OKHTTP PINNED REQUEST and RAW CUSTOM-PINNED REQUEST not working

[AlexanderSpoettl]

Hello,
unfortunately two of the requests are not working even without using a proxy.

They throw the following errors:

OKHTTP PINNED REQUEST:

10-13 10:20:36.556 3863 3888 I System.out: javax.net.ssl.SSLPeerUnverifiedException: Certificate pinning failure!
10-13 10:20:36.556 3863 3888 I System.out: Peer certificate chain:
10-13 10:20:36.556 3863 3888 I System.out: sha256/J2Rs/XhqmFqx7ihj0wVdUwVKMp9txlbWZCUK6zdaylg=: CN=*.badssl.com
10-13 10:20:36.556 3863 3888 I System.out: sha256/y7xVm0TVJNahMr2sZydE2jQH8SquXV9yLF9seROHHHU=: CN=E7,O=Let's Encrypt,C=US
10-13 10:20:36.556 3863 3888 I System.out: sha256/C5+lpZ7tcVwmwQIMcRtPbsQtWLABXhQzejna0wHFr8M=: CN=ISRG Root X1,O=Internet Security Research Group,C=US
10-13 10:20:36.556 3863 3888 I System.out: Pinned certificates for ecc384.badssl.com:
10-13 10:20:36.556 3863 3888 I System.out: sha256/NYbU7PBwV4y9J67c4guWTki8FJ+uudrXL0a4V4aRcrg=
10-13 10:20:36.556 3863 3888 I System.out: sha256/jQJTbIh0grw0/1TkHSumWb+Fs0Ggogr621gT3PvPKG0=

RAW CUSTOM-PINNED REQUEST:

10-13 10:21:59.852 3863 3888 I System.out: java.lang.Error: Unrecognized cert hash.

I tested it on multible devices

[pimterry]

Ah, that's annoying, thanks for reporting this. An excellent example of why people shouldn't do certificate pinning in the first place 😆 it's very fragile! Do you want to open a PR with the updated values so this passes as expected?

[AlexanderSpoettl]

Thanks for the quick answer. I created a pull request.

I'm using the app as part of my master thesis to evaluate the capabilities of my LLM Android Agent to automatically bypass cert pinning. The app is exactly what i need as a test case :)

[pimterry]

Merged your fix from #5, thanks @AlexanderSpoettl! I'll close this issue now, and create a new APK including this in just a sec.

By the way, in case you're not aware, HTTP Toolkit Pro is free for all contributors to all https://github.com/httptoolkit repos. If that would be useful, just let me know your email (either here or by sending a message to opensource @ httptoolkit.com) and I'll set you up with an account.

[AlexanderSpoettl]

That sounds great. Here's my email: alexander.spoettl{at}gmail.com. Thanks :)