[addtool] apk-mitm

[gwen001]

[tags]android,apk,mitm,reverse-engineering[/tags] [short_descr]A CLI application that automatically prepares Android APK files for HTTPS inspection.[/short_descr] [link] https://npm.im/apk-mitm [/link] [link] https://github.com/shroudedcode/apk-mitm [/link] [long_descr] Inspecting a mobile app's HTTPS traffic using a proxy is probably the easiest way to figure out how it works. However, with the Network Security Configuration introduced in Android 7 and app developers trying to prevent MITM attacks using certificate pinning, getting an app to work with an HTTPS proxy has become quite tedious.

apk-mitm automates the entire process. All you have to do is give it an APK file and apk-mitm will:

• decode the APK file using Apktool
• replace the app's Network Security Configuration to allow user-added certificates
• modify the source code to disable various certificate pinning implementations
• encode the patched APK file using Apktool
• sign the patched APK file using uber-apk-signer

You can also use apk-mitm to patch apps using Android App Bundle and rooting your phone is not required. [/long_descr] [image] https://raw.githubusercontent.com/gwen001/offsectools_www/main/tmp/5fe4a40cc4f782f9621629c2aa7a0da7.png [/image]

[gwen001]

Issue correctly handled, tool is waiting for human validation.

[gwen001]

Tool has been accepted by the team: https://offsec.tools/tool/apk-mitm

Thank you for your contribution!