Tool
Android Unpinner
Tool from the mitmproxy project that removes certificate pinning from an Android APK you own or are authorized to test, without a rooted device. It marks the app debuggable, touching only AndroidManifest.xml, and injects a Frida Gadget over ADB so an interception proxy can read the app's traffic, reusing HTTP Toolkit's unpinning script. It bundles the Android SDK helpers it needs and can also handle split APKs delivered as XAPK.
Requirements and limitations
- Installed with uv or pip and requires Python 3.10+ (pyproject version 1.0); the target device connects to a desktop over USB/ADB, and the tool bundles the adb, apksigner, zipalign and aapt2 helpers for Windows, Linux and macOS.
- Patches the target APK and needs active instrumentation from the desktop each time the app launches, so rooting the device is not required; intended only for apps you own or are authorized to test.
- The README states the project's own code is MIT-licensed, with no separate LICENSE file for GitHub to detect; bundled components keep their own licenses, including HTTP Toolkit's unpinning script (AGPL-3.0), the Frida gadgets (wxWindows Library Licence) and Android build/platform tools. The repository also ships HTTP Toolkit's open-source SSL-pinning demo APK (Apache-2.0) as a test target.
About this entry
- Type
- Tool
- Category
- Android tools
- Relationship
- Foundation tool
- Targets
- App · Protocol
Sources reviewed
The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.
Primary sources
- README.md GitHub · mitmproxy/android-unpinner · Revision 60cbfee
- pyproject.toml GitHub · mitmproxy/android-unpinner · Revision 60cbfee