# Bypass SSL Pinning for flutter apps using reFlutter Framework

Flutter apps are a little bit different and hard to bypass ssl pinning.There are many method to bypass ssl pinning for flutter apps and I'm gonna show you one of the method to bypass ssl pinning using `reflutter flamework`&#x20;

This framework helps with Flutter apps reverse engineering using the patched version of the Flutter library which is already compiled and ready for app repacking. This library has snapshot deserialization process modified to allow you perform dynamic analysis.

## Installation

```javascript
pip3 install reflutter
```

![](https://3759110756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVvHHLY2mrxd5y4e2vVYL%2Fuploads%2FkuwGlR7CIMTrD1Legbdl%2Fimage.png?alt=media\&token=cf350817-33f0-4180-92f1-4f3854199296)

Demonstration apps,&#x20;

> [https://github.com/thedarksource/Android/tree/master/flutter-test-apps](https://github.com/thedarksource/Android/tree/master/flutter-test-apps)

![](https://3759110756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVvHHLY2mrxd5y4e2vVYL%2Fuploads%2FDEkhqld8xNuUy1d5GJdP%2Fimage.png?alt=media\&token=3e82231f-7632-4cd2-91ae-2114945cb333)

We have two options `HTTP Request` and `HTTPS Request` , First let's check in `HTTP Request`&#x20;

![](https://3759110756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVvHHLY2mrxd5y4e2vVYL%2Fuploads%2Fof0y5jAQKT95t0Uh3X9x%2Fimage.png?alt=media\&token=1e1d2528-af91-4932-a309-7b6eec9858df)

The traffic through the burpsuite and we will get success response.But If we click on `HTTPS Request` ,we will get error like this.

![](https://3759110756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVvHHLY2mrxd5y4e2vVYL%2Fuploads%2FjnokucTZaGl8QEDiAaIQ%2Fimage.png?alt=media\&token=0fdaba21-6616-4316-b954-006073499f80)

So, let's bypass it using `reflutter framework`

```javascript
reflutter flutter-apps.apk
```

![](https://3759110756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVvHHLY2mrxd5y4e2vVYL%2Fuploads%2FpnTxCzEe4hA9WVcohqAm%2Fimage.png?alt=media\&token=299a0ba9-2f06-4b75-96e2-7cca5390007d)

`IP` is the IP of the machine which the burpsuite is running.&#x20;

Now we will get `release.RE.apk` but this apk is not sign yet. We have to sign manually and

I'm used [uber-apk-signer](https://github.com/patrickfav/uber-apk-signer)  in here. You can use your own method.

```javascript
java -jar uber-apk-signer-1.2.1.jar --apk release.RE.apk
```

![](https://3759110756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVvHHLY2mrxd5y4e2vVYL%2Fuploads%2F38qltNPZcM2GDXW2wnH4%2Fimage.png?alt=media\&token=bdef5f67-8965-46f2-8842-45cb4751fb0b)

Now install signed apk in your device.

```
adb install release.RE-aligned-debugSigned.apk
```

![](https://3759110756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVvHHLY2mrxd5y4e2vVYL%2Fuploads%2Fm5xVKNf0C8U35EarqQ4Z%2Fimage.png?alt=media\&token=ae1e61af-6e54-416e-aab6-763b9f2c4533)

For the next step, we have to configure the proxy in burpsuite.

![](https://3759110756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVvHHLY2mrxd5y4e2vVYL%2Fuploads%2Fja6jDJyediHXDETnOB4j%2Fimage.png?alt=media\&token=538764f3-0124-4921-8577-cb13d2ba4301)

First, change port `8083` because `reFlutter` set it by default.

![](https://3759110756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVvHHLY2mrxd5y4e2vVYL%2Fuploads%2F3jw0YHqL0u9u0wR3BWc8%2Fimage.png?alt=media\&token=60696c3f-84ca-400e-acfc-45e3c4fb93de)

In `Request handling` tab, enable `Support invisible proxying` and click on OK.&#x20;

Now open the new apk and click on `HTTPS Request`&#x20;

{% hint style="danger" %}
NOTE: we need to turn off all the proxies because reflutter is already modifed and set the proxy settings in the patched app.
{% endhint %}

![](https://3759110756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVvHHLY2mrxd5y4e2vVYL%2Fuploads%2Fr3gH4bRsOQOmACSpS3EA%2Fimage.png?alt=media\&token=657c3615-f507-4547-95df-8efd8b2d47e8)

![](https://3759110756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVvHHLY2mrxd5y4e2vVYL%2Fuploads%2FtilJiRoTvl7X7f4opGa4%2Fimage.png?alt=media\&token=d95a194c-c17b-4610-b5c3-3a13d83627c8)

Now we can intercept the HTTPS traffic of the flutter based app by bypassing the SSL pinning using`reFlutter framework`.

## Reference

> [https://github.com/ptswarm/reFlutter](https://github.com/ptswarm/reFlutter)
>
> [https://github.com/thedarksource/Android/tree/master/flutter-test-apps](https://github.com/thedarksource/Android/tree/master/flutter-test-apps)
>
> [https://github.com/patrickfav/uber-apk-signer/releases/](https://github.com/patrickfav/uber-apk-signer/releases/)
