apk-mitm

Inspecting a mobile app's HTTPS traffic using a proxy is probably the easiest way to figure out how it works. However, with the Network Security Configuration introduced in Android 7 and app developers trying to prevent MITM attacks using certificate pinning, getting an app to work with an HTTPS proxy has become quite tedious.

Features

Decode the APK file using Apktool
Replace the app's Network Security Configuration to allow user-added certificates
Modify the source code to disable various certificate pinning implementations
Encode the patched APK file using Apktool
Sign the patched APK file using uber-apk-signer
You can also use apk-mitm to patch apps using Android App Bundle and rooting your phone is not required

Project Samples

Project Activity

See All Activity >

License

MIT License

Follow apk-mitm

apk-mitm Web Site

Other Useful Business Software

Ship Agents Faster

Transform your applications and workflows into powerful agentic systems at global scale.

Gemini Enterprise Agent Platform lets you rapidly build, scale, govern and optimize production-ready agents grounded in your organization's data. The platform enables developers to build custom or pre-built agents for virtually any use case. New customers get $300 in free credits.

Get Started Free

Rate This Project

User Reviews

Be the first to post a review of apk-mitm!

Additional Project Details

Programming Language

TypeScript

Related Categories

TypeScript MiTM (Man-in-The-Middle) Attack Tool

Registered

2023-08-14

Similar Business Software

Aikido Security

Secure your code, cloud, and runtime in one central system. Aikido’s all-in-one security platform is loved by developers and security teams alike with full security visibility, insight in what matters most, and fast/automatic vulnerability fixes. Teams get security done with Aikido thanks...

See Software
Astra Pentest

Astra’s Pentest is a comprehensive penetration testing solution with an intelligent automated vulnerability scanner coupled with in-depth manual pentesting. On top of 10000+ tests including security checks for all CVEs mentioned in the OWASP top 10, and SANS 25, the automated scanner also...

See Software
Phishing Club

Phishing Club is an open source phishing simulation and red team phishing framework for authorized security testing. Self host it on your own server via a one line installer or Docker. Plan, launch, and measure realistic campaigns from a single Go binary with an embedded web UI, HTTP/HTTPS...

See Software
Quixxi

Quixxi is a leading provider of mobile app security solutions that empowers enterprises and security professionals to protect their mobile applications through its patented and proprietary three-pillar platform: SCAN, an automated vulnerability assessment tool (SAST/DAST/WebAPI) that...

See Software
Silent Armor

Silent Armor is an AI-powered perimeter defense platform designed to predict and prevent cyber breaches before they occur. It continuously analyzes hundreds of security metrics across an organization’s attack surface to deliver real-time, intelligent protection. The platform combines predictive...

See Software
Detectify

Detectify sets the standard for External Attack Surface Management (EASM), providing 99.7% accurate vulnerability assessments. ProdSec and AppSec teams trust Detectify to expose exactly how attackers will exploit their Internet-facing applications. The Detectify platform automates continuous...

See Software