Facebook iOS with SSL pinning bypassed / Facebook with certificate pinning bypassed. Get your private api endpoints now!!
- Current version which was bypassed: 501.0.0 (Later versions available but not for free release)
- You can now intercept all requests
- iOS Only
- Tested on iOS 15.4.1
- Any support is appreciated
- Download the IPA file
- Sideload the file (I personally suggest Sideloadly or TrollStore)
- Set up the proxy before starting the app (Was tested only with mitmproxy)
- Intercept
| Icon | Bundle ID | Version | File Type | Download |
|---|---|---|---|---|
 |
com.facebook.Facebook | 501.0.0 | IPA | Click here |
|
com.facebook.Facebook | 483.0.0 | IPA | Click here |
|
com.facebook.Facebook | 466.0.0 | IPA | Click here |
Message me on Telegram: @undecryptable Other apps available
SSL pinning, also known as certificate pinning or public key pinning, is a security mechanism used in digital communication to enhance the security of a connection, particularly within the context of Secure Sockets Layer (SSL) or its successor, Transport Layer Security (TLS).
When a client (such as a web browser or a mobile app) connects to a server over HTTPS, the server presents its SSL/TLS certificate to prove its identity. Normally, the client verifies the server's certificate by checking if it is signed by a trusted Certificate Authority (CA). However, SSL pinning adds an extra layer of security by requiring the client to validate the server's certificate against a known, pre-configured set of certificates or public keys, rather than solely relying on the CA's trust chain.
This project is for educational purposes only. It demonstrates bypassing SSL pinning in binaries, such as those used by Instagram/Meta, to help developers and researchers understand security vulnerabilities.
There is no intent to harm, exploit, or encourage illegal activities. If Instagram/Meta or any other party has concerns, please contact me at 0day@yin.sh, and I will address the issue or take down the project as requested.
Use of this project is at your own risk; the creator is not responsible for any misuse.