SSL Pinning Bypass Techniques

You are testing a mobile application that implements SSL pinning, preventing you from intercepting HTTPS traffic with a proxy.

**Understanding SSL Pinning**
- What is SSL pinning and why do developers implement it?
- What are the three main implementation approaches: certificate pinning, public key pinning, and SPKI pinning?
- How do you confirm that pinning is active and not just a failed proxy configuration?

**Bypass Techniques**

*Frida-based Bypass*
- How does a generic Frida SSL pinning bypass script work?
- What Android API methods does it hook and why? (TrustManager, HostnameVerifier, OkHttp CertificatePinner)
- When does a generic script fail and what custom hooks do you need to write?

*Objection*
- What does `android sslpinning disable` actually do under the hood?
- How reliable is objection's built-in bypass across different app implementations?

*Network Security Config Manipulation*
- How can you patch an Android APK to disable pinning in the network_security_config.xml?
- What does the `<trust-anchors>` element do and how do you add the system CA?
- How do you repackage and sign the modified APK?

*iOS Bypass*
- What does SSL Kill Switch 2 or SSL Kill Switch 3 patch in iOS?
- When does you need a custom Frida hook for iOS vs the off-the-shelf tool?

**Advanced Pinning**
- What is certificate transparency pinning and is it bypassable with the same methods?
- What does "custom TLS implementation" mean and why is it harder to bypass?

Output:
- Bypass decision tree by implementation type
- Frida script template with common Android hook targets
- APK patching workflow for network_security_config