apk-mitm

Inspecting a mobile app's HTTPS traffic using a proxy is probably the easiest way to figure out how it works. However, with the Network Security Configuration introduced in Android 7 and app developers trying to prevent MITM attacks using certificate pinning, getting an app to work with an HTTPS proxy has become quite tedious.

Features

Decode the APK file using Apktool
Replace the app's Network Security Configuration to allow user-added certificates
Modify the source code to disable various certificate pinning implementations
Encode the patched APK file using Apktool
Sign the patched APK file using uber-apk-signer
You can also use apk-mitm to patch apps using Android App Bundle and rooting your phone is not required

Project Samples

Project Activity

See All Activity >

License

MIT License

Follow apk-mitm

apk-mitm Web Site

Other Useful Business Software

Paessler: Easy to Use With Enterprise Power. Free Trial

A low-code dashboard makes monitoring intuitive for any admin, while scripting and custom sensors give experts full control.

You shouldn't have to choose between a monitoring tool that's easy to use and one that's powerful enough for a complex environment. PRTG's low-code interface lets any admin build dashboards, set alerts and monitor devices without scripting, while custom sensors and full API access are there when your team needs deeper control. One platform, no compromise. Download a free 30-day trial now.

Get Free Download

Rate This Project

User Reviews

Be the first to post a review of apk-mitm!

Additional Project Details

Programming Language

TypeScript

Related Categories

TypeScript MiTM (Man-in-The-Middle) Attack Tool

Registered

2023-08-14

Similar Business Software

Aikido Security

Secure your code, cloud, and runtime in one central system. Aikido’s all-in-one security platform is loved by developers and security teams alike with full security visibility, insight in what matters most, and fast/automatic vulnerability fixes. Teams get security done with Aikido thanks...

See Software
Astra Pentest

Astra’s Pentest is a comprehensive penetration testing solution with an intelligent automated vulnerability scanner coupled with in-depth manual pentesting. On top of 10000+ tests including security checks for all CVEs mentioned in the OWASP top 10, and SANS 25, the automated scanner also...

See Software
Phishing Club

Phishing Club is an open source phishing simulation and red team phishing framework for authorized security testing. Self host it on your own server via a one line installer or Docker. Plan, launch, and measure realistic campaigns from a single Go binary with an embedded web UI, HTTP/HTTPS...

See Software
Quixxi

Quixxi is a leading provider of mobile app security solutions that empowers enterprises and security professionals to protect their mobile applications through its patented and proprietary three-pillar platform: SCAN, an automated vulnerability assessment tool (SAST/DAST/WebAPI) that...

See Software
Silent Armor

Silent Armor is an AI-powered perimeter defense platform designed to predict and prevent cyber breaches before they occur. It continuously analyzes hundreds of security metrics across an organization’s attack surface to deliver real-time, intelligent protection. The platform combines predictive...

See Software
Detectify

Detectify sets the standard for External Attack Surface Management (EASM), providing 99.7% accurate vulnerability assessments. ProdSec and AppSec teams trust Detectify to expose exactly how attackers will exploit their Internet-facing applications. The Detectify platform automates continuous...

See Software