Fuzion24/JustTrustMe
JustTrustMe
JustTrustMe is an Android security auditing tool and mobile application penetration testing utility. Its primary purpose is to bypass hardcoded certificate requirements and disable SSL pinning in mobile applications to allow the inspection of encrypted API requests and responses.
The project functions as a dynamic method hooking module that integrates with the Xposed framework. It uses system-level instrumentation to intercept Java runtime function calls and override security checks within third-party Android applications.
The tool covers a range of capabilities including the disabling of SSL certificate checking and the use of runtime method hooking to redirect logic flow. It employs bytecode injection and reflection-based API access to modify the behavior of running applications during security reviews.
Features
- Certificate Pinning Bypasses - Provides the primary capability to disable strict certificate pinning for network traffic inspection.
- Java Method Hooking - Functions as a system for intercepting Java runtime calls to override security checks.
- Android Security Tools - Acts as a specialized utility for auditing and modifying Android application security.
- Xposed Framework Hooking Modules - Integrates with the Xposed framework to inject custom code into Android system processes.
- Android Application Penetration Testing - Enables security testing of Android apps by bypassing SSL pinning to inspect HTTPS traffic.
- Penetration Testing Tools - Provides a specialized tool to intercept network traffic by disabling SSL pinning.
- SSL Verification Bypasses - Actively disables SSL/TLS certificate validation to allow connections to intercepting proxy servers.
- Mobile App Security Auditing - Provides the necessary tools for security analysis and auditing of Android binaries.
- Runtime Method Hooking - Provides runtime interception and modification of function calls to alter application behavior.
- Android Runtime Code Injections - Implements the injection of custom Java code into the Android runtime to override security checks.
- Process Space Injection - Injects custom logic into the process space of target applications via a host manager.
- Dynamic Process Instrumentation - Injects custom code into running Android processes to alter functionality without modifying binaries.
- Reflection-Based Access - Uses runtime type inspection to access and modify private system properties restricted by the framework.
- Private Member Access - Modifies private fields and methods within the Android framework via reflection to disable validation logic.
- Runtime Bytecode Instrumentation - Modifies bytecode of classes already loaded in the Android process to bypass security checks.
- Bypass and Hardening Tools - Xposed module for bypassing SSL certificate pinning.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
