Bypassing SSL pinning to sniff traffic on an Android emulator #273

Tustin · 2025-05-28T18:57:13Z

Tustin
May 28, 2025
Maintainer

One of the main hurdles I had in the past was getting SSL unpinning setup for the PS App on Android because I no longer had a jailbroken iOS device to do this (which is what I was most familiar with). In recent years it seems like this new tool called HTTP Toolkit has come out and it makes this process so much easier. It's quite literally a few mouse clicks and I had all the SSL requests decrypted and visible. I figured I'd make a brief tutorial on how to do this for anyone looking to contribute, or maybe just use this for something else.

HTTP Toolkit
Android emulator (I used Bluestacks 5 because it works with Hyper-V which I need enabled)
Frida

Download and install HTTP Toolkit
Download and install BlueStacks 5. You can probably use something else like Nox if you want. I installed the Samsung Galaxy S22 Ultra profile
This might not be required, but in Bluestacks > Settings > Advanced, enable Android Debug Bridge (ADB). I don't think HTTP Toolkit uses this but its still nice to have enabled
Install the PS App on your emulator from the Google Play Store
Open the HTTP Toolkit program, and on the Intercept tab, select Android App via Frida (this should be available if your emulator is running)
Click your emulator in the box (if it throws any errors, just try again)
A list of all the apps on your emulator should show up, select the PS App
The app should spawn on your emulator, and all of the requests should start popping up in HTTP Toolkit fully decrypted. If the app closes on your emulator, just open the app switcher and go back to it.