A CLI tool that automatically patches Android APK files to bypass HTTPS security for traffic inspection.
apk-mitm is a CLI tool that automates the process of modifying Android APK files to allow HTTPS traffic inspection through a proxy. It works by decoding the APK, altering its Network Security Configuration to accept custom certificates, and disabling certificate pinning mechanisms. This solves the problem of analyzing app traffic that is otherwise blocked by modern Android security features.
Security researchers, penetration testers, and mobile developers who need to inspect HTTPS traffic from Android apps for debugging, analysis, or security auditing purposes.
Developers choose apk-mitm because it automates a tedious manual process into a single command, works without requiring a rooted device, and supports patching both APK and App Bundle formats. Its simplicity and reliability make it a go-to tool for preparing apps for proxy-based inspection.
🤖 A CLI application that automatically prepares Android APK files for HTTPS inspection
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Automates the entire patching process—decoding, modifying, and re-signing—in a single command, saving significant manual effort compared to manual APK editing.
Works on non-rooted Android devices, making HTTPS inspection accessible without the risks and complexities of device rooting.
Extends patching to modern app formats like .xapk and .apks files, ensuring compatibility with apps distributed via Android App Bundles.
Allows direct injection of a proxy certificate into the app's Network Security Config, bypassing system certificate restrictions on devices like Android TVs.
Inherits Apktool's limitations, often crashing or failing with large, obfuscated, or complex apps, requiring manual troubleshooting or alternative tools.
Cannot disable certificate pinning implemented in native code (e.g., Flutter apps), as admitted in the README, limiting effectiveness for many modern applications.
Requires user intervention for edge cases like Google Maps API key restrictions, using the --wait flag to edit files, adding steps and complexity.
Demands both Node.js and Java runtimes installed, which can be a setup barrier in minimal or controlled environments lacking these dependencies.