{"repo":"ilya-kozyr/android-ssl-pinning-bypass","free":true,"listed":false,"github":"https://github.com/ilya-kozyr/android-ssl-pinning-bypass","clone":"git clone https://github.com/ilya-kozyr/android-ssl-pinning-bypass.git","description":"The script allows to bypass SSL pinning on Android >= 7 and makes APK file ready for HTTPS traffic inspection","language":"Python","stars":178,"topics":["android","mitm","ssl-pinning","apk","aab","apktool","apk-decompiler","cli","bash-script","reverse-engineering"],"license":null,"category":"mobile-apps","readme_excerpt":"android-ssl-pinning-bypass A python script (previously bash ) that prepares Android APK (or AAB, XAPK) for HTTPS traffic inspection. Disclaimer 1. This script is not a \"silver bullet\" and even after using it you still might not be able to capture or decrypt the HTTPS traffic on Android. Learn tip #2 from the Tips section. 2. The script is not fully tested yet upon migration to python. This point will be removed once the script will be tested. Features The script allows to bypass SSL pinning on Android = 7 via rebuilding the APK file and making the user credential storage trusted. After processing the output APK file is ready for HTTPS traffic inspection. If an AAB file provided the script creates a universal APK and processes it. If a XAPK file provided the script unzips it and processes every APK file. Compatibility Works on macOS, Linux and Windows. [NEEDS TESTING] The performance on the Windows probably will be a few times ( 3.5) lower than in macOS / Linux ( apktool takes longer time to decode the APK). How the script works? It: - first of all checks if all the necessary tools are available and downloads it if it's not (except java ); - decodes the AAB file to APK file via bundletool (if AAB file provided) or unzips the XAPK file (in case of XAPK); - decodes the APK file using apktool ; - patches (or creates if the file is missing) the app's network security config.xml to make user credential storage as trusted; - encodes the new APK file via apktool ; - signs the patched","default_branch":null,"files":null,"tree":[],"storefront":"/r/ilya-kozyr","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/ilya-kozyr/android-ssl-pinning-bypass/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}