frida-mitm-capture

What problem does it solve?

Manually capturing decrypted HTTPS traffic from Android apps is extremely difficult because most apps implement SSL pinning (via conscrypt, OkHttp CertificatePinner, NetworkSecurityConfig, or native libssl hooks) that blocks standard proxy tools, and many apps ignore system proxy settings entirely. This skill eliminates the need to manually write Frida scripts, configure proxy routing, and parse raw traffic data by automating the entire end-to-end workflow.

Core Features & Use Cases

• Automated SSL Pinning Bypass: Injects a pre-built, extensively tested Frida script that bypasses all common Android SSL pinning mechanisms, including conscrypt TrustManagerImpl, OkHttp3 CertificatePinner, NetworkSecurityConfig pin sets, and native libssl SSL_CTX_set_verify hooks.
• Structured Traffic Capture & Analysis: Forwards decrypted HTTPS traffic to mitmproxy, saves it as structured JSONL files, and automatically identifies authentication headers and suspected encrypted/hashed fields for quick API reverse engineering.
• Use Cases: Capture API requests to reverse engineer request signing algorithms, analyze all endpoints called by a specific app feature, or debug network traffic for Android apps with strict security controls.

Quick Start

Provide the target Android app's package name to the frida-mitm-capture skill to automatically start capturing its decrypted HTTPS traffic for analysis, then share the captured data with the skill once you have performed the desired actions in the app.