For multiple reasons, some Android Apps check root access on Android devices and block access to the App if root access is allowed. The root access on the device makes access to see all of the application’s functionality and this is the reason why developers block rooted devices on their applications.

To be able to bypass root detection on these applications, you should know how this works.

Android Root Detection Methods

1. Test-Keys Release-Keys and Test-Keys have to do with how the kernel is signed when it is compiled. Release-Keys means it was signed with an official Key from an official developer. Test-Keys means…


There are several methods to pin server’s X509 certificate to defense on MITM attacks and enable proxy to capture applications traffic.

OkHTTP is an open-source project designed to be an efficient HTTP client. OkHTTP implements a SSL certificate pinner called CertificatePinner() as see below:

String hostname = "example.com";CertificatePinner certificatePinner = new CertificatePinner.Builder().add(hostname, "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=").build();OkHttpClient client = OkHttpClient.Builder().certificatePinner(certificatePinner).build();Request request = new Request.Builder().url("https://" + hostname).build();client.newCall(request).execute();

AA…AAA=’ is the base64 encoding of the server’s public key hash.

As you see when the client sends SSL hello packet and receives the server’s certificate, calculates the…

Hojat Sajadinia

Penetration Tester at Bitpendar

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store