Tool
apk-mitm
Command-line tool that prepares an Android APK you own or are authorized to test for HTTPS traffic inspection. It decodes the package with Apktool, adjusts the network security configuration to trust user-added certificates, disables certificate pinning, then re-encodes and signs the patched APK, so a proxy can read the app's traffic without a rooted device. App bundles supplied as .xapk or .apks are also supported.
- Targets
- App · Protocol
- Category
- Android tools
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Installed from npm as a global CLI and requires Node.js 14+ and Java 8+ per the README; patching app bundles on Linux also needs zip and unzip available.
- Operates on an APK or app bundle the analyst supplies and is intended only for apps you own or are authorized to test; rooting the device is not required because the changes are applied statically before install.
- The README notes the static Apktool-based approach can fail on large or complex apps and cannot address certificate pinning enforced inside native binaries such as Flutter. MIT licensed; the repository ships the tool only, no application packages.
- As checked on 2026-10-20, the latest release, v1.3.0 (2024-04-21, also the latest npm version), is the reviewed commit and still the main head; GitHub’s last recorded push was 2024-07-24, the repository is not archived and the README does not mark it as maintained, superseded or archived.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · niklashigi/apk-mitm · Revision 5a96363
- LICENSE GitHub · niklashigi/apk-mitm · Revision 5a96363
- package.json GitHub · niklashigi/apk-mitm · Revision 5a96363
- https://github.com/niklashigi/apk-mitm/releases/tag/v1.3.0
More in Apps
- Frida Mobile Interception Scripts · Tool
- reFlutter · Tool
- ddc · Tool
- Simplify · Tool
- GDA (GJoy Dex Analyzer) · Tool
- APKLab · Tool