shroudedcode/apk-mitm
Apk Mitm
apk-mitm is a command-line utility designed to modify Android APK files to enable HTTPS traffic inspection via a proxy. It functions as a network security patcher and certificate pinning bypass tool, automating the process of altering application packages to allow man-in-the-middle traffic analysis.
The tool modifies compiled Android packages by unpacking them, altering internal files, and re-encoding the binary. It specifically focuses on disabling certificate pinning and injecting network security configurations into the application manifest, which permits the use of proxy certificates on both rooted and non-rooted devices.
The software covers mobile API security testing and reverse engineering through bytecode-level patching. It includes a mechanism to pause the patching process, allowing for manual file modification in a temporary directory before the final package is rebuilt and signed.
Features
- Certificate Pinning Bypasses - Alters application bytecode to disable strict certificate validation, enabling traffic inspection via external proxies.
- Proxy Certificate Patchers - Embeds proxy certificates into the network security configuration of Android apps for non-rooted devices.
- Android APK Repackaging Tools - Provides a command-line utility for decompiling, modifying, and rebuilding Android APKs to enable traffic inspection.
- Android App Traffic Captures - Modifies applications to route HTTPS traffic through a proxy for security testing and analysis.
- Non-Root App Patchers - Patches APKs to embed network configurations that enable traffic inspection without requiring root access.
- Android Application Reverse Engineering - Analyzes and modifies APK files to change application behavior and inspect internal configurations.
- Android HTTPS Inspection Utilities - Automates the unpacking and patching of APKs to facilitate interception by a man-in-the-middle proxy.
- Proxy Certificate Injectors - Inserts custom proxy certificates into the network security configuration to enable traffic decryption on non-rooted devices.
- APK Re-signing - Rebuilds modified application files and applies a new cryptographic signature to allow installation on Android devices.
- Binary Patching Utilities - Provides utilities to unpack and modify compiled Android binary files for security analysis.
- Network Security Configurations - Injects network security configurations into the app manifest to permit the use of user-added proxy certificates.
- API Security Testing - Facilitates the interception of encrypted requests to analyze mobile API endpoints and data formats.
- Manual Intervention Gates - Pauses the automated patching pipeline to allow for manual file edits before the final APK is rebuilt.
- Bypass and Hardening Tools - CLI tool for preparing APKs for HTTPS inspection.
- Reverse Engineering Tools - Prepares APKs for HTTPS inspection by patching them.
