Bypassing Android Network Security Config & SSL Pinning: Complete APK Patching Guide

When auditing mobile applications, analyzing API traffic with HTTP interception proxies like Burp Suite, Charles, or mitmproxy is a fundamental step. However, modern Android architectures—starting from Android 7.0 (API level 24) up through Android 15 and 16—disallow user-added Certificate Authorities (CAs) by default. Furthermore, high-security applications enforce strict SSL Certificate Pinning, rejecting traffic even when trusted root certificates are provisioned on the device.

In this tutorial, we cover the exact operational workflow to decompile an Android application, disable the OS-level network_security_config.xml restrictions, patch bytecode-level SSL pinning (OkHttp and TrustManager), rebuild, and sign the binary—all accessible through browser-based workflows on APKTool Studio or local command-line toolchains.

Understanding Android Certificate Verification Layers

Modern Android network trust verification typically operates across two distinct layers:

• Android Network Security Config: A declarative XML declaration introduced in Android Nougat that controls which certificate authorities (system, user, or debug-overrides) an application trusts for secure TLS sessions.
• Application-Layer SSL Pinning: Programmatic checks embedded within networking libraries (such as OkHttp's CertificatePinner, TrustKit, or custom X509TrustManager implementations) that validate whether the remote server certificate matches known public key hashes (SHA-256 pin digests).

To inspect cleartext HTTPS requests reliably without requiring a rooted device running Frida or Xposed, security engineers must patch both mechanisms directly within the APK binary.

Step 1: Decompiling the APK and Auditing Network Security Config

Begin by decompiling the target package to unpack the AndroidManifest.xml, resource files, and Smali bytecode. You can upload the APK directly into APKTool Studio for instant, cloud-based decompilation without local Java dependencies, or invoke Apktool locally:

apktool d target_application.apk -o decompiled_app

Inspecting AndroidManifest.xml

Inspect the <application> element in AndroidManifest.xml to identify whether a network configuration file is bound:

<application
    android:name="com.example.app.MainApplication"
    android:icon="@mipmap/ic_launcher"
    android:label="@string/app_name"
    android:networkSecurityConfig="@xml/network_security_config">
    ...
</application>

If the attribute android:networkSecurityConfig does not exist, you can add it directly to point to @xml/network_security_config.

Step 2: Crafting a Permissive Network Security Configuration

Navigate to res/xml/network_security_config.xml (or create the file if it was absent). Replace its contents with a policy that explicitly permits both system and user-installed CA certificates:

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config cleartextTrafficPermitted="true">
        <trust-anchors>
            <certificates src="system" />
            <certificates src="user" />
        </trust-anchors>
    </base-config>
</network-security-config>

This declaration ensures that certificates generated by your interception proxy (such as Burp's PortSwigger CA installed under Android's User Credential Store) are fully trusted by the Android OS network stack.

Step 3: Patching Programmatic SSL Pinning in Smali

While modifying the XML config allows proxy interception for apps using standard platform defaults, apps employing OkHttp or custom trust managers will still abort TLS handshakes. We must patch the underlying Smali bytecode.

Method A: Neutralizing OkHttp CertificatePinner

Locate the OkHttp CertificatePinner class within the decompiled smali/ directories (typically okhttp3/CertificatePinner.smali). Search for the check(Ljava/lang/String;Ljava/util/List;)V method. Original implementation iterates over pinned hashes and throws an SSLPeerUnverifiedException upon mismatch.

To bypass verification, modify the beginning of the check method to return immediately:

.method public check(Ljava/lang/String;Ljava/util/List;)V
    .registers 3
    .annotation system Ldalvik/annotation/Signature;
        value = {
            "(Ljava/lang/String;",
            "Ljava/util/List<",
            "Ljava/security/cert/Certificate;",
            ">;)V"
        }
    .end annotation

    # BYPASS: Return void immediately to disable pin check
    return-void
.end method

By inserting an unconditional return-void, OkHttp skips comparison algorithms and completes the handshake successfully.

Method B: Neutralizing Custom X509TrustManager

If the target application implements a custom checkServerTrusted callback in an X509TrustManager implementation, locate the class and ensure checkServerTrusted performs an empty return:

.method public checkServerTrusted([Ljava/security/cert/X509Certificate;Ljava/lang/String;)V
    .registers 3
    .annotation system Ldalvik/annotation/Throws;
        value = {
            Ljava/security/cert/CertificateException;
        }
    .end annotation

    # BYPASS: No-op validation accepts all peer certificates
    return-void
.end method

Step 4: Rebuilding, Aligning, and Signing the Patched Binary

Once your XML configurations and Smali patches are saved, compile the directory back into an APK container:

apktool b decompiled_app -o unaligned_patched.apk

Optimizing with ZipAlign

Every modified Android binary must be 4-byte boundary aligned using zipalign to prevent performance degradations and installation errors:

zipalign -p -f -v 4 unaligned_patched.apk aligned_patched.apk

Signing with APK Signature Scheme v2/v3

Modern Android versions reject unverified binaries. Sign the package using apksigner to apply v2 and v3 signature blocks:

apksigner sign --ks release.keystore --ks-pass pass:secretpassword \
    --key-pass pass:secretpassword \
    --out final_patched_app.apk aligned_patched.apk

Streamlined Patching with APKTool Studio

If you prefer an automated and portable browser workspace, you can perform all these steps seamlessly in APKTool Studio. The platform decompiles the package in the cloud, gives you a web-based editor to modify AndroidManifest.xml, res/xml/, and Smali files, and handles ZipAlign plus APK Signature Scheme v2/v3 generation automatically with a single click.

Step 5: Verifying Interception in Your Proxy

With final_patched_app.apk installed on your test device or emulator:

• Configure the Android device's Wi-Fi proxy settings to target your workstation's IP and port (e.g., 192.168.1.50:8080).
• Launch the modified application.
• Confirm that outbound HTTPS traffic, authorization headers, and JSON responses now stream cleanly into your interception log without SSL connection failures or broken handshakes.

Conclusion

Bypassing modern network constraints via static binary modification provides reproducible security testing without requiring specialized physical test hardware or persistent system rooting. By mastering network_security_config.xml tuning and targeted Smali bytecode overrides, penetration testers and reverse engineers can inspect encrypted application telemetry accurately and efficiently.