mitmproxy/android-unpinner

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1032 stars · 82 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Python CLI tool that removes certificate pinning from Android APKs so traffic can be intercepted with mitmproxy, without requiring a rooted device. It patches only AndroidManifest.xml to mark the app debuggable, then injects the Frida Gadget via a custom JDWP implementation over ADB.

Use cases

• remove certificate pinning from an apk
• intercept https traffic from an android app without root
• patch an apk to be debuggable and inject frida gadget
• bypass ssl pinning for mobile app testing
• unpin xapk split apks and reinstall via adb
• pull apks from a connected device and unpin them

When to choose

• you need to MITM an Android app on a non-rooted device
• you want minimal APK modification (classes.dex untouched)
• you want a one-command tool with bundled adb/apksigner dependencies
• you need to handle XAPK split APKs

When to avoid

• you need an interactive runtime analysis shell (use objection)
• you cannot run a desktop machine connected during app launch
• you need to hide from root detection on a rooted setup
• you need a general-purpose Frida scripting toolkit

Facets

cli-tool · maturity active

reverse-engineering security cli security reverse-engineering android-tools penetration-testing windows cli python android apk certificate-pinning frida mitm mobile-security-testing linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="mitmproxy/android-unpinner")