Flutter App SSL Pinning Bypass Using ReFlutter

Flutter App Bypass

This is the workflow I used to bypass SSL pinning in a Flutter application during Android security testing.

1. Get the APK from the Device

First, identify the package name:

adb shell pm list packages | findstr <package_name>

Check the APK path:

adb shell pm path <package_name>

If the application uses split APKs, pull all the APK files from the device.

adb pull <apk_path>

Repeat this for each APK path returned by pm path.

2. Merge Split APKs

Place all the APK files in the same directory and merge them using APKEditor:

java -jar APKEditor.jar m -i apk_files

This generates a merged APK that can be processed further.

3. Patch the Flutter APK Using ReFlutter

Run ReFlutter against the merged APK:

reflutter merged.apk

The patched APK will be generated in the ReFlutter output directory.

4. Sign the APK

Sign the patched APK using Uber APK Signer:

java -jar uber-apk-signer.jar --apks _flutter_output_REdebug.apk

Use the signed APK generated by Uber APK Signer for installation.

5. Install the Modified APK

Install the signed APK on the Android device:

adb install <signed_apk>.apk

After installation, configure the device to route traffic through your interception proxy and test the application traffic.