Mobile › Module 5 › Lesson 2
TLS Pinning Named
TLS pinning names server certificate or public-key binding in the app — control purpose and defender notes on YOUR $MOB_LAB; NO bypass recipes.
Visual · t27_tls_pinning_named
Pinning literacy. $MOB_LAB only. Original Cyberlium.
Opening
Pinning stops casual MITM — Cyberlium teaches what it is and why defenders ship it, not how to defeat production bank apps.
Certificate pinning (OkHttp CertificatePinner, networkSecurityConfig pin-set, TrustKit-class libraries) binds app trust to expected keys or certs instead of only system CAs. Defenders use pinning to block rogue CAs, corporate proxies on untrusted devices, and casual tool intercept on sensitive apps. Cyberlium names pinning locations in YOUR $MOB_LAB debug APK or course samples — manifest networkSecurityConfig, decompiled pinner strings — and documents defender rationale. We do NOT ship bypass step recipes for production apps. Next: No Bypass Cookbook.
1. Pinning mechanisms (named)
networkSecurityConfig pin-set in manifest. OkHttp CertificatePinner in code. Native pinning in lib/. Pin rotation and backup pins for operational continuity — defenders plan updates before cert expiry.
On $MOB_LAB lab APK, note where pinning would live — even if your debug build omits it for learning contrast.
Command guide
Try these commands — Pinning mechanisms (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Certificate pinning — https://developer.android.com/privacy-and-security/security-config#CertificatePinning (defender literacy) OWASP MASTG pinning — https://mas.owasp.org/MASTG/0x05g-Testing-Network-Communication/ (test methodology — authorized only) Apple ATS — https://developer.apple.com/documentation/bundleresources/information_property_list/nsapptransportsecurity
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export MOB_LAB=${MOB_LAB:-$HOME/cyberlium-lab/t27-mob}
cat > "$MOB_LAB/notes/tls-pinning-literacy.txt" <<'EOF'
TLS pinning: app trusts specific cert/public key — raises MITM resistance
defender goal: pin correctly + backup pins + monitor expiry
tester literacy: identify pinning in YOUR lab app network config
never: run unpin/objection bypass on production apps you do not own
EOFCommand — copy this
grep -E 'pinning|never|defender' "$MOB_LAB/notes/tls-pinning-literacy.txt" curl -sS https://developer.android.com/privacy-and-security/security-config | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: Certificate pinning (https://developer.android.com/privacy-and-security/security-config#CertificatePinning); OWASP MASTG pinning (https://mas.owasp.org/MASTG/0x05g-Testing-Network-Communication/); Apple ATS (https://developer.apple.com/documentation/bundleresources/information_property_list/nsapptransportsecurity). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why defenders pin
Reduce MITM on untrusted networks and compromised device CAs. Raise bar against commodity intercept tools — not perfect against device compromise, but layered control with attestation and server-side fraud signals.
Over-pinning without rotation breaks apps — literacy includes operational tradeoffs.
3. Literacy without bypass cookbooks
Forbidden: step lists to bypass pinning on bank/social production APKs, Frida/Objection recipes for apps you do not own. Allowed: pinning literacy card — mechanism name, defender why, detection idea, lab-only observation note.
Ship: TLS pinning literacy card for $MOB_LAB. Next: No Bypass Cookbook.
4. What you ship: TLS pinning literacy card for $MOB_LAB
Mechanism, defender why, detection note — NO bypass steps. $MOB_LAB named. chmod 600.
5. What you record before the next lesson
Date. Pinning card. $MOB_LAB named. File t27-m05-l02-tls-pinning-named.txt chmod 600.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Publish pinning bypass for wallet app. Claim pinning is 'useless.'
Right
Write TLS pinning literacy card for YOUR $MOB_LAB context. Next: No Bypass Cookbook.
Mission: document pinning as defender control
1) Name two pinning mechanisms. 2) Write defender why in two sentences. 3) Explicitly omit bypass steps. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Pin backup keys prevent outage — defenders document rotation, attackers shouldn't document bypass.
Knowledge Check
APPLY: TLS pinning primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Cyberlium teaches pinning bypass recipes for production bank apps.
True or False
Knowledge Check
APPLY: Pinning literacy supports:
Multiple choice