp3 | ✅ Bypassed |
| Banking Apps | |
| Play Integrity | ❌ Server-side validation only (not bypassable with SSL alone) |
Add a GIF or screenshot of mitmproxy/Burp capturing traffic after bypass here
PinSlayer is intended for authorized testing and research only.
Using it against apps without permission is illegal and unethical.
You are responsible for your actions.
This project is licensed under the MIT License.
Crafted with ❤️ for the infosec community by [Nirmal-Chakraborty]