Search code examples
androidmitmproxy

How to see the traffic of all applications with mitmproxy in Android?

I added the certificate

There is no problem in the browser, but it has no effect on applications

I searched for this problem and realized that it seems that the Google update has caused this to happen

In the description for Android it is written:

Warning: Apps that target Android API Level 24 (introduced in 2016) and above only accept certificates from the system trust store (#2054). User-added CAs are not accepted unless the application manually opts in. Except for browsers, you need to patch most apps manually.

But with all the explanations and cases I searched, I still did not understand what I should do to solve this problem

I want to be able to see the traffic of all the programs

Solution

  • Unfortunately there is no universal solution to bypass certificate pinning.

    https://docs.mitmproxy.org/stable/concepts-certificates/#certificate-pinning lists a bunch of tools that can help with this, for example:

    • apk-mitm is a CLI application that automatically removes certificate pinning from Android APK files.
    • objection is a runtime mobile exploration toolkit powered by Frida, which supports certificate pinning bypasses on iOS and Android.