Tool
apk-mitm
Command-line tool that prepares an Android APK you own or are authorized to test for HTTPS traffic inspection. It decodes the package with Apktool, adjusts the network security configuration to trust user-added certificates, disables certificate pinning, then re-encodes and signs the patched APK, so a proxy can read the app's traffic without a rooted device. App bundles supplied as .xapk or .apks are also supported.
Requirements and limitations
- Installed from npm as a global CLI and requires Node.js 14+ and Java 8+ per the README; patching app bundles on Linux also needs zip and unzip available.
- Operates on an APK or app bundle the analyst supplies and is intended only for apps you own or are authorized to test; rooting the device is not required because the changes are applied statically before install.
- The README notes the static Apktool-based approach can fail on large or complex apps and cannot address certificate pinning enforced inside native binaries such as Flutter. MIT licensed; the repository ships the tool only, no application packages.
About this entry
- Type
- Tool
- Category
- Android tools
- Relationship
- Foundation tool
- Targets
- App · Protocol
Sources reviewed
The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.
Primary sources
- README.md GitHub · niklashigi/apk-mitm · Revision 5a96363
- LICENSE GitHub · niklashigi/apk-mitm · Revision 5a96363
- package.json GitHub · niklashigi/apk-mitm · Revision 5a96363