DΛΣMӨП

// HackTricks · Mobile

Make an APK Trust a User CA Certificate

Make an APK Trust a User CA Certificate

Android applications can restrict which certificate authorities they trust. In an authorized test environment, repackaging an APK with a Network Security Configuration that trusts user-installed CAs can make HTTPS traffic inspection possible. This does not automatically bypass certificate pinning implemented elsewhere in the application.[1]

Automatic

apk-mitm automates APK patching for HTTPS inspection and includes patches for several common certificate-pinning implementations.[2]

Manual

Decompile the APK:

apktool d app.apk

Decompiling an APK with apktool

In AndroidManifest.xml, add the following attribute to the <application> element if it is not already set:[1]

android:networkSecurityConfig="@xml/network_security_config"

Before adding:

Android manifest before adding the network security configuration

After adding:

Android manifest after adding the network security configuration

Create or update res/xml/network_security_config.xml with the following content. The system source keeps the preinstalled trust anchors, while user adds user-installed CAs:[1]

<network-security-config>
    <base-config>
        <trust-anchors>
            <!-- Trust preinstalled CAs -->
            <certificates src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/mobile-pentesting/android-app-pentesting/system" />
            <!-- Additionally trust user-added CAs -->
            <certificates src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/mobile-pentesting/android-app-pentesting/user" />
        </trust-anchors>
    </base-config>
</network-security-config>

Rebuild the APK:

apktool b app -o patched.apk

Rebuilding the patched APK with apktool

Repackaging invalidates the original signature, so sign the rebuilt APK before installing it. See the APK signing section.

References