https://crusaderproxy.com/research/en/tags/cert-pinning/ Recent content in Cert-Pinning on Crusader Research Hugo en-US Thu, 02 Jul 2026 00:00:00 +0000 https://crusaderproxy.com/research/en/posts/intercepting-mobile-apps-that-fight-back/ Thu, 02 Jul 2026 00:00:00 +0000 https://crusaderproxy.com/research/en/posts/intercepting-mobile-apps-that-fight-back/ <p>Ninety percent of mobile testing is web testing you already know — REST, tokens, IDOR, injection. The other ten percent is a wall you hit before you can do <em>any</em> of it: getting the app&rsquo;s HTTPS traffic to land in your proxy as plaintext. And most write-ups get that ten percent wrong, because they were written for an Android that no longer exists. You follow the steps, the cert goes into <code>/system</code>, the app still throws handshake errors, and you conclude the app has exotic pinning. It doesn&rsquo;t. <strong>Google moved the trust store out from under you and the tutorial never noticed.</strong></p>